Data Privacy Bill Advances with Significant Changes Following Intense Debate
After two years of debate, negotiation, and advocacy, S.71, Vermont’s comprehensive data privacy legislation, officially passed the Legislature this week after the House approved the bill and the Senate concurred with House changes. The legislation now heads to Governor Phil Scott.
For Vermont businesses, the final version of S.71 reflects substantial movement from earlier proposals in the House that would have made Vermont a significant national outlier. While the legislation still creates new compliance obligations for businesses operating in the state, the final product more closely aligns with surrounding states and regional privacy frameworks, creating a more workable path forward for Vermont businesses and organizations navigating increasingly complex state privacy laws.
The Vermont Chamber was a chief advocate for Vermont’s business community throughout this process, consistently pushing for a balanced approach that protects consumer privacy while maintaining regional compatibility and avoiding provisions that would unnecessarily disadvantage Vermont businesses.
Significant credit is owed to Senator Thomas Chittenden for initially sponsoring legislation grounded in a more regionally compatible framework, as well as the members of the House Commerce and Economic Development Committee, who continued working toward a practical path forward even as national lobbying groups pushed for Vermont to adopt far more aggressive first in the nation standards.
Debate on the House Floor became unusually contentious after the bill’s reporter delivered remarks that many viewed as mischaracterizing the work of her own committee and the extensive negotiations during the committee process. The representative voted against the bill she was reporting before moving on to lobby senators to reject concurrence. For an institution that traditionally operates with a high level of decorum and professionalism, this situation stood out from the normal legislative process.
The Senate ultimately voted to concur with the House version, recognizing the inclusion of an 18-month implementation timeline that provides lawmakers additional opportunity to revisit the law if adjustments are needed before it takes effect.
Key Components of the Final Bill
The final version of S.71 includes:
- Consumer rights to access, correct, delete, and obtain copies of personal data held by businesses.
- Opt out rights for targeted advertising, sale of personal data, and certain automated profiling activities.
- New requirements around privacy notices, consumer consent for sensitive data, and data security practices.
- Protections for sensitive data categories include health information, biometric data, precise geolocation, and information related to minors.
- Applicability thresholds that limit the law to businesses processing significant amounts of consumer data rather than sweeping in every Vermont small business.
- Exemptions for many federally regulated entities and data are already governed under laws such as HIPAA and Gramm-Leach-Bliley.
The Vermont Chamber will continue working with policymakers, stakeholders, and our members during implementation to ensure the law is interpreted and applied in a way that protects consumers while maintaining Vermont’s economic competitiveness.
CONNECT WITH OUR DATA PRIVACY EXPERT
Megan Sullivan
Vice President of Government Affairs
Economic Development, Fiscal Policy, Healthcare, Housing, Land Use/Permitting, Technology


