On May 21, 2024, the Vermont State Representative, Monique Priestley, announced via LinkedIn that the text of House Bill 121 for an act relating to enhancing consumer privacy as passed by both the Vermont House of Representatives and the State Senate was published by the Legislature. 

Notably, the bill provides for comprehensive data protection, including: 

• the Vermont Data Privacy Act;
• the Public Outreach and Education, the Attorney General study;
• the Protection of Personal Information, which includes the provisions relating to Data Broker Security Breach; and
• the Age-Appropriate Design Code. 

What are the changes to the bill text?

The bill, as passed by both Houses, amends the text of the bill as amended by the Senate. Importantly, the provisions related to the establishment of the Artificial Intelligence and Data Privacy Advisory Council are deleted from the bill. The bill includes, among other things, certain amendments to the Age-Appropriate Design Code as well as the Vermont Data Privacy Act.

Vermont Data Privacy Act

The scope of the bill was modified to apply to a person that conducts business in Vermont or a person that produces products or services that are targeted to residents of Vermont and that during the preceding calendar year:

• controlled or processed the personal data of not fewer than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or
• controlled or processed the personal data of not fewer than 12,500 consumers and derived more than 25% of the person's gross revenue from the sale of personal data.

The bill further amends the duties of the controller, including towards minors, and deletes the duty that a controller shall not process the personal data of a known minor for the purpose of targeted advertising. 

Enforcement

The Attorney General of Vermont (AG) would be authorized to enforce the provisions of the bill. The bill also provides for a private right of action in certain circumstances, notably, a private right of action is available to the consumer harmed by a data broker's or large data holder's violation as provided in the bill. 

Next steps

The bill will now be sent to the Governor of Vermont for signature. If enacted, the bill provides for staggered effective dates:

• July 1, 2025, for Section 1 (Vermont Data Privacy Act) and Section 7 (Age-Appropriate Design Code);
• July 1, 2024, for Section 2 (public education and outreach), Section 3 (protection of personal information), Section 4 (data broker opt-out study), and Section 8 (study on Vermont Data Privacy Act);
• July 1, 2026, for Section 5 (Vermont Data Privacy Act middle applicability threshold) and Section 11 (utilities exemption repeal);
• January 1, 2027, for Section 9 (private right of action);
• July 1, 2027, for Section 6 (Vermont Data Privacy Act low applicability threshold); and
• January 1, 2029, for Section 10 (private right of action repeal).

You can read the LinkedIn post here, the bill as passed by both Houses here, and track its progress here.