Vermont Legislature SmartTranscripts:

[Rep. Michael Marcotte (Chair)]: Good morning, everyone. This is the Vermont House Committee on Commerce and Economic Development. It's Tuesday, April '26 at 09:05 in the morning. And our day on s 71,

[Sen. James Maroney (Connecticut State Senator)]: which is an

[Rep. Michael Marcotte (Chair)]: act relating to consumer data privacy and online surveillance. So we have two people lined up this morning. Katrina, good morning. Thanks for joining us.

[Katrina Fitzgerald (Deputy Director, Electronic Privacy Information Center - EPIC)]: Good morning, sir.

[Rep. Michael Marcotte (Chair)]: If you'd just state your name and your affiliation and continue on with your testimony, that'd be great.

[Katrina Fitzgerald (Deputy Director, Electronic Privacy Information Center - EPIC)]: Great. Good morning all. Thank you, chair Marcotte, vice chair Graning, and members of the committee for the opportunity to testify today in support of s 71 version 2.3. My name is Katrina Fitzgerald, and I'm deputy director at the Electronic Privacy Information Center or EPIC. EPIC is an independent nonprofit that was founded over thirty years ago to secure the fundamental right to privacy in the digital age. And in fact, senator Patrick Leahy was the first ever recipient of our annual champion of freedom award many, many years ago. I wanna commend this committee for the incredible time and effort you have put into advancing strong privacy legislation over the past few years. And EPIC supports draft 2.3 of s 71, even though I wanna note it represents a significant compromise from the bill that passed the legislature last session. In my testimony today, I'll talk very briefly about why Vermont needs to pass a strong privacy law, then I'll give a brief background of where things stand with privacy laws in other states, and finally, I'll spend most of my time talking about the most critical protection in this bill, data minimization, and what that means for targeted advertising. So as you all know, our personal data is constantly way used in ways we don't expect. Advertisers, apps, data brokers, and others are constantly tracking us. You know, every website we visit, where we're going, who our friends are, what those friends are searching for and clicking on. And they use this data in ways that no reasonable consumer could expect. In fact, ICE recently put out an RFI exploring whether it could use this ad tech data that's collected about us online without our, you know, controller consent for its immigration investigations. And I include a link to this in my written testimony, but an advertising executive recently wrote an article in an ad trade publication, and the title was, the privacy zealots were right. Ad tech's infrastructure was always a risk. And he notes that the advertising industry should have seen the government's abuse of digital ad data coming. I'll admit that that article title felt really good. And in a time when lawmakers are rightly concerned about affordability too, privacy violations have real harms that are affecting your constituents' wallets, raising the cost of everything from insurance to groceries. Last year, the Texas attorney general sued Allstate Insurance for secretly gathering location data from apps like Life three sixty and GasBuddy and using it to raise people's auto insurance rates. And the FTC recently found that retailers are using our personal data, even down to our mouse movements on a page, to target individual consumers with different prices for the same goods and services, something called surveillance pricing. And this entire online advertising ecosystem is not good for small businesses either. They're stuck paying big tech, big money to advertise with little accountability about where their ads are being shown. They end up on garbage websites or spam websites or how effective they are. So it's a bad deal for small businesses, but big tech keeps getting richer and all of our privacy suffers. But it does not have to be this way. Good privacy laws can protect Vermonter's privacy while allowing businesses to reach customers. I won't say anymore on why Vermont needs a strong privacy law. I know this committee has heard lots about it, you know, and I don't think there's anyone other than the big tech companies profiting off of it who looks at the current state of things online and thinks, you know, this is fine. Let's continue down this path. So that's all I'll say about about why you should pass a privacy law. To give a bit of background on the current state of state privacy laws, 21 states have already passed I'll call them so called comprehensive laws because, unfortunately, most of these state laws were heavily influenced by big tech and their industry front groups, and they don't do enough to protect people online. And you're gonna hear a lot from industry groups this week about making sure you're consistent with other state laws, but that's primarily because those laws do absolutely nothing to require them to change their harmful business practices, and they want them passed in as many states as possible in order to bake that status quo into law. These these laws allow companies to continue collecting and using personal data however they like, as long as they disclose what they're doing in a privacy policy that we know no one ever reads. I'm a privacy advocate. Don't have time to read them all. That being said, it doesn't mean Vermont has to start from scratch when you're writing a privacy law. And in fact, version 2.3 uses the Connecticut Data Privacy Act as its base text, but it adds a few provisions that are really critical to keep Vermonters safe online. So let's talk about those additional provisions. How does version 2.3 build on other states' laws? The rules in version 2.3 better align companies' data practices with what consumers actually expect. It sets a baseline requirement that companies can only collect and use our personal data as is reasonably necessary to provide the service or product we're asking for. So that's data minimization. Minimize the data to what's necessary. So Meta can collect information about what I do on Instagram or Facebook. They can use that information to advertise to me. They know lots about me based on that. I expect them to do that. But they shouldn't be putting trackers in every website I visit to collect and monetize my every click online like they do now. I don't expect that when I go to WebMD and look up symptoms, that what I'm reading is automatically fed to Facebook in the background. That's exactly what's happening right now. So the key with a good data minimization rule is to ensure it's tied to that, you know, product or service requested by the individual, not simply whatever purpose the business decides it wants to collect data for and discloses in their privacy policy, policy. And that's what two point three does. So what would this mean for businesses, particularly small businesses in Vermont, in targeted advertising? You know, we recently went through this a very similar debate in Maine, and if the arguments in Maine and other states are any indication, you are going to hear many claims that this bill will eliminate Vermont businesses' ability to use targeted advertising, but that is not true. This bill does not ban targeted advertising. There are many avenues to target consumers with ads under the rules in this bill. First, there are no restrictions of businesses using the data they collect directly from their customers to advertise to them. So I do business with a retailer. They can email me. They can they can send me ads. They have that information. I expect them to have it. They can also, just as they do now, reach new customers by contracting with ad tech companies to direct ads to consumers based on the profiles those companies have about people. So Facebook, Google, and other ad tech giants won't have as much personal data about me as they do today, because they should no longer have trackers on every website to surveil us everywhere we go online. These profiles should be based instead on information they collect on their own platforms, the data that we expect them to have. You know, that's exactly the point of a privacy law, to limit mass data collection and ensure that the use of personal data aligns with consumer expectations. So the hope is that these rules will encourage ad tech giants to innovate on ways to provide targeted advertising services to Vermont businesses while better protecting privacy. So warning, I'm about to get a little in the weeds here, but I wanted to walk through the advertising provisions in the bill since you'll likely hear a lot of misinformation about this in the coming days. So version 2.3 defines a few forms of advertising and sets the rules for those. So one form of advertising, what kind of how advertising had historically worked was contextual advertising. That's when a business shows an advertisement to a consumer based on the topic or the content of the media surrounding the advertisement. Right? So in the old days, this was like, I read a golf magazine, I got ads for golf balls. The current version is, say someone in New England, you know, I'm I'm in Massachusetts. Say I search for soccer scores, Vermont Green FC can place an ad on that page to sell tickets for games. That's contextual advertising. Because they're placing the ad based on the knowledge that I'm interested in soccer, and I'm in the general geographic area of the team. They don't need to know everything else about me for that. And there are no restrictions on contextual advertising in the duh. First party advertising is when a business advertises in their own store, on their own website or app, or they email me follow-up after I go to their website or store. So if I buy a hat at Orvis, they can send me an email advertising matching gloves. And as long as it's not sensitive data, businesses are free to do first party advertising under the bill. There are no restrictions as long as, you know, they're using the data that reasonably necessary for the product or service the consumer asks for. And that can include, like, I went to your website and I looked at hats. They need that information of what page I looked at to serve me an ad. So even if I didn't buy the hat, they can know that I looked at the hat and send me follow-up advertisements for it. Then there's targeted advertising. There's a couple forms of targeted advertising with different levels of risk to privacy and data security. Behavioral advertising requires tracking consumers everywhere they go online, often without their knowledge, and building invasive profiles based on that data to target them with ads. If you use a browser that blocks trackers, you may sometimes notice there's a little thing in the top corner. I go to retailer, and my browser says, 47 trackers have been blocked from profiling you. And some of the names I recognize, a lot of the names I don't. My browsing habits are being sent back to all those companies. Now, this is like the example I mentioned earlier about WebMD automatically sending the info on what page I was reading back to Facebook in the background. You know, that's for cross contextual behavioral advertising. Nearly every website you visit is sending your browsing habits back to dozens of advertisers. And we view this as the most harmful form of targeted advertising because people don't expect it. They've never interacted at most of those companies, but they know everything we're clicking on. Version 2.3 makes this type of browsing data sensitive data, so it can't be used for advertising. Another form of targeted advertising, retargeting, is what a lot of people think of as targeted advertising. Right? Retargeting is when I look at a pair of Nikes online, and then suddenly everywhere I go online, I see ads for Nikes. Retargeting is permitted under this bill, but consumers can opt out of it, including through kind of a one click universal opt out. They can set a setting in their browser being like, I don't want retargeted ads. So long and short of it is that this bill gives businesses plenty of methods to advertise while protecting the privacy of Vermonters. Will large ad tech firms have to innovate to find more privacy protective ways of doing their business? Yes. Will Facebook have to rely on data I expect them to have rather than tracking everywhere online? Yes. But Vermont businesses can still advertise. You know, right now, small businesses are beholden to big tech's invasive advertising systems. They're forced to use a system that violates their consumers' trust and waste their marketing dollars, helps their big box competitors have pads of pockets of big tech. But this bill instead incentivizes big tech companies to provide advertising in ways that better protect privacy and will also benefit small businesses. There's a lot more in this bill, obviously, including some really important protections for kids and teens and a ban on the sale of sensitive data and more. But that data minimization rule and its impact on advertising is the most important update from Connecticut and other state privacy laws, so I thought it was worth focusing on. I hope it was helpful. You know, I just wanna note again that Epic does support version 2.3, but does wanna note that this is already a compromised bill. The removal of a private right of action is a massive concession to those who were opposed to the bill last session. The AG themselves have said they do not have the resources to adequately enforce this law, and we've seen in other states that laws without strong enforcement simply do not get complied with. So I recognize the decision to remove the private right of action was done in the hopes of advancing the bill this session, and I respect that. But I do hope it's something the legislature will revisit down the line once the bill has been in effect. Thank you for the opportunity to testify today. I'm happy to answer any questions.

[Rep. Michael Marcotte (Chair)]: Thank you, Katrina. Questions for Katrina?

[Unidentified Committee Member]: Good morning, Katrina. Thanks so much for being One thing that we've heard is that first party advertising is not a standard term across the country. Can you talk about what it is, and why it is in this bill, and how it can benefit Vermont's businesses?

[Katrina Fitzgerald (Deputy Director, Electronic Privacy Information Center - EPIC)]: So, the standalone definition that's in version 2.3 for first party advertising, you know, other states have not pulled that definition out and defined it separately as first party advertising, but it is in other states. That concept is used within the definition of targeted advertising to exempt it from opt outs. So in many other states, there's a definition of targeted advertising, and it says targeted advertising does not include and then there's a description of first party advertising. So it is not an entirely new concept. It is just that it has not, you know, been its own standalone definition in in other states. The the hope the goal with it being in there is to make clear that there's no restrictions on it.

[Unidentified Committee Member]: Thank you.

[Rep. Michael Marcotte (Chair)]: Herb? Thanks very much.

[Rep. Herb Olson (Member)]: I'm thinking of controllers and I'm trying to get a handle on who they are.

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: Mhmm.

[Rep. Herb Olson (Member)]: And how big what sort of resources they have. Do you have, off the top of your head, some idea of what maybe the top five controllers are in terms of, say, market valuation? And then I have a follow-up question about enforcement.

[Katrina Fitzgerald (Deputy Director, Electronic Privacy Information Center - EPIC)]: Sure. So a controller covers any entity that's collecting data. So that's everyone from Google and Meta down to, you know, a retailer that has a website and is collecting, you know, personal data when people buy something. But in terms of valuation, it's the the big ones that you would think of. It's Google, Meta, you know, various social media companies, advertising companies that are collecting lots of data.

[Rep. Herb Olson (Member)]: Yeah. Thank you. So I'm thinking about the issue of and I appreciate, you know, you you thought that the standards in this version, you think are good ones in terms of consumers and and what they expect. I'm thinking about how you enforce something like this. And you noted it doesn't include a prior right of action. And I'm wondering how an AG's office in a pretty small state, limited resources are gonna have the capability of making the consumer rights meaningful. And I'm wondering if you've considered some states have the ability to build back to the alleged companies, regulated companies for the expenses of conducting investigations, whatever. Have you given any thought to whether that's a viable option?

[Katrina Fitzgerald (Deputy Director, Electronic Privacy Information Center - EPIC)]: In terms of the attorney general, I think I don't know if someone's been in the attorney general's office is testifying this week, but they might be better suited to answer that question. But I will say that something we've seen with attorney general's offices across the country with in states that have privacy laws is they have come together and formed a consortium to try to, you know, consolidate resources and do these investigations together because, you know, Vermont is not alone in having limited resources in their attorney general's office, unfortunately. So but they but those consortiums, I think, have been very helpful. And, you know, California has a standalone privacy protection agency, so they have more resources to try to help lead those investigations. And, you know, and in states where they have enforced their privacy laws, the penalties are pretty significant. So, even if there's not a specific provision about the investigation being paid for by the company, the penalties, when they're found in noncompliance, provide significant resources back to the state.

[Rep. Herb Olson (Member)]: Do do those penalties flow into the AG's office for their expenses or not?

[Katrina Fitzgerald (Deputy Director, Electronic Privacy Information Center - EPIC)]: I think, you know, state by state, they can decide how to allocate them. I think normally, they just go into a general fund.

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: Thank you. You're welcome.

[Rep. Michael Marcotte (Chair)]: Questions for Katrina? So,

[Unidentified Committee Member]: you testified that a key piece is the definition of sensitive data. And make sure I'm using the right terminology, but including the sort of recontextualized, the browsing history, the browsing history Being coming back, able to sell the browsing history. So I think you're justifying that a key That's a really important piece, to identify that as sensitive data. Right? Is that am

[Katrina Fitzgerald (Deputy Director, Electronic Privacy Information Center - EPIC)]: I I understanding think it's an important clarification to have it as category of sensitive data, though I would argue that even if it is not, that a good a well written data minimization rule like the one in 2.3 still prevents that type of data from being collected because it's not reasonably necessary to provide me you know, if I go to a retailer's website and I'm buying something, it's not reasonably necessary for that product or service for my information to be sent back to advertising So I think I view that as a nice belt and suspenders way to make that clear. But I think that a good denomination rule, if it's properly complied with, still does not allow that practice.

[Unidentified Committee Member]: Great. Thank you. So that helps me make sure I understand it. And then I guess my question is, of the 21 states with data privacy laws, do any of them have this provision?

[Katrina Fitzgerald (Deputy Director, Electronic Privacy Information Center - EPIC)]: Yeah. So Maryland passed the Maryland Online Data Privacy Act in 2024. It just went into effect on October. And they have very similar data minimization rules to what's in this bill. There were some detail added, including, you know, separating out that definition of first party advertising here to help clarify some of the confusion that had been communicated by business and industry after Maryland passed its law. But yes, Maryland has very similar law. The Massachusetts Senate unanimously passed a very similar bill in September, and it is pending in the House. We're hoping it passes the House very soon in Massachusetts. And other states have considered, you know, including these data minimization rules. I think last session, was 10 states, you know, introduced bills that would have strengthened their their data minimization rules. So we really view this as kinda like the next stage of state privacy laws, and we're hoping that more states kind of come along. Maine came very close to passing a bill this session, went back and forth and filed, unfortunately, on the final enactment vote by by a few votes just a few weeks ago. But, you know, New England is is leading the charge.

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: Thank you. Other questions?

[Rep. Michael Marcotte (Chair)]: Katrina, thank you very much.

[Katrina Fitzgerald (Deputy Director, Electronic Privacy Information Center - EPIC)]: Thank you all. Take care.

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: Ben? Hello. Good morning. Sorry. Good morning. Do a few things to get to the screen. Should I just begin?

[Rep. Michael Marcotte (Chair)]: Yes, sir.

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: Alright. Thank you so much for having me. My name is Ben Winters. I'm the director of AI and privacy at the Consumer Federation of America. The Consumer Federation of America is a nonprofit consumer rights organization, based here in Washington, DC. There are 200, organizations, and agencies all across the country that are members, and we focus on research, advocacy, and education to advance consumer interest. So today, and you just heard from Katrina, who was my former boss actually at Epi a few years ago, so I won't pretend to know more about her on the details of all the privacy law stuff. But what I really wanted to focus on today is the role that targeted advertising and other technologies play in exacerbating the losses that people are getting from scams and fraud online today. It is no secret or lack of concern for anybody I've I've talked to that people are increasingly receiving scam texts, calls, messages, advertisements that really run the gamut of sort of what they are putting out there, right? Whether it is a fake government program, whether it is a threat about enforcement from an agency like the IRS, the US Marshals, whether it is a romance scam, whether it is sort of using new technologies to target individuals to make it feel like someone in their life needs immediate help. We are seeing an increase in the instances and losses of scams. And the reason this ties into the privacy law is that one of the key ways that happens and the reason why the losses are getting worse and worse is because it is easier and easier to target people with those scams. Right? So we have seen stories time and time again, whether those be people that are particularly in need of a job and recently laid off, whether those are, you know, particularly targeted at older Americans, you know, whether those have like as specific as they have recently been to this hospital or they have recently missed a payment on this, or they have, you know, owed a lot on their taxes last year, the granularity of data available on the internet that is profiled, is sort of compiled from different sources and freely available on the internet is a real like dangerous attack vector for Americans everywhere, including, you know, especially in Vermont, right? So we have been investigating the different under regulated technologies that are exacerbating this this this sort of effect. And, you know, just to sort of level set some of the numbers we're talking about here, and this is nationwide, the recorded losses to the FBI for online cybercrimes alone last year for 2024 was reported 16,600,000,000 losses in losses. And this in this year, they announced just a few weeks ago that in 2025, that shot up to twenty point eight, the $87,000,000,000 lost around the country. And that is with a estimated reporting rate of somewhere between four and ten percent, frankly. Right. Most people do not report when they get scam losses. Again, this connection back is that not every single text, not every single scam is as a result of a lack of a strong privacy law in a given jurisdiction. But what the FBI, the FTC, what we have been seeing and tracking things is that increasingly social media with Facebook and their parent company Meta. So, you know, Facebook, Instagram, WhatsApp are platforms they all own. That is the vast majority of the vectors where people are losing more and more money. And then put on top of that, the use of generative AI technologies to sort of create hyper personalized advertisements, which are offered directly by platforms like Meta are making it even harder for people to detect that something might be a scam. And so, we took some of these statistics based off of the reported rates of last year and the under reporting rates that the FBI, the FTC, the DOJ, other sort of entities have estimated of how many people are actually reporting their scam losses. And it came to last year, it was about $119,000,000,000 in real loss with 12,000,000,000 in Vermont alone. And then this year, since that increase went from 16.6 to 20.8 in reported losses, the real true cost of scams is almost $150,000,000,000 And so this is something that is rising and there is no coincidence that the lack of regulation around the way data is used, sold, abused, targeted, everything plays a huge role. I just wanted to talk through a little bit some of the examples in a lawsuit that we filed here in DC against Meta just last week. We sued them after reporting significant reporting over many years showed that they facilitate targeted advertising of scams and they do they consistently misrepresent the safeguards that they say they implement. They misrepresent whether they are even able to not whether they're able to because they actually are able to and we can show that. Whether they actually pull down advertisements, whether they ban advertisers, and whether they sort of pause and choose not to facilitate the targeting of individuals when people want to take scam advertisements on it just in the same way that you would want, you know, to be able to have your local taco restaurant be able to put out ads to people in a given city, right? The sort of difference is not significant to Facebook, but what we have seen in the reporting is that they both know that these advertisements, when they are scams, are likely to be scams, and they don't just reject them. They charge a higher rate for them. And if you go back to what I was saying about the 2024 number of the FBI reporting over $16,000,000,000 losses that were reported on online scams throughout the whole country. It was reported and confirmed by Meta themselves that 10% of their revenues, which is $16,000,000,000 came from scam ads that they knew were scams in that same year. So I think that again, there's no silver bullet for scams. There's no silver bullet for data abuse, but these are absolutely sort of connected phenomena. And of course behind these reports and big spreadsheets and big numbers are like shattered families, rent money lost, grandmother's exploited. And this newer technology is leading to a rise in these scams, both severity and number. The FBI report just last year, just last few weeks ago, said that this was the first year they were specifically asking about AI scams and that there was almost $900,000,000 reported in known AI scams. And again, I know we're not talking about an AI bill, we're talking about a privacy bill, but there is really no separating. What I like to say is that not all AI policy is privacy policy, but all privacy policy is AI policy because AI is only sort of being able to be used through data. It only is existing in the way it is existing right now because of the lack of privacy laws. And again, to reiterate the point, the most important critical point is that without a data minimization rule, the ability for people to target advertisements or scams is sort of alive and well. And it's not just Facebook, right? They are the most well known in this place, but even just data brokers more broadly, they are able to sell really specific lists of people. In 2020, there was a case brought by the Department of Justice against a company called Epsilon. They were selling a specific list of elderly people who have shown begin to show signs of dementia. And they would use that list freely available on the internet, not freely available, available for a small cost, but available nonetheless to anybody who wanted to do it. They bought it and then used that list to send direct mailers that were complete scams. And so we are glad that one is caught, but those types of data segments are only existing because there is a failure of strong privacy laws around the country. And so wherever we can get strong data minimization rules, I think that in addition to all of the reasons why you've heard from privacy advocates and academics and everyone so far that we need privacy laws, it will also increase the safety of people's wallets and just sort of day to day lives and families. That's just a part of the reason why we need these laws and I see that it's at 09:36 already so I will stop and take any questions. But again, thank you for the opportunity to talk to you today, and I'm happy to send some of the resources I'm referencing in the sort of scam ad space.

[Rep. Michael Marcotte (Chair)]: Thank you, Ben. Questions for Ben? Monique?

[Rep. Monique Priestley (Clerk)]: Thanks, Ben. I was just wondering if you could tie together, so the National Bureau of Economic Research did a study about when the reduction in tracked data actually reduces the amount of complaints. I'm just wondering if you, like, tying that to things like the questions about sensitive data that, like, and minimization that literally like, correlation between less data and reduction in scams and fraud.

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: Yeah. Absolutely. I mean, I think that, as I mentioned, like, some of the most dangerous ways we're seeing the lack of data modernization rules actually manifest is the fact that you have sensitive data out there that can either be combined or just by itself sold, shared, used, and manipulated. And so, you know, it is more likely that a scam will be sort of successful that people will, you know, give that information, give that money when it is targeted at them, whether it is by name, it is by some sort of weakness they perceive they have, whatever it is. And so, yeah, I think the more sensitive information that is out there, the more attack vectors there are for people. And so I think that we, you know, have seen that and unfortunately to your question and endpoint previously, like, we are seeing an increase in it as we are seeing sort of an increase in reports and a decrease in data protection and a decrease in enforcement resources at the federal level. I do not think those are coincidences. And so I think that that sort of correlation absolutely sort of rings true more broadly.

[Rep. Herb Olson (Member)]: Yeah, thanks very much, Mr. Winters. The previous mentioned Google and Meta as controllers or, you know, large companies that were acting in a controller type of capacity. Those are huge companies.

[Sen. James Maroney (Connecticut State Senator)]: Yeah.

[Rep. Herb Olson (Member)]: It always seems like they're quite quasi sovereign entities within our country. Yeah. And I'm worried about the ability of the Vermont attorney general to be able to enforce Yeah. This bill if it does become law. And I'm thinking of, yeah, you could join together with other Attorney General's office, but you need to have kind of a common claim in order to do that. Sure. Maryland is the only state that would have similar data minimization requirements. What's your perspective on the back? And do you think some additional authority needs to be given to the attorney general?

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: You know, I think I and thanks for the question. I agree with the last to start Katrina that we need and in an ideal world would have a right of action for exactly that problem that you are diagnosing. But I think that, you know, with Maryland, if Vermont passed a similar standard, what we have seen is that these privacy laws do go a little bit on a trend, right? I think that if more states pass this type of protection, it is more likely to beget other states to update their laws and do the same thing. It is starting a little bit of a trend. We saw some a trend of really bad privacy laws, and we are seeing a little bit of progress away from those. And I think that's one part of it. I think a second part of it is that, you know any additional resources for the Vermont Attorney General that can be done, whether those are investigative technologists, those don't even have to be hired right there are really creative and cool arrangements where people work with researchers in academia, where there are sort of third party technologists that are really willing and ready to help with investigations. Before this position, I was at the Department of Justice, and I can really tell from experience how hard it is do these types of investigations, regardless of how many resources you have. But, you know, that doesn't mean that we shouldn't do it. That doesn't mean that we shouldn't have the opportunity to do it. The more enforcement, whether it is of the medium sized, large sized ones, whether there's clear common violations. I think the more enforcement actions are able to be pursued, I think the easier they get frankly, right? There is that fact finding that is done that is common to the underlying claims. That is one of the biggest problems of it. And also, attorney general around the country have shown a willingness and ability to really step up, especially right now. And there still remains these agencies that will hopefully at the federal level be funded the extent they deserve to be one day. So, you know, I think there's not a clear and perfect answer of a way it'll be super easy, but I do think that it's worth doing and going moving towards and that the AG can definitely, start to handle that at least.

[Rep. Herb Olson (Member)]: Thanks very much,

[Rep. Michael Marcotte (Chair)]: Michael. You

[Rep. Michael Boutin (Member)]: mentioned earlier that you were part of a lawsuit, correct?

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: Yep.

[Rep. Michael Boutin (Member)]: So I don't know the details of that. Was there damages we see for that?

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: Yeah, so are the named plaintiff in a class action. We just filed it yesterday. Or no. Last week. So the organization in DC organizations are allowed to be the named plaintiff for our class actions for violations of the DC consumer protection act. It's $1,500 per violation, a perfected user. So we are, you know, depending on what the class ends up getting certified as, it would be a significant amount, especially given the relatively high concentration of people here in DC. And then we are also seeking injunctive remedies for them to employ specific and better standards and sort of safeguards against these ads getting through.

[Rep. Michael Boutin (Member)]: Does that so $1,500 per person? How many people are part of this lawsuit?

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: So the class has not been certified in the court yet. And so we don't have an answer to that yet, unfortunately. It'll depend on it'll sort of it'll be a fight in court about exactly what the defined class is. If the defined class in DC would be most of the Facebook users, then we're probably looking at something like 600, 700,000. But that's really off the top of my head. It will really depend on on what the the court sort of says. So, you know, I don't think this is a thing that we are trying to really hit them in their wallet. It's hard to do that with Facebook, frankly. Right? We have seen them pay billions and billions in fines. And so we would not get to that point. But I think the injunctive remedies are a part of it and also strengthening the sort of standing and the precedent here in DC is another priority for us.

[Rep. Michael Boutin (Member)]: So, attorney Carter just did the numbers. It's about $900,000,000,000 in fines. So if they settled, your firm would be benefiting from any settlement, correct? Because you take I assume you take a percentage of the

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: I don't have our agreement with our offer. We're in the organization. We're represented by two law firms. I don't have agreement on him. But, yeah, I mean, we're we're trying to we would try to get most of it directly back to the affected individuals, the members of the class, and that's sort of facilitated by a third party. And I think, yeah, we would we would we would remain retain some percentage to try to, you know, advocate for policies that would advance this stuff.

[Rep. Michael Boutin (Member)]: That's I I think that's my problem with the PRA is it creates a kind of a cottage industry within our state for torque cases. The PRA Listen. It's not the PRA. Argument that's being brought up now two times is that we should add it back in. So I'm just I'm just pointing out in a suit isn't using the PR. He just said So

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: D DC doesn't have a privacy law.

[Rep. Michael Marcotte (Chair)]: That's classified sanctions.

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: We're we're using the DC Consumer Protection Act. Many states throughout the country and then D. C. Have private rights of action as part of their unfair intercepted trade practice authority. And, you know, I think, you know, it is not this is not something we are doing for profit, and this is we are a nonprofit organization. I think that, you know, people are being harmed and individualized harm needs individualized remedy. And I think to the the last question, it is really hard to try to get a small attorney general office or attorney general offices, even if it was 15 states worth to be able to investigate, do the litigation and actually sort of get the best resolution for their constituents. And so I think that in every situation, will be bad apples. There will be people that are seeking profit for bad claims for things that don't make sense. I think there is the court processes for frivolous claims. There is sort of a lot of certain ways. So I think we need to have that trade off, right? There will probably be a few bad apples that bring BS lawsuits, BS claims, but that is not necessarily something from my perspective at least that outweighs benefit of when people are really harmed. And we are seeing for years and years and years and years, any lack of resolution, any lack of action from a lot of enforcement agencies, I don't know what people should be able to do. So that's why I recognize there is a compromise here. I think that data minimization standards, the standards in this bill as currently states would be great. And that most times politically right now, the private rate of action is not popular, but I do think that, you know, it's a important step and move, I don't think it would be more frivolous suits than the positive suits.

[Rep. Monique Priestley (Clerk)]: Ben, could you just repeat the numbers for the amounts and billions of dollars that individuals are losing because of clicking on scams and then the number that Facebook is making off of serving up fraudulent ads?

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: Yeah. And just to caveat, like, this is just the one leaked memo from 2024, so two years ago. And this is that just the knowing scams is $16,000,000,000 off from Facebook and what they knew from from scam advertisements. And then there are lots of other ads that they have, like, some degree of certainty that are likely scam ads, but maybe not. And then more broadly, the FBI just three weeks ago reported that $20,870,000,000 were reported in scam losses this year. And again, reporting alone, depending on who you ask, whether it is Department of Justice that said, or the FTC that said, it's likely that only 4% of people actually report their losses up to the Bureau of Justice Statistics at the Department of Justice that says 14% of people, that's the highest level. If you extrapolate out, that is, you know, that 20,800,000,000 is really, you know, 140 something billion dollars likely if you extrapolate out. Obviously, there's, you know, you can quibble with this, go over there. But it isn't the many billions of dollars that people are losing and that people, specifically companies like Meta, are profiting from that we know of at least.

[Rep. Michael Marcotte (Chair)]: Ben, thank you very much.

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: Thank you. Have a great day.

[Rep. Michael Marcotte (Chair)]: Senator Marrone, good morning.

[Sen. James Maroney (Connecticut State Senator)]: Good morning. And I I do apologize. I got stuck in standstill traffic on my way up to Hartford, so I am calling it from from my car. So I'm not gonna put the camera on.

[Rep. Michael Marcotte (Chair)]: Well, you for joining us. I appreciate your time.

[Sen. James Maroney (Connecticut State Senator)]: No, thank you. And just wanna, I guess, start, I guess my understanding is I have a few minutes to talk and then answer your questions. I'm not gonna testify to the specifics of this bill, just talk more about process we've gone through in Connecticut and build on a little of what Bennett said. So when Connecticut, when we passed our bill, we were the at that time, the fifth state to pass the consumer data privacy. But since then, we've gone back and amended it. So we passed it in 2022. We amended it in 2023, 2024, and again, wait, 2023, 2025. And then again, this year we have amendments that have made it out of the Senate and have yet to be called in the house, but are on the calendar for the house. And so I think, you know, one of the things we you know, we're talking about how attorney generals sometimes work together, you know, the legislators around the country, we also work together and build off of the work that the others have done. And so that's one of the things why we had gone back to amend was when we had seen changes that other states had made. And I guess one of the the things last year, we updated our sensitive data definition based on what had been done in Oregon and looking at, you know, some of the other changes we've made from other states. We updated last year to add the right to see what third parties your data had has been sent to. Also, we updated based on Minnesota some of the rights with regards to the automated processing on some of what Steve Steve had done and Steve Elkins representative Elkins had done in Minnesota with our bill. And so I think that's an important to notice that it's not what you pass is not necessarily up. I think that this is not static like all laws. Right? We're not etching commandments in stone. We're writing laws, and laws are meant to be updated as we learn more, see what other states are doing. And then, you know, sometimes you discover issues that you need to clarify, which we've seen happen in other states, and then sometimes there are additional harms that we need to mitigate. And so last year, we updated our definition of heightened risk of harm to minors to try to put more protections in for minors. And I think when I go through the bills each year, I'll think of, I have certain things that I know are important to me that we want to protect. And so this year when we updated our bill, we were looking at facial recognition, and so with sensitive data, the biometric data to identify a specific individual is supposed to be sensitive, you supposed to have to give your permission, but we found that some grocery stores and other stores were using facial recognition, citing the security theft and fraud exemption. And so this year, we wanted to to clarify how facial recognition could be used. And I think that's one of the other things to point out is whenever you create actually, I'm stopped now. So I guess I can put my camera. I pulled into a rest area. Traffic started moving. So, actually, maybe it's better. I'll scare you less if I have my camera off. But but we did one of the times we had to update our exemptions was based on what we were seeing in other states. We updated we had given the entity level exemption for Gramm Leach Bliley Act. And in Texas, they were, they found that, car dealers were claiming the GLBA entity exemption because they had finance units. And so we updated ours and tied our exemption to state regulation like Oregon had done, and so I think that is one of the good things now. We've seen, you know, about 20 states have passed comprehensive privacy, and so there's been a lot of learning on what works. I think another thing I'd point out is it's, know, kind of building off what Bennington said. It's not necessarily, I guess the strength of the law, but it is just as important as the strength of the law is the enforcement, whereas in Texas we've seen that that is probably seen as a more business friendly version, and we're all kind of off the same framework, However, they've done rigorous enforcement in Texas. So I think being able to enforce is important, and putting money towards enforcement is important. I think the multistate work, you know, we have seen, you know, the AGs work together. I know our AG, Michelle Lucan, has introduced me to AGs from California and Oregon. We've had to come in and talk to us when they were working on issues and to learn from them. And so I think just as legislators are working together on this, AGs work together across states. So I guess with that I'd open it up to see if anyone had any questions, if there are any questions about things we've done in Connecticut or and again, I think each state is different and you kind of we were all working off of the same framework, and then sometimes, you know, a state will something is especially important for that state, right, and or for that legislator, and that's where we will see sometimes there are changes and differences between the laws, but for the most part it is by sticking within that same framework, it makes it easier for businesses to comply across states.

[Rep. Monique Priestley (Clerk)]: Thanks senator, you've made significant changes, so the version that passed by the Senate was a copy that more closely resembles your bill from a couple years ago. And as you said, you've made changes that are actually, I was surprised with the number of changes you've got through in 2025. And I guess I was just wondering your recommendation of starting at a point that's a couple years old versus building off of a point that you basically, like up until what's enacted now for you.

[Sen. James Maroney (Connecticut State Senator)]: Yeah. It's a good question. Right. We've changed. 2023, we added children's protection. So initially, we were only up to 16 for our children's protections. We went up to 18. Last year, we went further on the children's protections because, you know, we had all we allowed them to opt in for the the tracking and sale of data, but as our AG point out, children are 18. They really can't sign a contract, so we did a strict ban last year. I would say, yeah, start from this is it's not it's not a static. It's more dynamic to privacy, but I would start from where we are now, right, versus where we were. Maybe not that, you know, the amendments that haven't yet passed, so but from what we were able to pass last year and what's being enforced, right, and that's a way to and that's what I always looked at, what what's been in effect in other states. Right? Yeah,

[Rep. Herb Olson (Member)]: thanks very much. So it seems to me there are a bunch of different options states can take in terms of how to enforce the consumer privacy protections that you enact. What did Connecticut choose in terms of how to enforce

[Rep. Michael Marcotte (Chair)]: those provisions?

[Sen. James Maroney (Connecticut State Senator)]: Yeah, and so we're solely enforced by the AG. You know, we do have the consumer, like, think Ben had mentioned, are we use CUPA, so the Connecticut Uniform Trade Practices Act for our enforcement. CUPA does include a backdoor or include a PRA, although we have not allowed for the PRA on our on our privacy laws. I think what we've seen in in some what I've noticed in some states is anything regarding children, it seems like there have been PRAs are more likely to pass. Right? And the children's protections, I think we all agree, and we need to protect the children. It it's been harder to get a a PRA, I think, in the comprehensive privacy, but again that's kind of an individual state decision. We have the first our AG's office had the first data privacy unit within any AG in the country. So we had a unit that was enforcing the data breaches and the others that's been very active, and they do our enforcements.

[Rep. Herb Olson (Member)]: Yeah. Just follow-up question. Does Connecticut's AG's office have the ability to bill back for the expenses of their examination?

[Ben Winters (Director of AI & Privacy, Consumer Federation of America)]: I

[Rep. Herb Olson (Member)]: may not have made that clear.

[Sen. James Maroney (Connecticut State Senator)]: Yeah, no, I'm sorry. I would need to look at that. So we're updating our data breach laws this year. So I know in the data breach we're adding in that they can if it passes, you know that but they are looking to be able to get the cost of the forensic audit covered by the companies. I'm not sure if they're able to to build back for their expenses. I would have to because that's in the I'd have to check within the cut by statutes and get back to you on that.

[Rep. Herb Olson (Member)]: Thanks very much. Yeah.

[Rep. Monique Priestley (Clerk)]: Senator, could you talk so I know the the AG does a regular report in which they provide, basically, like, thoughts about their ability to enforce indoor areas that need to be updated on a regular basis as well that you are then working off of. I was just wondering if you could share a little bit about that kind of like process.

[Sen. James Maroney (Connecticut State Senator)]: Yeah, you know, every year our AG issues a report, it's been very helpful, and then what we're on their enforcements and what they've had to do, and so what they find is that a lot of the complaints that come into the office tend to fall under one of the exemptions, and that's why we went back and narrowed the exemption for GLBA. This year their recommendation was tightening up on the publicly available information definition. So last year and this year we tried to actually copying is the sincerest form of flattery, we tried to flatter Vermont's AADC publicly available information by copying that definition. You know, there are different concerns when it's a comprehensive privacy versus, you know, the the state has a I guess, a more of an interest in protecting children, so we weren't sure if we could copy that exactly, took out small pieces of it, but that is very useful having the AG do an enforcement report, and that we are able to then see where the weaknesses or where they make recommendations that we should update.

[Rep. Michael Marcotte (Chair)]: Hey. Unfortunately, we're being called to the floor now.

[Sen. James Maroney (Connecticut State Senator)]: Okay.

[Rep. Michael Marcotte (Chair)]: So but we appreciate you taking the time to talk with us today, and if we have more questions, is it okay if we touch base with you?

[Sen. James Maroney (Connecticut State Senator)]: Yeah. I am happy. Please feel free to email, call, text, and I'm happy to help you however I can.

[Rep. Michael Marcotte (Chair)]: Great. Thank you very much.

[Sen. James Maroney (Connecticut State Senator)]: Okay. Thank you. Have a great day.

[Katrina Fitzgerald (Deputy Director, Electronic Privacy Information Center - EPIC)]: Thanks. You

[Sen. James Maroney (Connecticut State Senator)]: too. Goodbye.

[Rep. Michael Marcotte (Chair)]: Bye bye. So before we sign off, I just want everybody to know that Rick has done a red line comparing Yes. To 71, so it's now on our web page for today as well. So Great. I just wanted everyone to know that. So we're on the floor now. So after the four caucuses, lunch, back here at 01:00 to continue the discussion. So we will be back.