The legislature has introduced a new version of a data privacy bill that was discussed last year, pulling from laws in Connecticut and Oregon. The bill contains a small business exemption that will support Vermont’s smallest businesses from undue burden, but it also contains a private right of action that could lead to costly lawsuits. In the absence of comprehensive federal data privacy law, state legislatures have been passing a patchwork of different, and sometimes conflicting, laws.

These laws regulate how companies control and process personal data in an economy that is relying on it more and more. They can be important consumer protection tools but also have the potential to create confusion and challenging burdens in the marketplace. Nationally, the Information Technology and Innovation Foundation has estimated that state privacy laws could impose costs of $98 billion and $112 billion annually. Over 10 years, these costs would exceed $1 trillion. The burden on small businesses would be substantial, with U.S. small businesses bearing $20–23 billion annually.