Vermont Legislature SmartTranscripts:

[Michael Marcotte (Chair)]: Good afternoon, everyone. This is the Vermont House Committee on Commerce and Economic Development. It is Thursday, 04/30/2026 at 02:20 in the afternoon. We're back from the floor, and we'll continue to take testimony on this. Justin, you're up next. He's not with us. We had Mr. Kirk.

[Unidentified Committee Member]: I texted him. I saw him. Okay. Heard he was planning to be here on June 4.

[Michael Marcotte (Chair)]: Okay. Valco, do you want to?

[Unidentified Committee Member]: Yes. Yep. Good

[Falko Schilling (Advocacy Director, ACLU of Vermont)]: afternoon. For the record, my name is and I'm the advocacy director for the American Civil Liberties Union of Vermont. Just for some context, the ACLU is one of 54 nationwide affiliates of the larger American Civil Liberties Union, and we work to protect and defend the civil rights and civil liberties of everyone calls the state home. So I'm gonna be speaking with you today at a high level to offer some support for s 71, because the ACLU has a long standing commitment to a number of the rights implicated in this bill, including reproductive rights and general rights, especially those covered by the the Fourth Amendment. So well, s 71 is, you know, doubtlessly a data privacy bill. It also does a lot to help protect other fundamental rights implicated by the current data use practices that exist. In particular, as I said before, Fourth Amendment rights and also the rights of folks trying to access reproductive healthcare, as well as rights of folks who might be seeking asylum or might be undocumented. And so I wanna speak a little bit just in terms of some of the concerns we have around the current data landscape and how we've seen consumer data used to target folks and especially through governmental entities. So first, attacking reproductive health care and reproductive rights. In 2024, the Federal Trade Commission brought enforcement actions against a half dozen data brokers for not only selling location data, but marketing as revealing business to hospitals, oncology centers, and other medical centers. Our data can often reveal access to abortion and gender affirming care. And, for example, a report by four zero four Media detailed how one dataset shows a phone being beginning a day in mid June in residence Alabama crossing state lines and visiting another abortion clinic for approximately two hours. Similarly, there's information and data collected by period trackers, fitness apps, or even brick and mortar retailers that may reveal or provide means for predicting someone's pregnancy status, and such data has been weaponized by folks to target people who are accessing health care in a way that they do not agree with. Another way that we've seen data used in a way that can be harming folks within the borders of Vermont is tracking undocumented people. Over the past four years, data analytics company, Palantir, received more than 1,000,000,000 from immigration enforcement agencies. Then tele provider of location data had had seven contracts with ICE totaling at least 330,000 between 2018 and '22. And ICE and other agents have utilized databases such as LexisNexis, Equifax, and others to conduct millions of searches, including information such as utility bills and others to track undocumented people and to try and target them. And just recently, I think very relevant to this bill, this last January ICE put out a request for information to ad tech providers to better understand how they could utilize existing off the shelf products to be able to better track and arrest people using existing available data, especially location data. And it's clear from this RFI that ICE doesn't see this as the need to reinvent the wheel in order to perpetuate mass surveillance. They just need to layer existing consumer tracking tools onto their existing investigatory capabilities. And so that is one of the major concerns is as this data is collected, how is it then aggregated through the system, and especially how does it get to government agencies in a way that wouldn't be available under without you know, under the normal fourth amendment protections. So that's our other larger concern is the use of government government use of consumer data in a way that undermines existing Fourth Amendment protections because, as I think as you are aware, when this information is shared with a third party, you lose certain expectations of privacy in that information. Whereas if it was held by an individual, they would be able to maintain protections over that information. So so in addition to the purchase of information, by immigration agencies and other arms of the government, The government has purchased our data from data brokers all without a warrant or judicial oversight. So for years now, federal agencies, including the Internal Revenue Service, Terror and Defense, and others have been buying buying their way around the Fourth Amendment and purchasing American sensitive information from data brokers. These often these companies often obtain the information through common applications like the Weather Channel, Tinder without using without users realizing it, and then that government uses to track people's location without a warrant or probable cause or even suspicion that anyone in the dataset had done anything wrong. So this is a larger concern around current data collection practices. And one of the reasons that we do we support the bill in front of you because I think it gets at a number of the concerns, as I heard folks speak to earlier in terms of minimizing the information that's collected in the on the first place, which is one of the best protections that we have as well as giving use you know, consumers more control over their data. So I'm gonna go through some of the the sections of the bill that we support, and then also have, you know, a few small suggestions around the language. So first, we support the consumer rights found in section three. This provides consumers with common sense protections for their personal data, including ability to access, correct, delete, or obtain a portable copy of their data and find out who their data has been sold to. This section also provides the ability to limit the sale of personal information for advertising purposes, limits on targeted advertising. Advertising, of course, is important for many online businesses and is protected by the First Amendment, although in a limited way. This bill still permits advertising, even targeted advertising, but lets consumers rein in the data uses for that purposes. It also provides users consumers a one stop shop to opt out of all targeted advertising known as the unit of opt out opt out mechanism, which we support. We also support the data minimization components found in section four of the bill. This bill would be one of the first in the country to change business as usual for big tech. Most consumer privacy laws like companies bury the collection and use of your information in lengthy terms of service. This bill creates common sense rule. Your data can only be used and shared to provide the services you ask for. No mobile games secretly collecting and selling your location data if it's not needed to play that mobile game. And then next, the limits on collection distribution of health related data is something that is something we are very interested in and strongly supportive of. As we discussed above, we support S71 because it provides necessary protections related to individuals' health care and their related data. Importantly, this bill puts limits on collection and distribution of health care related data, especially data related to accessing legally protected essential health care services, such as reproductive health care and gender affirming care, have been protected under Vermont state law. And in particular, support the prohibition on using geofencing to track the location of any individual accessing protected services, because we know this information can be used by individuals and potentially governments to track people based on their decision to access healthcare. So in the light of this, and also some of the work that's been done to protect these healthcare services in the state, we do have one suggestion for clarification on page 46 and sub A2. This references when folks who maintain this data would be expected to be able to turn this information over. So in there, it discusses turning this information over for when there's a subpoena, when there's an investigation, anything like that. What I would suggest is that the committee look at what was passed and was contained in 18 VSA eighteen eighty one, which was our current shield law. So this was passed in 2025 to limit the distribution of information related to accessing health care and does have some specific limits on when that information could be shared with governmental bodies based on the reasonable belief that it would be used to impose penalties or prosecutions for accessing protected health care services. So I think the committee could just, I think as it reads now, there's a potential conflict with what the legislature passed in the shield laws in 2025 and what's in this current version of the bill. So I think that could be addressed by either incorporating just existing statutory language from 18 DSA 1881 or incorporating by reference, you know, making it clear that this does not waive those obligations that exist within that chapter. So just a place that as I was looking through and seeing some of those it brought up some concerns around existing law and a potential conflict. Next, I just wanna say I really greatly appreciate the language contained in this bill explicitly stating that this is not an authorization of the use of facial recognition technology by law enforcement. Just that's a clarification. I don't think that's the intent of this bill in any way. But in 2020, this legislature put a moratorium on the use of facial recognition technology by law enforcement because of the many concerns around that technology, the implications for bias, and infringement on civil rights and civil liberties. But just that express expressed statement in there that this is not authorizing that use is something we appreciate and hope will stay in the draft. And then finally, you know, we at the ACLU strongly support having a private right of action along with the AG's enforcement. I, you know, understand that this has been a long negotiation. There's a lot of conversation about what's on the table and what's not. But, we support including a private right of action just because, as I know folks have heard, the AG has capacity limits, and this would allow consumers to bring forward their complaints, their concerns without having to, you know, tax the AG's capacity and also being able to work with their own attorneys to bring forward their cases in the way that they might like to see them proceed as opposed to relying on another entity to bring that type of enforcement. So I just wanted to mention that, but I also understand that that's a larger point for discussion that has been happening with this and the other body. So I think with that, I'll wrap up and generally say we we support s seventy one, support these efforts, and would be happy to answer any questions. I will also say that one of the benefits of working at a nationwide network like the ECLU is I have access to folks that are much smarter than I am, who spend a lot of their time working on these types of laws and considering the ins and outs of these types of bills. So if there's any more specific questions that come up about any provisions, I'm happy to check with our National Policy Council or to answer the best

[Unidentified Committee Member]: of my ability.

[Michael Marcotte (Chair)]: Questions? First,

[Herb Olson (Member)]: I think. I think you mentioned that we passed a lot relating to reparation recognition at the end of the citation?

[Falko Schilling (Advocacy Director, ACLU of Vermont)]: That was from the acts and resolves of 2020. I think it's actually referenced in here. Let me pull up the page.

[Unidentified Committee Member]: 18 BSA, 18 B-one was there. Jonathan I'm sorry.

[Falko Schilling (Advocacy Director, ACLU of Vermont)]: Yeah. That's a slightly different one. The cyclophen to that, let me just find it. I can send you that citation. But, you know, it was it was actually in section law, so it's not a a statutory provision, which is one of the reasons that it felt you know, as this was being discussed before, it felt important to flag because folks might not know it's there.

[Herb Olson (Member)]: They might not.

[Falko Schilling (Advocacy Director, ACLU of Vermont)]: While we would prefer that it would be in statute and be more clear so folks can understand it, also just appreciate that inclusion in here to clarify the intent behind the bill.

[Herb Olson (Member)]: Yeah. Second question, I thought there was I can't find it right now, but I thought there was some reference to the shield law or journalists. But you're suggesting

[Falko Schilling (Advocacy Director, ACLU of Vermont)]: I might've missed it, but in just looking at that one particular section on page 46, let me just pull it up. It's it references It basically says this chapter should not be construed to restriction controllers, processes, ability to comply with civil, criminal, or regulatory inquiry investigation, subpoena, or summons by state, federal, municipal, government authorities. And then in 18 v s c eighteen eighty one, there are more restrictions on what can be disclosed, and I think just wanted to make sure that those two square would be something to be helpful because it it limits when that information can be shared if in a number of different situations, especially if it's, you know, for instance, something like, you know, you see the state of Texas is trying to reach into the state of Vermont to regulate health care within our state. There's some provisions to try and protect against that.

[Herb Olson (Member)]: Yeah. I'm just thinking there's probably a host of exceptions

[Jonathan Cooper (Member)]: to

[Herb Olson (Member)]: that kind of inquiry or subpoena or whatever beyond just shield. Yeah. I think the the term in

[Falko Schilling (Advocacy Director, ACLU of Vermont)]: here is a pretty it's a a broader catchall that's just trying to capture lawful, you know, activity, but I also, you know, wanna make sure that that squares with the other statutes the body has passed.

[Herb Olson (Member)]: Okay. Thank you.

[Michael Boutin (Member)]: Submitted a copy of your testimony to our

[Michael Marcotte (Chair)]: clerk.

[Michael Boutin (Member)]: And if haven't, would you please?

[Falko Schilling (Advocacy Director, ACLU of Vermont)]: Yes. I'd happy to. I I have not. I was I will admit that I was writing this up until about 10:00 this morning and ran over at fresh off the printer. So I'm happy to clean up my notes and submit a copy of it. Thank you.

[Abbey Duke (Member)]: Okay. Thanks, Falco. Two things. One, I'm

[Monique Priestley (Clerk)]: curious, Connecticut and you may I know you'll lean on Cody. That's totally fine. I just didn't know if you guys discussed it. The curious about whether or not ACLU supports and likes the facial recognition language that's in Connecticut's amendments for 2026 that are moving right now.

[Falko Schilling (Advocacy Director, ACLU of Vermont)]: I I will I will admit. I need to look into that, and I can submit that along with the other written testimony.

[Monique Priestley (Clerk)]: And then the other one is we went further with civil liberty protections in the version, basically the House amendment from May, we rolled them all back to restart from the Senate bill is passed. And so I'm curious if you can write this up, but ACLU's thoughts about or any concerns with the fact that we took those back out, basically. A lot of anti discrimination language, for instance.

[Falko Schilling (Advocacy Director, ACLU of Vermont)]: Yeah. Can take a look at kind of those changes, Largely reaction to the version that I have not looked at all the

[Herb Olson (Member)]: previous Okay,

[Abbey Duke (Member)]: thank you.

[Michael Marcotte (Chair)]: Questions?

[Michael Boutin (Member)]: Thank you.

[Michael Marcotte (Chair)]: Andy, you wanna go on?

[Andrew Kingman (State Privacy and Security Coalition)]: I am sorry. Would would I was just asked to mute. Did folks want me to testify Yes.

[Michael Marcotte (Chair)]: If you'd like to.

[Andrew Kingman (State Privacy and Security Coalition)]: Alright. Apologies. I I don't mean to be skipping the line here. So I thought there were a couple of Oh, we

[Michael Marcotte (Chair)]: the floor got down earlier and we anticipated.

[Andrew Kingman (State Privacy and Security Coalition)]: No problem at all. Good afternoon, Mr. Chair, Madam Vice Chair, members of the committee. My name is Andrew Kingman. I represent the State Privacy and Security Coalition. We're a New England based coalition that's a multi sector group. I also have a background as a privacy compliance attorney. I wanted to start just by saying I've appeared on this committee many times over the past decade or so. There's always been a familiar face at the end of the table. If this is the last time I testify here this year, I just want to say thank you to the chair for your leadership during your tenure here. Thank you. I also wanted note SPSC has a long history of working collaboratively and transparently for the past decade on Vermont privacy issues, including the data breach notification updates, the data broker registry bill, and the student privacy bill that passed several years ago. I wanted to start with this. There's no such thing as a perfect privacy framework. These laws are a series of trade offs and choices that legislators must make. These choices often involve tensions between comprehensibility and comprehensiveness, consumer choices and business obligations, and transparency versus security. I also want to emphasize that there's very little debate about, and as far as I'm aware, no opposition by the business community to many of the most high profile issues in this bill, in particular providing conceptually heightened protections for immigration and citizenship status, reproductive health data protections, individual status as transgender non binary, biometric data protections, or precise geolocation data. There's no debate about the inclusion of data protection assessments, the provision and processor contracts, or the importance of privacy notices that can be as clear as possible. And I also want to express gratitude for the removal of the private right of action, which aligns Vermont or would align Vermont with every other state comprehensive privacy law in the country. But I do want to speak today about why keeping this framework similarly aligned with the other 19 states that have passed it is not only critical, but logical. As many of you know, this framework started in 2019 with the introduction of the Washington Privacy Act, which is a product of a multiple month stakeholder process. And while that has never been enacted in Washington, it did lead to the passage of laws in Virginia, Colorado, Utah, and Connecticut, all in 'twenty one and 'twenty two. Connecticut in particular was the product of a two year multi stakeholder process ending in a bill that Consumer Reports praised in a press release as a strong law that will extend real privacy protections to its citizens. Importantly, the Washington Privacy Act's baseline was the GDPR. The stakeholder group drafted a bill that was more suitable for state law versus a multinational law, more suitable for The United States versus Europe, but the consumer rights, the data minimization standard, the data protection assessments, the processor contractual requirements, all were brought over from the GDPR. And I use the term framework here quite deliberately because at this point, these laws have evolved to encompass a wide range of rights, provisions, requirements. Many states return to them each biennium seeking to update them. So from the business community standpoint or from SPSC standpoint, we don't view this as a set it and forget it kind of process. It's a process that will likely be a multi year discussion on how best to implement changes. In other states, this process has been successful because trust has been built over time, that the business community is transparent about what its red lines sensitive to legislators' desire to get something done that advances the privacy ball forward. What all these states have in common, however, all 19 of them covering at this point well over 100,000,000 consumers, states like Oregon, Minnesota, Delaware, Connecticut, Colorado, Texas, Nebraska, Indiana, Kentucky is a common skeleton. Virtually identical definitions for critical terms like controller, processor, personal data, biometric data, sale, precise geolocation, targeted advertising, virtually identical requirements for data protection assessments, virtually identical requirements for privacy policies and controller processor contracts. Some states have opted to add in universal opt out requirements, some have expanded provisions relating to reproductive health care, some have added provisions regarding children's data, And in each instance, the business community has worked with the authors to make these provisions workable, not to defeat them, because the bones of the law are workable and interoperable. And in Vermont, obviously, we're all stuck on the issue of data minimization. As I mentioned earlier, the Washington Privacy Act framework is based on the GDPR, and I think it's critical to note that the data minimization standard that exists in these states is not only the GDPR standard, it's the global standard effectively for data minimization. So India, Brazil, Canada, GDPR, all require that a controller transparently disclose the information they're collecting and ensure the data collected is only enough to do the job required. And then that's twinned with a purpose limitation principle. It says if you're going to change the reason you're collecting that data or the type of data you're collecting, you need to get the individual's consent. Connecticut recently updated their standard, but critically, it is still interoperable with other states. The provisions in S-seventy one currently create a novel framework that no other state is enforcing and no other jurisdiction in the world is using. And even the Maryland attorney general has issued guidance recently suggesting that they will enforce that standard to what California uses rather than the literal text of the statute. And as I mentioned earlier, privacy law is a series of trade offs. And in our view, the most significant downsides to the Maryland data minimization model, which again, S-seventy one even differs from that, and this model has been rejected in the past year in Maine, Colorado, Oregon, New Mexico, and Washington. The significant downsides to this are the following. The biggest one is the total absence of control over sensitive data by the consumer. The vast majority of other states require opt in consent for sensitive data collection and processing, and that allows the consumer to say, no, I don't want you to collect my sensitive data, or yes, that's okay that you do so. Under S-seventy one, as we're considering it, this is entirely up to the business as that standard is interpreted by the state and whether the business deems that data strictly necessary or not. But if they do, the consumer has no ability to prevent that collection and processing. The second downside is the potential of further marginalizing historically marginalized populations. So can use the example of an LGBTQ plus dating app that offers optional safety features like anonymous reporting of harmful encounters, alerts when multiple users flag dangerous individuals, or access to information about safe meeting locations. This relies on sexual orientation and precise location data, but these optional features are not strictly necessary and so there's no ability for the company to offer those unless they are actually requested by the consumer. Third, we're likely to see because this is a completely novel standard, nobody understands or knows what the standard requires, we're likely to see inconsistent interpretations among companies. That's a bad outcome for consumers and it's a bad outcome for businesses. From a compliance standpoint, extensions of existing law and sort of adding more meat onto the bones of the skeleton, if you will, Those involve tweaking products and services, but a novel framework like this requires a wholesale reworking up and down the supply chain. So as an example, on the legal side, law firms currently have compliance plans that they can run a company through. You heard Jody talk about that earlier today on the compliance side. On the legal side, similar processes, but with a novel framework, have to start at square one. What does specifically requested by the consumer mean? What does provide or maintain mean? What is reasonably necessary to provide or maintain mean? And how does that differ from strictly necessary? Of course, on the legal side, increased time equals increased cost. And how does this affect product recommendations, personalization, customer service, offering new products or services to existing customers or finding new customers? We think it's likely to affect things that consumers find very useful. We can take, as an example, a virtual try on for sunglasses online. So because the definition of biometric data is unusually broad as it's written right now because a virtual try on would likely be classified as using that biometric data in Vermont, but very few other jurisdictions because of distinctive definition. And because the virtual try on is not strictly necessary for someone to purchase sunglasses online, it seems unlikely that these kinds of features could be offered. From a product standpoint, compliance vendors have plans in place right now. They have consent management platforms. They have opt out links. They're all using the same data sets and the same definitions, and this lowers costs, obviously, for companies. Requiring new products and services to serve Vermont, of course, means increased costs. Now there's not a lot of data on what the cost of these frameworks are, but when California's law first went into effect, the state's own estimates were that for businesses with 20 or fewer employees, costs for just initial compliance would be around $50,000 For businesses with fewer than 50 employees, that cost jumps to $100,000 Certainly, as the uniformity of privacy laws have increased, those costs have likely come down. But the more a framework deviates from these baselines, the higher those costs are likely to jump. And again, these frameworks are a series of trade offs. We just don't think any of the above issues are worth the deprivation of control by consumers over their sensitive data or again, potentially depriving marginalized populations of products or services that could be designed for them and offered to them. We believe that Vermont absolutely can enact a law that is in the upper tier of robust privacy laws in The United States while still building off of the same skeleton that is used in other states. It can still be aligned with the model that New England states have already passed, giving consistent expectations for both consumers and businesses across a region we all travel throughout frequently and still contain real protections for consumers and striving obligations for businesses. So thank you very much for your time. I appreciate it and happy to answer any questions.

[Michael Marcotte (Chair)]: Thank you. Questions?

[Herb Olson (Member)]: Herb? Thanks very much for your time. I was interested in how you framed your testimony. What I was hearing that you thought that S71 was a quote novel framework. And I wanna explore that a little bit. It's my impression from truth. I haven't reviewed some of these statutes and regulations in detail myself. That's for you. And but it was my impression

[Michael Boutin (Member)]: that

[Unidentified Committee Member]: California enacted the law,

[Herb Olson (Member)]: and then that they also adopted rules that came pretty close to the framework that we're considering in SA81. And let me just back up. I think my sense is that the major difference that you're talking about in terms of regulatory framework is the difference between disclosure and consumer consent as opposed to specifying, you know, when information can be collected and stuff and then what you do with it and who's responsible or what. Is that is that an accurate distinction? And if so, how do you view the cap? Maybe I'm not correct on the California. Maybe I understood the testimony correctly.

[Andrew Kingman (State Privacy and Security Coalition)]: Yeah, I think it's helpful to sort of think of the existence of three different models in the country right now. One is California, which I think is kind of its own framework. One would be Maryland because of its data minimization framework. Although again, the attorney general's guidance suggests that they're going to enforce it to California standard. And then there's the other 19 states. And again, those are all working off of very common definitions, a common data minimization framework, etcetera. So I think that would be the most useful way to think about the state of privacy law in the country.

[Herb Olson (Member)]: But, okay, I'm sorry, I don't quite get it clear. I mean, think you were saying that the S71 was a novel thing. Yes. But I've been under the impression that this framework is similar in some of its corporate. There might be some, you know, details different, but it's pretty similar to what's been enacted in California, particularly their rules as well as as well as Maryland.

[Andrew Kingman (State Privacy and Security Coalition)]: No. California is is quite different. And what makes s 71 novel is that it is largely the data minimization framework because it would impose a totally new regime for how data can be collected and processed. And so although, you know, there are some similar definitions and while, like, processor contracts are the same and DPIA requirements are the same, the entire framework for what's permissible and allowable to collect data and process it, and the different steps that you would have to go through make it very different than what's in other, what's in other states.

[Abbey Duke (Member)]: Okay. Is

[Andrew Kingman (State Privacy and Security Coalition)]: that helpful?

[Herb Olson (Member)]: I have to do some research. That'll be fine.

[Andrew Kingman (State Privacy and Security Coalition)]: Okay, yeah, I think the other way, I can try it this way. California, the easiest way to think about that is that it is extremely prescriptive and granular because of its regulations around the form of a privacy notice. And then I think it can fairly be described as largely an opt out regime. So there's the opt out of targeted advertising and the sale of data, but it also is effectively an opt out for sensitive data. And that sensitive data opt out is a little bit different than the opt in for sensitive data under most other regimes. Those are the biggest issues. Mean, there are a lot of others, but those are sort of the main things that separate California from other states.

[Herb Olson (Member)]: Okay, all right. Thank you. I'll walk into this.

[Michael Marcotte (Chair)]: Questions?

[Emily Carris Duncan (Member)]: Okay. Emily? Thank you for your testimony. I'm curious to know about the companies that you work with. Are they also complying with California in addition to the 19 other states that have a slightly different data privacy regime?

[Andrew Kingman (State Privacy and Security Coalition)]: Yeah, think most of our members are working in all 50 states, so everybody is trying to comply with what's out there. Think, again, California is different in any number of ways. I should also say it does not require data protection assessments either. And so if I am guessing whether your question is if you comply with California, are you complying with all of the other states? It's not possible to say, well, we're complying with California, we're complying with other states. But I see you're shaking your head, so perhaps I jumped got out over my skis. I apologize.

[Emily Carris Duncan (Member)]: No, I was just generally interested in the company's capacities to deal with California and also understanding that Maryland is enforcing to California standards. It seems like maybe that's becoming a new place where data privacy is going and where the 19 are. I'm not sure, and I need to read more into whether or how much their laws have been updated recently.

[Andrew Kingman (State Privacy and Security Coalition)]: Yeah, so all of the state laws that are in this kind of common framework have passed from 2021 on, so none of the laws are older than five years old. And as I said, four of them were passed in 2021 and '22. Most of them are just a couple of years old. As we've said, a number of them have gone back and updated their laws each year. And I think to the extent, to your question about whether there's a new direction on data minimization, wouldn't characterize it that way only because so many states have rejected that approach in the last year or two. And so I think the global standard or the GDPR standard that's in the majority of states in the country still is the dominant standard, for lack of a better term. Thank you.

[Michael Marcotte (Chair)]: Any other questions?

[Monique Priestley (Clerk)]: Good news, Andrew. I'm just wondering, so Maryland has a strict prohibition on the sale of sensitive data, and I'm just wondering what your members have done to comply with that, like how they've handled it?

[Andrew Kingman (State Privacy and Security Coalition)]: Yeah. I I think as far as I know, everyone is working to to comply with that. You know, I I'm not I'm not aware of anything to the contrary. I think our concerns about those broad prohibitions, again, gets to the ability to advertise and offer products or services to people based on race or ethnicity or sexual orientation or things along those lines where there are products and services that are directed to them. Again, the way that the AG has signaled they're likely to enforce their law provides a little bit of a pressure valve there, think, but I think that's where the concern comes from broad prohibitions on sales rather than thinking about a prohibition on the sale of immigration data, for example, or something along those lines. It's little a more targeted.

[Jonathan Cooper (Member)]: Andrew, you just said remarked on something that that got me thinking. Can you are you do we equate sales with advertising? The attempt to procure sales. Like, can can I hear your thoughts on how equivalent those two things are?

[Andrew Kingman (State Privacy and Security Coalition)]: Yeah. I I mean, I think it's it largely depends on each company, but sale in this bill and in many bills, many laws in the country are very broadly, the term is very broadly defined. So it's the exchange of personal data for monetary or any other valuable consideration. For those of you who had the misfortune like I did of going to law school, you'll know that basically the basis of any contract at all is consideration. And so anytime you have a contract, even if it is just sharing data, even if it's transferring data in exchange for giving up a right or giving up an agreement. So basically any transfer of data other than we're giving it away for free with no contract at all would qualify as a sale here. And so that's where there's that intersection, if that makes sense. So if you are providing information to advertising partners, oftentimes that is considered a sale, even if you are not saying, here's a personal data set, we're giving it to you, you're giving us money back. And so that's where that provision comes in. The reason that that definition is as broad as it is and is a little bit counterintuitive to what we would all think of as a sale is so that consumers can have the broadest rights when it comes to opting out of the sale of their data. So that when a consumer opts out of the sale, they're opting out of the controller with transferring data to a third party, even if it's not just a straight monetary consideration.

[Jonathan Cooper (Member)]: So I think this is it's something that I wish I had been thinking about more at an earlier time, but that probably from representative Priestley's inquiry about, like, so what would we see as impacts in a state like Maryland? There might be what we broadly consider bottom line impacts. But the thought is that there's also I think you're articulating here is sales that might not be seen in that way, but are still part of the sort of the web of what commercial activity is.

[Andrew Kingman (State Privacy and Security Coalition)]: Yeah, I think that's fair. I know it's an area where I think a lot of state chambers have had to educate their businesses because the vast majority of businesses are not out there selling data for money. And so many of them say, well, we're not selling data. But under depending on what that state law's definition of sale is, you may well be. And again that compromise for lack of a better word has been reached so that the consumer gets as broad a protection as possible for their opt out rights. And also, I will say California to the former representative's former question, California has very, I would say, overlapping definitions of both sale and sharing that are not particularly easy to pry apart. So the other compromise is that this would preempt a definition of share that would be tricky to pry apart. Thank you.

[Herb Olson (Member)]: Hi,

[Edye Graning (Vice Chair)]: thank you. I apologize that I'm not with everyone there right now. I've been listening to testimony on this for a while. And Andy, when you were talking about framework and scheme, I wasn't exactly sure what you were talking about, but I think, and you could help me make sure I understand, You're talking about a business's ability to collect data and how that works. Is that what you're referring to when you talk about framework or scheme?

[Andrew Kingman (State Privacy and Security Coalition)]: When I was talking about frameworks, I don't want to say, like, there's not really like a model law at this point because every state's law is just a little different, right? But all of them build on each other and are interoperable. And so that's what allows some states to have universal opt out mechanisms or some states to have extra provisions around children's data or reproductive rights data, because it's working from a common skeleton, for lack of a better word. And that's the concern about where we're at with this draft, we're really not working from a common skeleton because primarily of the data minimization provisions.

[Edye Graning (Vice Chair)]: So the, and I just want to be perfectly clear, make sure I really understand. So the difference is that in most other states, the individual chooses whether their data is collected or not. And this framework or this scheme is saying you can't collect certain data. Is that what you're saying?

[Andrew Kingman (State Privacy and Security Coalition)]: In most other states, there is consent requirement for for sensitive data that gives the consumer control over their sensitive data, where if a business is going to collect or process it in any way, they're required to obtain consent, but it also obviously gives the consumer the ability to say, no, I don't want you to do that. The consumer doesn't have the ability to do that under this Maryland data minimization framework scheme. There's no individual control over their sensitive data under the way that S71 is structured right now.

[Edye Graning (Vice Chair)]: Because the business isn't allowed to collect it or the business is allowed to collect it but has to do more be more sensitive with it, be more careful with it?

[Andrew Kingman (State Privacy and Security Coalition)]: Because the business, as long as the business, if the business deems it strictly necessary to provide a product or service specifically requested by a consumer, and again no one knows what those words mean, then the business is permitted to collect it and the consumer doesn't have any ability to say, no, I don't want you to do that.

[Edye Graning (Vice Chair)]: Okay, so two things. One is, I think rulemaking explains what something means if it's not clear in the law and that's part of laws that we deal with every day. So, you're a lawyer, you get that. That feels a little inflammatory when you say nobody knows what it means because these are words that you know we could do a statute search and find out how many times these words are used. It has not been in place in Vermont yet, so sure. There is some question about what it is going to mean, but there will be rule making. There will be clarity just like every other law.

[Andrew Kingman (State Privacy and Security Coalition)]: Well, I think respectfully, I would disagree a little bit and I apologize. I'm not trying to be inflammatory. I think it's fairly objective to say that the standard here is not in effect anywhere else in the world. And when you compare that to the standard that is in most other states that is based off of the GDP that is effectively a global standard, businesses do know what that means and so I think trying to parse out the difference between what reasonably necessary versus strictly necessary does cause quite a bit of angst or understanding what the impact on product recommendations or personalization would be because if I don't specifically request a product or service and a business can't offer anything to me based on that, I think that does have concern. Again, I would just say this doesn't exist anywhere else in the world. And so I do think that that is fair to say that folks don't understand what that framework means or what it requires.

[Edye Graning (Vice Chair)]: And then my other question is if we change because we are talking about what the law could be, should be, we change the law to say a consumer has opt in, opt out rights over all of their sensitive information, would that meet your standard?

[Michael Marcotte (Chair)]: Well,

[Andrew Kingman (State Privacy and Security Coalition)]: That would change the whole data minimization framework. It would require changing the data minimization framework to where other states are. So that would go a long way towards doing that because, and I want to be clear, so moving to a framework where businesses have to collect what is adequate, relevant, reasonably necessary to a disclosed purpose but obtain consent for sensitive data, yes, that would solve many of the problems.

[Edye Graning (Vice Chair)]: So this takes me back to my first question, was your concern is that there are, it is not, yeah, it is the business cannot collect certain information is the way this law is written and that's what you're concerned about.

[Andrew Kingman (State Privacy and Security Coalition)]: No, I think our concern is, again, the lack of consumer control over sensitive data, the inability to offer products and services designed for marginalized populations. And again, just not being able to offer existing customers new products and services that might be complementary and an inability to find new customers.

[Edye Graning (Vice Chair)]: Okay. I think we covered the find new customers part earlier today, but then we talked about making that more clear. So I don't think I have any more questions. Thanks. I really appreciate that.

[Andrew Kingman (State Privacy and Security Coalition)]: Yeah. And I would just say, a recommendation, the way to make it more clear would be to use the standard that the vast majority of other states are implementing that derives from the GDPR.

[Monique Priestley (Clerk)]: Questions? Monique? Yes, I know earlier you were citing numbers from 2019, I think it was 2019 from California with the 50,000 to 100,000 compliance costs. Before there was a cottage industry of free and low cost tools and consultants and all this stuff. We got a letter from the National Federation of Independent Businesses that cited that they thought that startup costs for the majority for small business, I think, would be $5,000 to $15,000 And I know we had to lease Walnuts and Kim Lancaster and things like that, and some of the numbers that they dropped were 20,000 to $40,000 depending on the business and the sensitivity of the data and that kind of stuff. So we haven't had anybody hit 50,000 to 100,000. I understand that could be large businesses, but also curious if large businesses are not already complying in other states. So can you help us figure out the costs there of the original ones that you cited?

[Andrew Kingman (State Privacy and Security Coalition)]: Yeah. Again, I was citing the California State Department of Finance's own estimates on what it was. The 100,000 number was for businesses with 50 or fewer employees. As I said, there's not a lot of data on cost, but I think the uniformity of the state framework has certainly brought costs down. I certainly would be wary of advising anybody to use free tools, but yeah, I didn't see the NFIB's letter, but again, I was just citing the one sort of state source on cost that's been out there.

[Monique Priestley (Clerk)]: And that was from seven years ago, right?

[Andrew Kingman (State Privacy and Security Coalition)]: I think it was from 2019 or 2020. Yeah, it was again, I think the uniformity of the state framework certainly has brought costs down.

[Emily Carris Duncan (Member)]: One more question for me. We've been having these conversations also about the quality of the data that is being collected. And this is the general ecosystem of data and the issues of inaccuracy. Do you have any thoughts on that?

[Andrew Kingman (State Privacy and Security Coalition)]: I don't really, only because I think it varies so much. I think the only thing that I hear is that, you know, it matters for businesses that they're able to advertise and try to find new consumers. And that, you know again I think the chamber is going to go later today so it won't speak for them, but you know we've heard in plenty of other states that for small businesses that's incredibly important and an incredibly important part of their business. So in terms of quality of data, think it varies so much for companies and industries and I think there's a lot of variability there. There's certainly plenty of noise out there. So you know, I I don't have any particular insight on that. I apologize.

[Unidentified Committee Member]: That's alright. I appreciate you. Questions?

[Michael Marcotte (Chair)]: Great. Thanks, Andrew.

[Andrew Kingman (State Privacy and Security Coalition)]: Thanks, everyone. Appreciate it.

[Michael Marcotte (Chair)]: Justin, good afternoon.

[Justin McCabe (General Counsel, OnLogic; VTTA Board Member)]: Hello, everyone. Good to see you again. My name for for to remind you all, my name is Justin McCabe. I work at OnLogic. I'm the general counsel here. OnLogic is a computer manufacturer located in South Burlington, Vermont. We have a global presence. So we're dealing with the data privacy laws in The UK, EU, as well as in all 50 states. I'm also here as a representative of VTTA. I serve on the board of the Vermont Tech Alliance. And I'll put on a couple other hats as well. So before I joined OnLogic, I was an intellectual property attorney advising people on data privacy issues. And I'm also a former small business owner. I recently, my wife and I recently sold our company called the Vermont Evaporator Company in October. And we were an e commerce company providing maple sap equipment throughout New England and the rest of The United States. So I've got a couple of different lenses to look through for this bill. I know you guys have taken a lot of testimony today. I've sat in a couple of the sessions and I'm sure many points have been touched upon and it's been a long day. But I have two specific things I wanted to bring up. And one of the, I know all of us want a privacy bill to be clear on how a company should behave and what a person's rights are. That should be ultimately what our goal is. And so I had some questions or concerns about twenty four fifteen BA two, which is really applicability standard. Because the sub chapter applies, you know, to any collection of sensitive data, which you guys just had an extensive discussion on. But the definition of consumer excludes people, and I'll paraphrase a little bit, operating in a commercial capacity. So OnLogic is a b to b business primarily. And I'll say primarily because that's what most of our customers are looking for in terms of our industrial computers that we're selling. But we're also an e commerce platform. We have really no way to delineate when a person comes into our e commerce platform, what that person, how that person is approaching us, whether that's from an individual capacity or from an operational capacity as a business. Right? So this would be really challenging for us to apply. We would essentially have to treat, I think, every single individual that would come in as an individual to be safe under the law as written versus, you know, our what our standard process would be, which would be to, you know, market and sell computers. So that is something I'm a little distressed about. I think it would have there could be some additional clarity that would be needed there to understand how would we be able to differentiate from that? What assumptions can we make as a business? We all, I'm sure, have used our business accounts to make purchases online or to have something shipped to your place of business. That's just not that uncommon. And so that would be something that I'd be very interested in seeing some additional clarity on out of the bill. The second piece is with respect to the definition of contextual advertising. So as currently written, there is a range profile, a 10 mile profile, and then there's this unique or this user online activity understanding. It's unclear as to whether it's the lesser of, the greater of in that context. Right? What we're actually looking for or what we're trying to evaluate. My assumption would be is it's the greater of because that would provide for more anonymity. But the term, the definition uses the term user, which isn't a defined term in the act as well. We use the term consumer, we use the term person, but that's not defined. And online activity also is a little unclear to me as to what we're trying to capture, whether it's online activity directed towards the site that we're looking at, whether it's on the online anybody that's online in the region, in a community. What we're what we're actually assessing there and how we're supposed to assess that to whether to know whether a business can provide contextual advertising, which I know our Vermont and Vaporative business said quite a bit of. So those are two areas where I would like, you know, the committee to think hard about. Yeah. And I think if if there's any questions that I can help answer, I know you had a lot of other experts, today, but I'd be happy to happy to advise.

[Monique Priestley (Clerk)]: Thanks, Justin. So on the first one, can you remind me, were you looking at the sensitive data applicability?

[Justin McCabe (General Counsel, OnLogic; VTTA Board Member)]: Yes. Because that's just broadly based. As long as we have one sensitive data person Sure. The act applies to us, and so then we're looped in.

[Monique Priestley (Clerk)]: Yeah. So the definition of consumer, what it does include and what it doesn't include is the same as Connecticut, and so is that applicability threshold. So I'm just curious, do you not have any data from anybody in the state of Connecticut either?

[Justin McCabe (General Counsel, OnLogic; VTTA Board Member)]: No, we absolutely do, but we have our consent Opt in, opt outs. Right? This is a complete this would be a complete this is the way that the this is written, right, as I understand it, is that we would only be able to process that data for the use for the purpose of completing a sale, Not for remarketing purposes, not for targeted advertising, etcetera etcetera, which we we can have people opt in or opt out of which we have systems that that help us do that. If people opt out, they don't get targeted advertising, etcetera etcetera. But that is the primary difference here. We'd have to treat people differently here.

[Monique Priestley (Clerk)]: So are you talking about the way that sensitive data interacts with the data minimization pieces? Yes. Okay.

[Herb Olson (Member)]: Alright. Thank you.

[Andrew Kingman (State Privacy and Security Coalition)]: Yep.

[Michael Marcotte (Chair)]: Very good. Justin, thank you.

[Justin McCabe (General Counsel, OnLogic; VTTA Board Member)]: You're very welcome. Have a great day, everyone.

[Michael Marcotte (Chair)]: Thank you. You too.

[Megan Sullivan (VP, Government Affairs, Vermont Chamber of Commerce)]: Alrighty. What is this? We're just gonna come in. Good

[Unidentified Committee Member]: afternoon.

[Megan Sullivan (VP, Government Affairs, Vermont Chamber of Commerce)]: Hi. For the record, Megan Sullivan, Vice President of Government Affairs for the Vermont Chamber of Commerce. And good afternoon. My name is Joshua Diamond. I'm with the Dinsey Law Firm, and I'm special counsel for Vermont Chamber of Commerce. So I'll kick things off, and then Josh is gonna get weedy with you all. So just wanna be clear from the onset that the chamber supports comprehensive data privacy reform in Vermont. Ideally, data privacy would be addressed at the federal level. Data and digital services do not operate within state boundaries, and a national framework would provide a consistency that both consumers and businesses need. However, in the continued absence of federal action on this and so many things, we recognize the responsibility states have taken on and support Vermont's work to move forward. The Information Technology and Innovation Foundation estimates that without federal legislation, a patchwork of state laws could impose 20 to $23,000,000,000 in annual costs on US small businesses. Related, University of Vermont legislative research service reported in 2025 that the average amount to implement California's data privacy act was estimated to be a $100,000. For medium sized business, that's 20 to a 100 employees. So even assuming economies of scale that can be reached for Vermont and given the the 20 other states have, now adopted this, even a portion of that amount will create financial pressures for Vermont businesses. Economies of scale will be minimized if the law substantively departs from our regional neighbors. That is the scale of impact that warrants careful consideration as Vermont shapes its approach to why sorry, shapes its approach and why since first engaging on data privacy legislation in 2023, we have consistently advocated for a framework that is compatible with the laws adopted in other states. Over the past year and a half, the Vermont Chamber has worked to deepen our technical knowledge of these issues by retaining Josh Diamond of DNC as our special counsel. He has a strong background in consumer protection, including leading the creation of Vermont's data broker registry during his time at the attorney general's office and brings valuable technical expertise to this discussion. This engagement reflects a business community that is not seeking to avoid regulation, but is committed to sitting here at the table with you to get it right. Our goal is to support a framework that delivers meaningful protection for consumers while remaining workable for Vermont employers. Connecticut, New Hampshire, and Rhode Island have established a strong regional model for data privacy. S 71 is passed by the senate aligns with that framework. Today, we have submitted a letter signed by more than 100 Vermont businesses and organizations that reflects this position. It expresses strong support for comprehensive data privacy while urging Vermont to align with regional framework reflected in s 71 is passed by the senate. It also outlines concerns with provisions introduced in drafts since moving out of the senate that are not compatible with approaches taken in neighboring states. It's also important to address the timeline. S 71 was passed by the senate more than fourteen months ago. During that time, Connecticut enacted additional updates to its data privacy law. While those updates have not yet been broadly adopted across the region, we would welcome the opportunity to work with the committee to evaluate how those changes could be incorporated into Vermont's approach. Any data privacy law will carry compliance costs. Those costs come at a time when Vermont businesses are already managing a long and growing list of costs and regulatory challenges. But the question is not whether to act, but how to do so in a way that delivers strong consumer protections and allows Vermont businesses to succeed. There is a path to achieve both. The current draft of s 71 does not yet strike that balance. Josh will walk through specific provisions and explain where the bill diverges from regional models and how those differences can create challenges for Vermont's business community.

[Unidentified Committee Member]: Thank you. So as stated by my colleague, Sullivan, the desire for regional consistency, we think serves important policy objectives. Not only is it fair to Vermont businesses to be competing on a level playing field, but it also enhances the opportunity to create cultures of compliance. The bill that is before this committee and has passed by the senate are lengthy bills. They're complicated bills that are gonna require a lot of effort for businesses, especially those without in house counsel or CIOs to create systems and policies for compliance.

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: And if you can look at similar terms of art that are used within our regional members, That allows for a greater opportunity to be guided as we've seen our other sister states tackle these requirements. And that's good for consumers at the end of the day because if the businesses are doing what they're supposed to do, then the consumers are being protected at the end of the day. We've got some concerns with version 2.3, because in some instances, it's overly broad and in others, it's too narrow. It is seeking to adopt a data minimization standard, we believe, that is unique across the country. And as a result, doesn't serve both consumers and businesses and achieving that maximum environment of creating a culture of compliance. My testimony today is hopefully to go through some of the more pertinent provisions for the chamber to highlight those distinctions for you. So first, let me address the issue of applicability. Version 2.3 departs in three ways from s 71 that was passed by the Senate. First, it lowers the threshold from a 100,000 to 35,000 for those who collect, use, store, analyze or modify data. And that is a standard that reduction probably does align in fact with our regional states. I can't remember which one is which, but New Hampshire and Rhode Island are twenty five and thirty five respectively, and Connecticut starting July 1 will be at 35,000. But the modifications as well also address situations where there is a sale of data or there's a control or processing of sensitive data. And that's a one and done situation. If you're selling any data and you heard in previous testimony about the definition of sale being quite broad, any valuable consideration. Or likewise, if you're controlling or processing consumer sensitive data, if you're just doing one transaction, that means you're gonna be falling within this rubric of regulation. So for myself as a lawyer in my law firm, we're gonna have access to sensitive data, in particular tax returns, financial accounts. First example, estate plan. That is being collected, that's likely being processed. Does that mean every law firm that's gotten a state or real estate or a transactional practice now gonna be brought into this regulatory framework? And similarly with selling of data, it being so wide in that definition, for some of you here who might be candidates for office in this next election cycle, you may be compiling voter lists. And as those lists, if you're transferring them to the party and you're getting something participation in a Get Out the Vote campaign, that is consideration. And that would arguably also bring you into the rubric of this scheme. So we think that one and done type of trigger is probably overly broad and does not benefit the vast majority of folks. Likewise, the exemptions in S231, as I'm sure you've heard from other witnesses, have considerably made changes to the conversion that has come over from the Senate. I will just highlight in particular one of them, and that's dealing with our nonprofits. The version from the Senate exempts C3 charitable organizations, C4 which are social welfare organizations, C6 trade associations and C12 cooperatives. That's not here in this version. The version here before this committee has at least 15 definitions that are unique and substantially different than what has come over from the Senate. I will highlight a few of those for you for your consideration. Let me start with publicly available information and the exclusion that is in the draft before you. The definition excludes public information that is collated and combined to create a consumer profile that is made available on a publicly available website or made available for sale. That's in section two four one five a sub b 48B, Roman numeral I or little Roman numeral I and 3I. You'll get written testimony where you'll have this. So if you need references, you can find that. We think that that is an overly broad exclusion because really what it does is that if I may be dating myself, but the old white pages essential that we used to have, and now sometimes you get that service essentially online to look up someone's address or telephone number, that's no longer gonna be made available under the circumstances. And I think to the extent that that may also involve issues, as I suggested earlier about creating voter lists and things of that nature, public information that is typically out there in ether for folks who engage in the political process, that's not gonna be excluded. That's gonna become data. And then when you combine that with the triggering functions, it brings a lot more folks into the umbrella of this statute than I think what happens with the Senate. Now with regards to sensitive data, this also presents a unique definition as well. And let me quote the area that we think is novel and potentially problematic. It includes online activities of a consumer over time and across websites, online applications, and mobile applications that do not share common branding or data generated by profiling on such data. And I'll talk about this a little more, but when you combine this unique definition with the minimization requirements that you can't utilize or process this data unless it's strictly necessary to further a transaction with a consumer. What is going to happen is for those businesses that may not have common branding, like say an auto dealership, they may have a Subaru dealership, they may have a Ford dealership, and consumers are visiting those websites. If I'm that common auto group, I'm not going to be able to analyze that and understand who that consumer was coming, send them advertisements, things that I think businesses that have separate lines of business, but not common branding will no longer be able to do. And that would have a significant impact on them. Other notable unique definitions, I think ties back into data minimization, which I'll talk about in a minute, is context advertising, first party advertising, and targeted advertising. Scope of rights. S 71 that came over from the senate provides meaningful consumer protections. It has the right for consumers to require confirmation that their data is being processed, to correct inaccuracies, to delete data, to obtain a copy of their data, and to opt out from circumstances where they might be getting targeted advertising or having their personal information sold. Now, with regards to these criteria, the new bill adds a few more rights, two in particular. A consumer will also have the right to get from the controller a list of the third parties with which they're selling data. And in addition, consumer will have the right to know that if their data is being processed by automotive means, they will have some subsidiary rights to information. And to question the results, be informed of the reason that such profiling resulted in the outcome reviewing the data. And when it comes to housing, they actually corrected the data. And let me just note that those two additional rights were passed and adopted in Connecticut in 2025. So slowly these two additions are gonna become part of a more regional model. But I think the single most important issue for the chamber is really about data minimization. And I know you've heard a lot about that. I wanna read to you what we think is the unique standard, both here for New England, but also it sounds like nationally as well. This standard has not been utilized anywhere else. And essentially it will limit a controller to collect and process data to that which is reasonably necessary and proportionate to maintain a specific product or service requested by the consumer. You can also engage in communications other than an advertisement that is provided in reasonable anticipation within the context of that relationship. And you may process or transfer personal data if you have collected it in a way that's consistent with what I just identified, which is reasonably necessary and proportionate to a specific product or service requested by the consumer and use that data to foster first party advertising or targeted advertising. And we think when you look at that framework, that is significantly going to limit the way that e commerce happens for Vermont businesses. And let me give you an example. And the example is this, it's retargeted. Now I'm not a marketing expert, but my understanding is a lot of businesses, if you go window shopping on somebody's website, that data is collected and a smart marketer will be able to through the URL codes or whatever, send you back an advertisement for a product, maybe related to that webpage or maybe another product that was part of your business operation. That's not going to be allowed any longer because the consumer hasn't requested a specific product or service. And so that whole paradigm of e commerce will now go by the wayside. And that's gonna really restrict folks. Now, we heard, I think originally it might've been Tuesday, a representative from Epic to say, well, you'll still be able to advertise at Meta because they have this big database and presumably because they have relationships with these consumers that you can kind of funnel that in. But I don't think that's good for Vermont either at the end of the day, because what it'll do is instead of allowing businesses to utilize their own resources to do targeted advertising, or maybe engage in a cooperative with other like minded businesses to do advertising. They're gonna have to go to the big dominant players in the marketplace. And that's just gonna continue to foster the consolidation of power by companies such as Meta and others. I'd like to talk a little bit about as well, how data minimization and sensitive data operate together as well. And I know you've heard a lot of testimony on this and I'll try not to belabor that point. But before I get there, just wanna contrast back to S-seventy one is passed by the Senate. Because I do think that does strike a good balance on how consumers have rights, they have autonomy and they can limit how their data is utilized. So S-seventy one does have data minimization. You have to use reasonable and necessary processes to what has been disclosed in your privacy policy. So there's a nexus there. You can't just go off and do whatever you want. You've got to disclose to the consumer what you're doing. And then you've got to stick to that in methods that are reasonably necessary to further what's in those policies. Now, I know there's been a lot of concern raised by some to say, well, policies are 20 pages and the details are buried and I don't want people selling my data or giving me targeted advertising. And if I have to read through 20 pages, how am I gonna effectively stop that? S71 addresses that. It says you gotta conspicuously disclose to the consumer that you're intending to sell the data or use it for targeted advertising. If you bury it in 20 pages, you gotta be upfront about it. And I think that enhances the concern, I think that consumers may have and provides meaningful protections as well. Now, I'd like to turn to my thoughts, the chamber's thoughts, I should say, and my thoughts as well on processing sensitive data. We believe there should be restrictions on how you process sensitive data. S71 does that, but it allows options for the consumer. As you heard earlier from testimony that if someone is okay with sharing their data, having it processed, they've got to opt in after of course disclosure. And we think that cuts a more meaningful balance for consumers and for businesses. Otherwise, if you don't have that option, affinity groups will not have the ability to share data in a way that could advance the community. Community gatherings, fundraisers allow for specialized services. And as I talked about earlier as well, that common business, because of the definition of sensitive data that has different lines of business, but not under common branding, won't be able to analyze data and do what we would think of as traditional marketing because it's not strictly necessary to further the actual transaction that has been requested by the consumer. Let me also address a couple of more issues. The bill we note allows for exclusive attorney general enforcement. We think that strikes the right balance. I'd like to note that in the draft from the Senate, they also talk about the opportunity for a cure period. We think that's reasonable that this is gonna be a new line of regulation for many businesses in Vermont that they should be given the opportunity to cure if they mess up. And we would ask that that be as well considered. And then finally, I wanna talk about data minimization because I think there's been a lot of talk here about that issue as well. And S-seventy one is passed by the Senate does have meaningful measures to address data security. First of all, businesses that fall within this regulatory rubric are going to have to do detailed security assessments. They've got to take the time to analyze the data that they're collecting, that they're utilizing, and assess what kind of risk that makes. They can't turn a blind eye to what they're doing. And then they need to implement and maintain a reasonable technical security practice to maintain the security of that data based upon the nature of that data. So we think S71 addresses those concerns in a meaningful way and doesn't leave the wild west here in the state of Vermont. So at the end of the day, we think Vermonters deserve a data privacy bill. Lamont Chamber supports that, but we think the version that was passed by the Senate is the better pathway to accomplish the goals of creating meaningful consumer protections, but also creating a standard that will be recognizable by the business community, allow them to continue to engage in e commerce and hopefully create that culture of compliance that will eventually protect consumers at the end of the day. Happy to take your questions.

[Herb Olson (Member)]: Sure. Thanks very much. So, Trane is right. What I'm hearing, I'm trying to think big picture as opposed to all the detailed stuff that I'm thinking. Big picture for me anyway, is a question of how privacy is gonna be regulated in terms of privacy for the consumer. And sort of the one model that I'm thinking of is, came over the Senate for 19 other states, etcetera. And it basically, and correct me if I'm wrong, in this sort of characterization involves basically disclosure notice to the consumer. And then the consumer has a choice about whether they want their data used, know, maybe, you know, probably a number of different points. Versus what I think is embodied in 2.3. And I'm not saying what's right around right there, but 2.3 suggests that that previous model isn't all that effective, because of the limitations of business consumers, we can find trend and all that sort of stuff, even if I know I have difficulty with that. So, think that's, I think the intent of 2.3, what do you think about that characterization of the two ways to purchase? I I think there's definitely a difference. Right?

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: A fundamental difference. I I wouldn't characterize the senate version as not being effective, and that version is not being effective. I think it offers a different model of enhanced consumer choice. And I think we should start there. Let's see how it works. Our sister states are working there. Attorneys general are bringing enforcement actions under those actions in a And collective way create cultures of I think let's be in the norm with the rest of our region and frankly, our country.

[Herb Olson (Member)]: Yeah, I hear you. For me, not with any sort of previous hat or anything, it's just the notion that all that data about me is floating around, and I have to figure out with probably multiple companies, whether or not I wanna get consent to that. It's been increasingly year after year, that's becoming more difficult. Let's put it that way.

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: Yeah, I mean, I hate to testify based on anecdotes, but I mean, referenced an anecdote for you. So let me, if I may, and I'm often online and I'm being told, do you want cookies to share your data or not? And I go right to no, you can only have the strictly necessary cookies. It does take me an extra few moments, but I do that regularly. I'm glad I have that choice. And in a rare occasion, I may say, you know what? Let's say the icon group where they tell me they're gonna share my data with maybe North Face and Rossignol skis and some other areas of a sport that I enjoy. Because at the end of the day, I'd like to get those ads coming to me because it gives me the opportunity to take advantage of that aspect of commerce. I like having the choice. Okay, I get it.

[Herb Olson (Member)]: So now I'm gonna get into the weeds again. So example about an attorney doing tax attorney, I think you

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: were talking about. Oh, or state planning. Yeah.

[Herb Olson (Member)]: Yeah. And I'm looking at the duties of a controller. And this is all about the state of administration. Yeah. And it's kind of limited the framework to specific product or service tax advice requested by the consumer with whom the data contains. That sounds like tax returns. So, and I understand you have an issue around sanctification,

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: but why wouldn't the tax attorney come within that rubric? Well, I think that's the problem. The tax attorney is gonna fall into the statutory scheme. And now, as you know, as a fellow member of the bar, we have duties of confidentiality. That's not gonna be a problem. No one's selling the state of the third parties. But every other aspect of this, as far as if a client comes back and says, well, we wanna understand, we want these notices. It's gonna create a lot of additional regulatory burden that might not already exist. Whereas today that practitioner can say, this is simple. I need to have a system, a good data security system, so I'm not breaching and I'm maintaining confidentiality. And I don't share the information with anybody, absent of course, client consent, as you know. Why should I have to comply with all these other requirements in 54 pages of statute?

[Herb Olson (Member)]: I just don't understand why that kind of information is reasonably necessary to provide the legal service

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: for the client. Well, I think tax returns, if you're doing tax law, you're collecting people's tax returns. And if you're doing estate planning, you're collecting financial information. You need that information.

[Herb Olson (Member)]: You need that information to provide advice. Absolutely. So I guess I don't understand why it doesn't come within that. I think it does.

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: I think we're talking I I think we're talking about the same thing.

[Herb Olson (Member)]: Well, but I think you were suggesting that you would not that something you would be altering that you're providing that service, that tax service, by virtue of standard accounts for you using data that's reasonable and necessary to provide the service, I don't get

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: I think by merely collecting and processing this data means you've become a controller under the statute, and therefore you have to abide by all the other terms and conditions therein. But if you only taken in the information that you need to provide the service, what's about? I've got to create privacy notices that I've got to respond to if my clients wanna exercise any of the five rights, I've got to deal with that. Instead of very simply saying, I'm maintaining this confidentially. And if you want your file back, you can have your file back. But it creates a whole new nuance of regulatory criteria that the small business didn't have to do. So probably similarly for CPAs, I would guess as well.

[Herb Olson (Member)]: Yeah, okay.

[Michael Marcotte (Chair)]: Edye?

[Edye Graning (Vice Chair)]: Unmuting, lowering hand, all of that takes so much time.

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: I could

[Edye Graning (Vice Chair)]: be adept at it by now. I just have a couple of questions. I'm wondering on the letter, I haven't seen it yet, is it coming to us today? Is that something I just I'm curious if It's the

[Megan Sullivan (VP, Government Affairs, Vermont Chamber of Commerce)]: sent to Jonathan. And he's The only night sent it to the right Jonathan, or a different Jonathan is wondering what they have

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: from me. And she got confused. No, there's a lot of confused Jonathan's out there.

[Megan Sullivan (VP, Government Affairs, Vermont Chamber of Commerce)]: Yes, your committee assistant should have it and me posting it, I will I can send it out to everyone as well. But yes, you will get that.

[Edye Graning (Vice Chair)]: Great. Thank you. Because I yeah. It's hard to respond. It's hard to know which businesses. It's hard to Yep. Thanks. That's great. And then we talked about, I guess you brought it up again today. We talked about it the other day about being able to advertise to customers who are looking for similar items online. And I'm curious if you could restate those concerns. I thought we addressed them. I thought we said we could make that law more clear. And I just want, I was wondering if you could review that.

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: Yes. So as I understand the data minimization language, and I'll read that again, if that's helpful. That a controller shall limit the collection and processing of data to what is reasonably necessary for culture to maintain, and here's the specific line, a specific product or service requested by the consumer. And then the section goes on to say, but you can still do targeted advertising based upon data that was collected in furtherance of what I just read, specific our service requested. So the the example that I gave about redirect marketing, there has been no product or service requested in the example that I understand it to be. That's just one line of marketing that raises the concern. Then there are probably others as well. The collective marketing aspect that may happen with like the icon pass that I shared earlier. Under this scenario, ICON wouldn't be able to share that data or effectively sell under the broad definition of sale for consideration to North Face, Rasignol, Lang Boots, because that's not allowed for in the context here for then Lang boots to send me an advertisement for 30% off their next generation of boots. So I think it impacts a number of ways of traditional e commerce marketing and that's the problem. And we would suggest that a better model is give the consumer upfront disclosure that's conspicuous. This is what we're doing with your data, not bury 20 lines down or 20 pages down and give me the consumer, you the consumer, the opportunity to opt out.

[Edye Graning (Vice Chair)]: Okay, I think that's helpful. Thank you. I look forward to getting a chance to take a look at that letter.

[Michael Boutin (Member)]: Can you touch base a little more on the fact that we've become controllers?

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: Well, I think it depends on the circumstance, right? My general understanding is it's not uncommon for candidates, not you as legislators, but you as potential candidates, create voter files, you get out the vote activities. You wanna identify who voted in your respective primaries, in your district. And I think it's not uncommon as well for once you the candidate that do that, some candidates I think share that with your state party. That comes part of a bigger database. And then you get some value from that to help you enhance your get out the vote activities. So first of all, that process of collecting the voter data and probably creating priority checklists, that's not public information or that's data that falls under the rubrics of this statutory scheme. And you're controlling it, you're processing it, you're arguably selling it. And that's why you'd probably come under this regulatory scheme. As under version 2.3, I think under the Senate version, that's not so because that voter information is public information that falls outside of the data that will bring you into this regulatory scheme.

[Michael Boutin (Member)]: We have to do privacy notices.

[Abbey Duke (Member)]: This might be more from Megan. When we think about both the version that passed through the Senate and then this updated draft, do have a sense of what it would take for small businesses to comply in terms of effort, in terms of expense?

[Megan Sullivan (VP, Government Affairs, Vermont Chamber of Commerce)]: I think it depends a little bit on where that small business might already be. So if that small business is already confined with other New England states, and this is why we really appreciate a regional model. If you're already providing, this standard for your Connecticut consumers, your New Hampshire consumers, your Rhode Island consumers, that it's not going to take much to say, Okay, can I just move this over for my Vermont customers now and do that in a uniform way? We do have some members who are like, when there are little differences, we do a state by state. What does that specific state say? Some folks say, I'm going go with what is the highest level and then try and hope that that incorporates all. So there's different ways that folks go about it. When it is a new business that's adding this, it is more complicated. If this is the first time you're adding these services, you need to have a thorough legal understanding of what's going on, what you need to do, and someone who can do the technical side of that. And for some businesses that their work is operating online, they might have that technical expertise in house. But for a lot of businesses that are doing e commerce, to try and compete, always happy to bring in conversations about our demographics and challenges. They're likely gonna have to go to a consultant. I would agree that free is usually not the way to go if you want something that's quality. So there are costs involved. And we do have resources like the Small Business Law Center who is trying to help businesses with this. And they've testified in the past that this is challenging. It is a lot for a small business to understand these legal complexities. It's a lot for us to understand these legal complexities. We have to bring in an attorney to work with us to try and be a good partner on this topic. So it's going to be dependent on the business as to what that scale is. But we do know that if this is something that's regionally compatible and they're already doing this for their consumers in other states, that that is a much easier way to say, all right, how do I make sure that my customers in Vermont have the same protections that my customers in these other states have had now for years.

[Michael Marcotte (Chair)]: Just to follow-up on that, is there any way of knowing how many Barbara Mons businesses that are that's been on centric? Either have some type of privacy policy or have none at all? And what would that mean for them?

[Megan Sullivan (VP, Government Affairs, Vermont Chamber of Commerce)]: I don't think there's any way to know Vermont wide. I mean, organizations like ours could try to do surveys. Those are always challenging to get people to actually respond to surveys. But that's gonna be the best way to sort of actually get a quantifiable, alright. What what does this look like in Vermont right now? How many you know, we can sort of there's some data about the level of e commerce that's happening in Vermont that I had to get for a free braille study.

[Abbey Duke (Member)]: And the question I have, too, is that we have a lot of our small businesses, when you think about just sort of a standard service oriented business, for example, cave or something, a business I know something about, where the big significant data is really in the CRM and the customer file. And usually, there's notes. There's all sorts of stuff. And that data builds up over time. The question is thinking about have you thoughts about how CRMs at what point that becomes sensitive data that then would be treated as thinking out loud. But there's the e commerce. But there's also what really and nonprofits with we heard testimony about donor files, for example, where they're keeping all kinds of information. So there's ways that businesses are collecting a lot of information that they're not necessarily utilizing on the web, but they have it. They have the information and often using a CRM that is a third party, whether it's Salesforce or something else. I don't know if that's a question exactly.

[Michael Boutin (Member)]: I think it's a question. I mean, it puts you into a controller position, which then you have to follow in line with all the other commissions.

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: So if you have

[Abbey Duke (Member)]: a CRM, you're a controller.

[Michael Boutin (Member)]: Well, I mean Well, then it's well, not 35,000. But but it's sensitive data, which is so expensive compared to the other.

[Herb Olson (Member)]: It pushes you over for, I mean, if

[Michael Boutin (Member)]: you send a card to somebody for their birthday, it's

[Abbey Duke (Member)]: right. Mean, there's a lot of CRMs at birthdays, they probably have dietary preferences. They have religious preferences, like kosher or whatever. There's a lot of different ways you're collecting information that says a lot about the people that it goes into a CRM. Notes about, oh, don't call them older brother or whatever, it's out for a month. There's these notes, right? You talk to somebody, you take notes in order to use that for future.

[Michael Boutin (Member)]: Following up on that, using your email, you have an extensive history of e mails with AI to get information such as I just went and used Gen nine and pulled up your email address. We think that that would bring me over to a data controller position, but if I have any sensitive information in my email, would it not? Because it's technically I'm using it as a repository for information.

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: I don't think email addresses alone, the definition of sensitive.

[Michael Boutin (Member)]: No, but it's a data point and it's a repository that emails have, I mean, using like 30 bazillion emails that I never delete and using an AI to pull information that I can't easily find.

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: Right, so if you're collecting, you're analyzing, you're creating something in a CRM, you're prioritizing and you do that for 35,000. Or if you sell one of those things that you've done, that brings you into the version 2.3. Or if you have sensitive data, which

[Michael Boutin (Member)]: all of

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: our accounts, if we think about it, we all have sensitive data in our emails. I would hope not. Why don't we take a look at the definition? I mean, are you talking about sensitive data just from your own sensitivity or are you talking about the strict definition?

[Michael Boutin (Member)]: The definition that's in the bill, we would have sensitive, we would absolutely have sensitive data. Stuff that references.

[Abbey Duke (Member)]: Don't talk about racial or ethnic origin, religious, philosophical points.

[Herb Olson (Member)]: Do we have any discussion? Because I have some thoughts about that. Okay. Sorry. No. I I

[Michael Boutin (Member)]: I I'm easy.

[Michael Marcotte (Chair)]: We have To ask know we have one more for someone.

[Jonathan Cooper (Member)]: Can I Yeah? I mean

[Megan Sullivan (VP, Government Affairs, Vermont Chamber of Commerce)]: I do think

[Herb Olson (Member)]: I don't want Mike, I don't want you to sell my Not

[Michael Boutin (Member)]: to sell.

[Herb Olson (Member)]: No. I don't think you would, but I wouldn't want anyone to sell sensitive data that I might have had a con email conversation, frankly. And in order to sell under the Senate version, you gotta give notice that you're gonna do it in

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: an opportunity to opt out.

[Herb Olson (Member)]: I'm thinking of a broader kind

[Michael Marcotte (Chair)]: of category.

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: I'm not even talking

[Michael Boutin (Member)]: about selling. I'm just talking about the fact that I get lumped into a controller position that's subject to all the requirements just because I use my email to find an email for something.

[Herb Olson (Member)]: Bring it on. I'll I'll regret. I have a disagreement about the nature of what we're trying to do here. That's all. Yeah.

[Monique Priestley (Clerk)]: Thanks. So I know you started by stating out that the Connecticut's as, the the 71 is passed by the Senate has meaningful protections, which is based off of Connecticut from several years ago. And Senator Moroney, who crafted that himself, testified at the opening of this saying he doesn't suggest, recommend copying where he was several years ago, since none of these are static bills. States are always learning from each other. And I don't know why we would want to give for Monterey less protections than what folks in Connecticut have. The AG report in 2024, some of the things there's lots of things that they recommended in the first year that they update, including publicly available information and definition, the definition of sensitive data, all of the exemptions. The enforcement reports in 2025, they said, although it's been in effect for two years, complaints still involve consumers' unsuccessful attempts to exercise data rights, getting to the need for data minimization. With 77 complaints, a third of those were specifically due to publicly available information. And the update that Maroni is working on for 2026, currently, that definition, I say, you had a problem with. It very closely matches Oregon and a few other states. And Moroni's update himself is copying what's in law right now in kids code. And so I'm just curious, with all of this, can you address why would we copy a bill from several years ago and get for mom and there's less infections than what people in Connecticut have?

[Megan Sullivan (VP, Government Affairs, Vermont Chamber of Commerce)]: I mean, you can listen to my testimony again. But what I specifically actually said was that 71 was passed out of the senate fourteen months ago. And during that fourteen months, Connecticut updated its law. So so we didn't suggest going back, or we didn't s 71 didn't pass behind Connecticut. It actually passed the senate before Connecticut 2025. Connecticut 2025 passed at the end of the twenty twenty five legislative session in Connecticut. In 'seventy one, you had in the early part.

[Monique Priestley (Clerk)]: Keep referring to, Josh kept saying that you guys support as passed by the senate. And I'm just why would we trying to make

[Megan Sullivan (VP, Government Affairs, Vermont Chamber of Commerce)]: the distinction between s 71 that we're looking at now, draft 2.3, and the s 71 that we had supported. Now we'd be happy to talk about what's gone into place in Connecticut, though, to be clear, regionally compatible. This is happening in Connecticut. It has not gone into place yet. Right? Shouldn't It will start in July 1. So we don't know what those will look like, how that will play out. We don't know what that means for consumers yet because they start 07/01/2026. But we're happy to look at what has gone into law in Connecticut since 'seventy one has been in this committee.

[Herb Olson (Member)]: Other questions?

[Monique Priestley (Clerk)]: Just the law school citation that you had of the 100,000. I'm just curious, could you provide that report and would like to look at it?

[Megan Sullivan (VP, Government Affairs, Vermont Chamber of Commerce)]: I think

[Joshua Diamond (Special Counsel, Vermont Chamber of Commerce)]: it's UVM, not the law school.

[Monique Priestley (Clerk)]: Well, I thought it was, yeah, UVM. I don't know what the citation is. Research center? Yeah. Research center. Thanks.

[Herb Olson (Member)]: Okay. Thank you.

[Michael Marcotte (Chair)]: Can

[Matt Schwartz (Policy Analyst, Consumer Reports)]: everyone hear me and see me?

[Herb Olson (Member)]: Yeah. Great.

[Matt Schwartz (Policy Analyst, Consumer Reports)]: Just one sec while I get everything set up. Thank you, Chair Marcotte, Vice Chair Graning, and members of the committee for inviting me to testify today and for your continued work on this topic. My name is Matt Schwartz. I'm a policy analyst with Consumer Reports based in Washington, DC. We support version 2.3 of S71. Consumer Reports is an independent nonprofit and nonpartisan organization. We work with consumers to create a fair and just marketplace, and we have 6,000,000 members spread across every state, including Vermont. CR has advocated at the federal and state levels for the introduction and passage of comprehensive data privacy legislation for years now. We've worked with lawmakers around the country to advance legislation that's as workable and protective of consumers as possible. And you've heard many other privacy advocates over the course of this week already, so I won't belabor the point about why this legislation is so critical to Vermont consumers in the first place. The key takeaway is this, though: our data is increasingly being used against us in ways that we have very little knowledge of or control over. That includes businesses using our personal data to set personalized prices that charge us more than our neighbors for the same products, businesses secretly collecting and sharing our data with insurance companies who can use it to raise our premiums without our knowledge, or simply data brokers sharing dossiers of our personal data on the open market to the highest bidder. Version 2.3 is a compromise approach that would go a long way towards mitigating many of these and other harms while retaining the general framework that will in fact be quite familiar to any business that already needs to comply with privacy laws in other states. It does use the same basic structure as the Connecticut Data Privacy Act. I would estimate it's 80 to 90% the same, but at the same time taking key learnings from regulators and consumer experiences in those states to ensure that Vermont's law is keeping up with our current understanding of what it means to have an effective data privacy law. In particular, this bill currently includes two key provisions: data minimization and heightened standards for sensitive data, including an outright ban on the sale of sensitive data. Neither of these concepts would be unique to Vermont were they to pass. First, as you've heard from many others, this bill currently includes a data minimization provision, which attempts to ensure that data collection and use is aligned with consumers' reasonable expectations of how their data will be used. Those expectations are based on the relationship the consumer has with the business and the context of that interaction. This is critical and it's intended to prevent the common practice that we often see today, where our data is collected for one purpose and then is ultimately used, sold, shared behind our backs to dozens of other companies that we never expected or consented to. By contrast, as you've heard already from several speakers today, industry prefers a much different standard from the Senate version of S-seventy one that simply states that businesses are not allowed to contradict the data practices described in their privacy policy. And if they want to do so, they just need to get consent. But this is actually already the law under Section five of the FTC Act, and as such, does not meaningfully move the ball forward in a way that a privacy law should. Critically, the regulators responsible for enforcing laws that already use such a standard know that it's failing to protect consumers. In Connecticut, for example, the AG is required to submit an enforcement report every year detailing their experience enforcing the law. Their law uses the industry friendly data minimization standard that you've heard about already. In quoting them here, they've said, We cannot underscore enough the importance of these provisions, talking about data minimization. Connecticut's current notice and choice, notice and consent model sets an exploitable standard. Businesses can seek to justify unnecessary data collection by deeming such collection, quote, adequate, relevant, and reasonably necessary to the purpose disclosed to consumers. Continuing on, they say, This standard contravenes data minimization principles outright. It allows businesses to collect data they simply do not need so long as it's disclosed in privacy notices that are often bulky, confusing, or worse, misleading. And so just to be clear, the regulator enforcing the law that industry has long pushed other states to mimic is stating that its core protection doesn't really work to protect consumers. But luckily, we don't have to create a whole new concept to address this problem. Other states like California and Maryland have attempted to address this issue already, and version 2.3 uses a data minimization standard based on their language with some additional points of clarity that are meant to address some of the common complaints we've heard from industry about the supposed ambiguity in those standards. And that's why it doesn't match any other state identically. But the concept is actually quite similar to what we've seen in at least two other states. This bill also contains a ban on the sale of sensitive data, which is a concept we're seeing take root around the country in response to some of the high profile misuses of consumer sensitive data. Maryland includes this in their law, while Oregon also recently banned the sale of certain categories of sensitive data, like geolocation and kids data. And Virginia also recently joined them by banning the sale of geolocation data this year as well. In Connecticut, Senator Maroney is leading a bill that would similarly ban the sale of location data, which has passed the Senate and sits on the House floor. So those are some elements that we really appreciate about this version of the bill, but this version is not perfect and it is far from it, in fact. This version takes a significant step back from the privacy bill that already previously passed the legislature that included a limited private right of action for certain highly significant violations of the law. Unfortunately, the lack of meaningful enforcement has been the key factor in preventing other state privacy laws from effectively protecting consumers. We know, for example, that there's widespread noncompliance with those existing laws. Multiple research studies have found that more than half of all websites are not complying with consumer opt out requests. Consumer Reports did our own study that found that it was trivial to find major brand name companies continuing to show consumers targeted advertisements after they had already opted out. This is highly suggestive that under an AG only enforcement framework, many businesses will simply not comply and bet on AGs not having the resources to go after them. Given that that is a highly significant drawback of this proposed approach, the least we can do is at least ensure this legislation meets the standards set by other states, especially on some of the key issues that we've talked about already. And one additional benefit is that some of those higher standards that are proposed in this version 2.3, such as the BrightLine ban on the sale of sensitive data, are actually easier for the AG to enforce than some of the convoluted and loophole written standards in some other state privacy laws. You've heard from industry that alignment with other regional states is a key priority. But at this point, as has been pointed out, passing S-seventy one that's passed by the Senate would actually make Vermont out of step, given all of the recent and likely forthcoming changes to Connecticut's law alone, not even to mention the ongoing debates of much stronger bill proposals in Massachusetts and Maine. It's obviously impossible to predict how all that's going to shake out, but one thing that we do know is that other state laws are constantly being amended to react to the shortcomings identified by regulators and others. What this bill does do is incorporate many of those learnings from other states into a single bill that will help ensure that Vermont won't need to immediately go back to the drawing board in order to keep pace with those other states, or in fact, fix issues that are already well known to those that follow this issue closely. For those reasons, we support version 2.3. Thank you for the time and I'm happy to answer any questions.

[Michael Marcotte (Chair)]: Thanks Todd. Any questions, Tony?

[Anthony "Tony" Micklus (Member)]: Just to get back on the data minimization thing, one of the things we've heard from the opponents of this bill is that we are taking away a user's right to choose what data they can give, they can collect and what they cannot. Tell me why that's wrong.

[Matt Schwartz (Policy Analyst, Consumer Reports)]: So this bill fundamentally is still an opt out bill. The data minimization standard in this bill is saying that businesses can't collect additional information beyond what's needed to provide the service and process that data in ways that aren't anticipated but completely preserves the ability for businesses to do targeted advertising and just says that if you want to do first party advertising or targeted advertising you have to give the consumer the right to opt out. And so in our view, there's still choice, at least with respect to advertising in general. Where there's maybe less choice is on the sensitive data piece, right? That is a ban on the sale of sensitive information. We think that is important because many of the other states, about 18 at this point, have opt in provisions for sensitive data that say that businesses can only process sensitive data if you can opt in. And what we found is that that hasn't really worked to protect consumers from some of the worst abuses. And part of that's because of the way that the opt out actually or the opt in actually works in practice. It's probably a familiar experience for many people. How this works is like when you go to a new website or new business at the account creation stage, you get a pop up that says, will you consent to your personal data being used? And in order to you to get that service, you basically have to click through and say yes. So that's not really actually a meaningful choice that consumers get. There's no way that you can say, yes, I want you to use my data because I do want this service, but I don't want you to sell it. So it's kind of just ends up being another pop up that consumers click through and they're not actually being protected. And since we think sensitive information is so personal to so many people, the best way to protect people is a ban on that information from being sold. And it's worth pointing out as well, even if that ban were to go in effect in Vermont, wouldn't actually be completely taking away consumers control over sensitive information. There's an exemption in the definition of sale that says it's actually not a sale of personal information if a consumer affirmatively directs a business to share their data. So consumer, even in the world where sensitive data is being banned, would still be able to tell the business if they wanted to, to sell their information. It would just require the consumer to affirmatively direct the company to do that instead of them badgering you all the time, or in the worst case, making you essentially agree to it because of the way that the pop up is engineered. So that's kind of our take on that.

[Herb Olson (Member)]: Questions?

[Monique Priestley (Clerk)]: Yeah, thanks, Matt. So I know from speaking to reporters and stuff nationally about when these privacy bills come up, a common tactic at the very end is try to scare the politicians into thinking that they are going to fall under these laws. And just at the March in Maine, the Maine Chamber of Commerce, Basically, was a push for a political exemption for the legislators to exempt themselves from being part of covered by the law. Then the Maine Chamber of Commerce did a push to get all the businesses mad at the politicians exempting themselves and being hypocrites for not. So and and, again, this is, national reporters have been covering this in 2023. I had this whole email thread between the DNC and the VDP trying to basically talk about this. And at that time, the AG was like, this doesn't apply to legislators. And just talking to legislative council, which I encourage everyone to do, again, I'm getting that this doesn't apply. And I'm just, can you speak to like, do you think this applies to legislators campaigning, going about their business? And also, you want to share anything that's happened in

[Matt Schwartz (Policy Analyst, Consumer Reports)]: other states. I mean, I don't really think this would apply to political actors. Like, whether it should or not is a bigger question, but I don't

[Monique Priestley (Clerk)]: Yeah, no, agreed. I agree. I'm fine to be governed if that

[Matt Schwartz (Policy Analyst, Consumer Reports)]: It's hard to regulate all things at once, right? There's a reason why these bills don't regulate, say, government use of data and you could probably lump in political campaigns into that as well because there's just kind of like a different set of imperatives that would appear in that situation. But I think it's fairly clear that this doesn't apply to political candidates. It says this bill only applies to a person that conducts business in this state or a person that produces products and services. And I just don't think that political candidates are conducting business or providing products and services. I mean, maybe it could benefit from some clarity on those terms, to be crystal clear that it doesn't. But a plain reading to me suggests that it wouldn't cover political candidates. I mean, at the end of the day, I do think people deserve rights relative to the data that's collected about them and used by political campaigns. Again, whether this is the right vehicle for that or not, leave up to you. But I don't see how this bill could be construed to apply to them.

[Michael Marcotte (Chair)]: Question? Great. Matt, thank you for joining us at.

[Matt Schwartz (Policy Analyst, Consumer Reports)]: Thanks, y'all. Have a good day.

[Michael Marcotte (Chair)]: You too. We committed that it's for today. Tomorrow, I appear at nine. We have a witness coming in. Mary Marley, privacy for cards. So remember, we only have that nine to 09:30, so it's really imperative that everyone, at least the quorum is here for 09:00 so we can start right on time. Now that Maggie wants to testify, we'll put her on right after the floor. So we'll see what the estimated time of floor is tomorrow. And right now, we have it set at 11:20. We could start earlier than that. I think that's it. Any questions? Okay. So we'll see everyone here in