Lawmakers want to impose new guardrails on an opaque industry that’s profiting from the sale of Vermonters’ sensitive personal information.
The Vermont House of Representatives gave preliminary approval Tuesday to a bill that would let residents tell data brokers to delete the troves of personal data collected by those companies.
Bradford Rep. Monique Priestley said residents have become unwitting participants in a global data industry that generates hundreds of billions of dollars annually from the sale of phone numbers, location histories, political affiliations, health conditions, biometric data and other information.
Priestley said the legislation, modeled after a 2023 California law, provides a level of consumer agency that existing state and federal laws do not.
“It gives Vermonters something they don’t have today — the right to say ‘no’ — to request the deletion of personal information, to interrupt the sale of their personal information,” said Priestley, a Democrat.
Vermont would be the second state in the nation to adopt a so-called Delete Act, and data privacy watchdogs are watching the debate closely.
The legislation would function much like a “do not call” list, John Davisson, deputy director of enforcement at the Electronic Privacy Information Center, told lawmakers earlier this year.
“Make no mistake, brokers pose a threat to us all through the vast range, depth and scale of the personal datasets and products they make,” Davisson said. “Our personal data can be a powerful weapon in the hands of the highest bidder, depriving us of our privacy, safety, peace of mind and control.”
Zachary Tomanelli, with the Vermont Public Interest Research Group, said the bill corrects a “market failure” that has allowed companies to commodify consumers’ personal assets — their information — without their consent.
“Most people have no idea which data brokers hold their information or even that many of these companies exist,” he said. “This means that consumers never actually agreed to provide these companies with their information in the first place.”
The bill requires the more than 300 data brokers registered in Vermont to prominently display an information-deletion option on their websites. And it directs the Vermont Secretary of State to provide links to those opt-out features.
“Our personal data can be a powerful weapon in the hands of the highest bidder, depriving us of our privacy, safety, peace of mind and control.”John Davisson, Electronic Privacy Information Center
The legislation has drawn concerns from banking and insurance industries that rely on personal information sold by data brokers to underwrite policies, for example, or verify customers’ financial histories.
Chris D’Elia, president of the Vermont Bankers Association, said his members view data privacy as “paramount to building trust with our customers.” But he said the industry can’t provide critical services without access to those customers’ personal information.
“If you come in and apply for that loan, and in our due diligence we go out and we need to verify you … and that data doesn’t exist, then how are we going to give you that loan if we don’t do the proper due diligence on our part?” D’Elia said.
Priestley said the legislation includes “use case” exemptions that will preserve data brokers’ ability to maintain data that’s used for legitimate business purposes. That “use case” approach, however, would be unique to Vermont. And Castleton Rep. Zachary Harvey, a Republican, said the untested framework risks potentially severe consequences for consumers.
“We would be making Vermont an outlier in a way that degrades fraud prevention, complicates insurance underwriting, and ultimately makes credit and financial services harder to access to Vermonters,” Harvey said Tuesday.
That concern is shared by Republican Gov. Phil Scott, who’s vetoed previous data privacy bills on similar grounds. According to Scott’s spokesperson, Amanda Wheeler, “the governor believes we should be more aligned with other states, rather than be a regional outlier.”
