• by Wendy Davis  @wendyndavis, June 17, 2024

A coalition of advocacy groups is urging Vermont lawmakers to override Governor Phil Scott's veto of a sweeping privacy bill.

“Companies should not be profiting from the sale of consumers’ most personal data, such as children’s data or data about a consumer’s race, religion, sex life, precise geolocation, or health. The bill appropriately bans this behavior,” say Consumer Reports, the Electronic Privacy Information Center, Center for Democracy & Technology and other groups in a letter sent Saturday to lawmakers in Vermont's Senate.

The organizations add that the Vermont Data Privacy Act (H. 121) “creates important guardrails” against privacy violations.

“The current digital landscape produces, with frightening regularity, concrete harms to consumers and is leading to the erosion of our basic expectation of privacy,” the watchdogs say.

The bill, passed in May, would limit the amount of data that companies can collect, impose restrictions on online ad targeting, and allow consumers to bring private lawsuits in some circumstances.

Scott vetoed the measure on Thursday. Among other reasons, he said the provisions authorizing private lawsuits would “make Vermont a national outlier, and more hostile than any other state to many businesses and non-profits.”

Vermont lawmakers will convene on Monday and Tuesday, when they will decide whether to override Scott's veto. An override would require approval by two-thirds of lawmakers in both chambers.

The House previously voted in favor of the bill 139-3; the Senate passed the bill without a roll call vote.

If enacted, the privacy bill would require companies to let consumers opt out of targeted advertising -- meaning ads served based on non-sensitive data collected across distinctly branded sites or apps. The measure also would explicitly obligate companies to honor opt-outs made through mechanisms like the Global Privacy Control, which transmits opt-out requests to every site consumers visit.

The proposed legislation additionally would prohibit companies from collecting or harnessing sensitive data -- including biometrics, location data and information that reveals consumers' race, religion, citizenship, sexual orientation or health -- without opt-in consent.

The bill also includes a controversial “private right of action,” which would allow consumers to sue data brokers and large companies companies that process or sell sensitive data without consent.

Ad industry groups previously urged Scott to reject the bill for several reasons, including that it authorizes private lawsuits.

“H. 121’s private right of action will benefit opportunistic trial lawyers and plaintiff’s law firms rather than protect the privacy of Vermont consumers,” said the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, American Advertising Federation and Digital Advertising Alliance in a letter sent to Scott last month.

“If H. 121 is enacted, Vermont will stand on its own as the state with the most onerous and unfriendly approach to privacy enforcement in the nation,” the groups added.