• by Wendy Davis  @wendyndavis, June 13, 2024

Vermont Governor Phil Scott on Thursday vetoed a sweeping bill that would have imposed sweeping restrictions on companies' collection and use of data, and would also have created an “age-appropriate design code” that would restrict how social-media platforms serve content to minors.

The privacy portions of the bill (H. 121), which was passed last month, would have limited the amount of data that companies can collect, curbed online ad targeting, and allowed consumers to bring private lawsuits in some circumstances.

Scott stated Thursday the major ad industry groups opposed the measure, arguing in a May 22 letter to Scott that the bill “will hinder Vermonters’ access to innovative services and online resources and significantly impair business operations in the state.”

Among other objections, the organizations criticized provisions that would have authorized private lawsuits.

“If H. 121 is enacted, Vermont will stand on its own as the state with the most onerous and unfriendly approach to privacy enforcement in the nation,” wrote the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, American Advertising Federation and Digital Advertising Alliance.

Scott stated Thursday that the bill “creates an unnecessary and avoidable level of risk,” adding that the provision allowing private lawsuits “would make Vermont a national outlier, and more hostile than any other state to many businesses and non-profits.”

Advocacy groups including Consumer Reports and the Electronic Information Privacy Center supported the bill, arguing to Scott that it would help ensure that companies “abide by a basic respect for consumer privacy.”

The measure would have required companies to let consumers opt out of targeted advertising -- meaning ads served based on non-sensitive data collected across distinctly branded sites or apps. The measure also would have explicitly obligated companies to honor opt-outs made through mechanisms like the Global Privacy Control, which transmits opt-out requests to every site consumers visit.

The legislation also would have prohibited companies from collecting or harnessing sensitive data -- including biometrics, location data and information that reveals consumers' race, religion, citizenship, sexual orientation or health -- without opt-in consent.

A separate section of the bill would have prohibited social platforms from using minors' data in ways that could result in “emotional distress” or compulsive use.

The tech industry group NetChoice urged Scott to veto the measure due to those provisions, arguing that they would violate minors' right to access content, and platforms' First Amendment right to wield editorial control over the material on their services.

NetChoice challenged a similar California law in court, and last year obtained an order blocking enforcement.