Attorney General Charity Clark issued the following statement in response to Governor Scott’s veto of H.121, An act relating to enhancing consumer privacy and the age-appropriate design code:
“I am extremely disappointed in the Governor’s decision to veto H.121. The process to arrive at this bill took years of public forums, research, broad and various testimony, and collaboration among the Legislature, my office, industry groups, non-profits, small and mid-sized businesses, and consumers. The Governor’s Office and Administration were almost entirely absent from this process and may lack the relevant and important knowledge that would have been gained had they participated. All of the efforts made culminated in a strong and thoughtful bill Vermonters can be proud of. Indeed, the Legislature has already considered the issues raised in the Governor’s veto letter. I would like to correct some misstatements and misunderstandings.
A private right of action. To say that the bill’s private right of action – a right that Vermont consumers have had since the Consumer Protection Act was enacted in 1967 – “would make Vermont a national outlier, and more hostile than any other state to many businesses and non-profits” is simply false. Because I know the Governor is operating with the best of intentions and in good faith, I wonder if he may be responding to an earlier version of the bill, which made available statutory, or pre-determined, damages under a private right of action. Under the final version of H.121, individuals have a right to sue only for actual damages suffered and – significantly – only where a violation involves sensitive data, such as a Social Security number or biometric data, like your fingerprint or face. Moreover, small and mid-sized businesses are removed completely from this private right of action. Only entities holding data for 100,000 or more consumers are subject to the private right of action. In addition, a private right of action generally vests after a minimum 45 to 90-day period during which a data holder has an opportunity to take corrective steps. To the extent small businesses are communicating fear, as the Governor states, my hunch is that they are responding to the same misinformation to which the Governor is responding. In contrast to this misinformation, this is a small business friendly bill. And, if that weren’t enough, the private right of action provision sunsets in 2027, allowing time for reflection and reporting to occur to see if any fears are realized before the right is re-instated.
Moreover, without a private right of action, enforcement will fall solely to the taxpayers in the form of the Attorney General’s Office bringing enforcement actions for violations of the bill. I firmly believe the costs of violating the privacy of your sensitive data should not be transferred solely to the taxpayer, rather than allowing Vermonters themselves to hold violators accountable when their data privacy is violated under the bill.
Age-Appropriate Design Code. I was perplexed by the concerns about the so-called “Kids Code,” given that the effective date of the relevant provision is pushed out to July 1, 2025, to allow for clarity from courts looking into these issues now, including the appeals court reviewing the lawsuit the Governor referenced. Furthermore, while the “Kids Code” provision of H.121 is similar in some ways to California’s law, we had the benefit of the California court’s ruling, allowing us to incorporate changes to the concept into H.121. Further, even if my office needs to defend the law, we do not anticipate needing additional resources, which I have already communicated to the Governor’s Office. Again, I appreciate the Governor’s concern, but as Attorney General, I am best positioned to determine the capabilities and needs of my office. Defending a lawsuit based on H.121 would not present an additional expense to my office.
Importantly, as my office has learned through our investigation of Meta and TikTok, social media’s harmful impacts on the mental health of teenagers warrant this legislation. I am sure most policymakers and lawmakers have heard from parents and teachers what I have heard: a plea to act to protect children from the harmful impacts of social media. The “Kid’s Code” provisions of H.121 are designed to do just that.
Small businesses. Turning to the Governor’s concern about small businesses, my office is genuinely perplexed. As repeatedly described, small businesses are completely removed from the scope of the bill. The bill applies only to businesses holding the data of 25,000 or more consumers. This bill simply does not apply to mom-and-pop shops. To the extent that businesses already market and sell nationally, the elements of the bill are modeled on other jurisdictions, primarily Connecticut, the very law after which the Governor said he thought we should model H.121. The Legislature heard testimony from Connecticut lawmakers who advocated for improvements to their own law, some of which were incorporated. These changes were made in part in anticipation of similar changes occurring to Connecticut’s own law. Additionally, the Vermont law actually provides more flexibility to Vermont businesses in its data minimization provisions – something Vermont businesses requested. In other words, Vermont businesses themselves requested deviations from the Connecticut model, in contradiction to the Governor’s assertion that blind conformity to the Connecticut model would benefit Vermont businesses.
Importantly, businesses won’t have to implement H.121 alone; we are going to do it together. My office’s Small Business Advocate and attorneys will put out guidance, templates, and webinars, and, of course, be available for questions as we continue to be with past data privacy laws passed.
Urgent need for this legislation. Finally, the benefits that H.121 will bring to Vermont consumers and children are entirely overlooked in the Governor’s veto letter. Instead, the Governor has chosen to focus on the “significant fear and concern among many small businesses” – again, a group that has been completely removed from the scope of the bill – rather than the significant fear and concern among many parents and consumers. Facial recognition can let strangers identify us on the street. Geolocation tracking apps and spyware can map our physical location. Artificial intelligence tools create “deepfake” videos of political leaders, celebrities, and children in sexual settings that are indistinguishable from reality. Social media algorithms collect data they sell and use to addict children to their screens. Data brokers sell our information, including predictions about our interests, our personalities, and our vulnerabilities, to anyone willing to pay for it.
The Legislature should be proud of the profound step they have taken to protect Vermonters, especially children. H.121 represents a paradigm shift: Our data belongs to us, not the companies that hold or process it. The bill also aligns our data privacy laws with Vermont’s values of privacy and personal freedom. On Monday, the Legislature has a tremendous opportunity to deliver to Vermonters the most impactful consumer law enacted in decades. I urge them to override this veto.”
CONTACT: Lauren Jandl, Chief of Staff, 802-828-3171