Vt. Legislators Punt Comprehensive Privacy Bill to 2026; Summer Talks Planned
Vermont’s comprehensive privacy bill won’t pass the legislature in 2025, the second year in a row that sweeping legislation by Rep. Monique Priestley (D) has failed to become law. At a livestreamed House Commerce Committee meeting Wednesday, Priestley said legislators “ran out of time” to finish the bill this session, particularly with more pressing housing and education measure before the legislature. However, to tee up summer talks about privacy, Priestley said she plans to post an amendment restoring the Senate bill to the original House version, with some changes.
Sign up for a free preview to unlock the rest of this article
Priestley's privacy legislation got further in 2024. Last year, her comprehensive privacy bill passed the legislature, but Gov. Phil Scott (R) vetoed it due to its outlier private right of action and other concerns. At Wednesday's meeting, Priestley said stakeholders continue to disagree on enforcement and data minimization language, especially.
The state lawmaker is “trying to work on data-minimization changes in coordination” with other New England states, she told the committee. Connecticut is considering adding data-minimization language to its privacy law (see 2505140067) through a Sen. James Maroney (D) bill, while some pending Maine (see 2505230037) and Massachusetts (see 2505130041) bills contain controversial minimization language that’s similar to the content of Maryland’s privacy law. Priestley considered adapting Connecticut’s approach, but ultimately decided it’s not an ideal model to copy because Maroney is dealing with his own "local political pressures," the Vermont rep said.
While talks on that issue will continue over the summer, Priestley plans to propose a “strike-all” amendment to the Senate-passed S-71 by the weekend, she said. S-71 started as a copy of Priestley’s H-208, with a private right of action and strict data-minimization rules. However, a Vermont Senate committee replaced the bill's text with an industry-favored proposal (see 2503140056).
Priestley’s amendment would scrap the Senate text and replace it with her original bill language, while making some changes in response to concerns, the Democrat said.
For example, it will no longer include a year-by-year step down in applicability thresholds, which would have expanded how many businesses are covered by the proposed law one or two years after it takes effect. The amended bill would say that the legislation applies to Vermont businesses that control or process personal data of at least 25,000 consumers, or at least 12,500 consumers while deriving more than 25% of gross revenue from selling data.
The forthcoming amendment will tweak the private right of action so that individuals may only sue companies with $500 million or more in annual revenue, a significant increase from the $25 million threshold in the original H-208. Under another change, the bill would now define a large data holder as an entity that processes personal data of at least 200,000 Vermonters, up from 100,000 in the original.
The Vermont Public Interest Research Group “supports legislators' plan to use the off session to continue to shape the critical elements of this bill -- specifically the data minimization standard and effective enforcement via a private right of action,” emailed Zach Tomanelli, VPIRG consumer protection advocate. The Senate-changed version of S-71 “offers Vermont consumers little in the way of meaningful data privacy protections,” so “Vermonters would be well served by having legislators use this time to track improvements to data privacy legislation in other states and continue to engage with stakeholders.”
Vermont legislators also plan next year to consider Priestley’s bill to protect the privacy of certain public officials and their families (H-342). S-71 and H-342 can carry over to next year’s session without having to start from scratch procedurally.
However, Priestley’s kids code bill is still in play this year. On Tuesday, the Vermont House passed S-69, which proposes requiring an age-appropriate design code (see 2505270042).
S-69 could soon go to the Senate floor after clearing the Institutions Committee by a 3-0 vote at a meeting Wednesday. Two committee members were absent. The Senate previously passed S-69 but now must agree to the House's changes.
The House amendments made the bill clearer, said Chair Wendy Harrison (D), though she asked why the other chamber removed applicability thresholds meant to carve out small local businesses from the bill’s scope.
The House heard from legislative counsel that it needed to "tread lightly," explained Rep. Tony Micklus, a Republican co-sponsor of the measure. If Vermont exempts certain businesses but not others, "we're beginning to cross that line of free speech" and it starts to look like the bill is targeting Big Tech, he said. "And that's not what we're doing here. We're here to protect the children.”
Noting he has a background in IT, Micklus disputed concerns that it would be hard for businesses to implement higher safety standards for children by default. “I don't think it's a big ask for [platforms] to default to the most private settings.”