As Vermont legislators filtered back into the Statehouse early this year for the 2024 legislative session, several set their sights on a new target for regulation: Big Tech.
With the federal government unable or unwilling to set parameters around the collection, sharing or sale of Americans’ data, state lawmakers said they would step up to the plate to establish state-level digital rules by which corporations would have to comply.
But stark differences of opinion between key players in the Vermont House and Senate — and ramped-up lobbying efforts by business interests and Big Tech — threaten to hold up the passage of two landmark bills this legislative session.
“Policy this big takes everyone in the building, chamber-to-chamber and administration, being united,” Rep. Monique Priestley, D-Bradford, told VTDigger in an interview last week. “It has not felt like we as a building are as united as we need to be to fight Big Tech.”
In January, two major pieces of tech legislation appeared poised for passage. One, H.121, would establish ground rules for Vermonters’ digital privacy and data sharing, and establish a private right of action against companies suspected of violating that privacy. The second, S.289, would compel social media companies to adjust their digital codes and algorithms for users under 18 years of age, in hopes of addressing social media’s documented negative impacts on teens and adolescents.
Now, with mere weeks remaining in the 2024 legislative session, the two key legislative panels that initiated the bills — the House Committee on Commerce and Economic Development, and the Senate Committee on Economic Development, Housing and General Affairs — are at odds, despite each of the bills passing unanimously out of the House and Senate, respectively.
‘Hundreds of hours, years of work’
Facing the most pushback is H.121, a sprawling, 80-page bill aimed at protecting Vermonters’ digital privacy. Drawing on policies already enacted by other states, such as California and Connecticut, H.121 establishes rules for companies’ collection, use, sharing and sale of data.
Development of the bill dates back far before this legislative session. It is the brainchild of the Vermont Attorney General’s Office and the 10-member House commerce committee, and the result of years of studying, testifying and workshopping.
Priestley, one of the chief architects of the bill, said she and fellow bill drafters spent a great deal of time hearing from not only proponents of the bill’s goals, but also early skeptics in order to hear from both sides.
“(We) spent hundreds of hours with a variety of advocates and lobbyists, listening to every lobbyist that wanted to sit down and have a conversation — whether it was Google or Comcast or the power companies or all the chambers (of commerce) that came forward, and having conversations, trying to be collaborative,” Priestley said.
It was after those many committee hearings, summer studies and hours of testimony from both proponents and opponents that Priestley and her nine fellow committee members put forward H.121 this year.
Vital to the bill, according to its authors, is a private right of action. If a company is suspected of violating a Vermonter’s digital privacy, as defined by the law, that person would have the right to sue the company. The penalty for misusing a Vermonter’s data under the law is $1,000, and businesses would have a “cure period” to come into compliance before facing fines.
‘Unintended consequences’
It’s not just Silicon Valley household names such as Amazon, Apple and Meta that could be held liable under H.121. The bill, as passed by the House, would be applicable to businesses and nonprofit organizations that possess data from 6,500 consumers or more.
According to Sen. Kesha Ram Hinsdale, D/P-Chittenden Southeast, who chairs the Senate economic development committee, that’s a problem.
”There are unintended consequences,” Ram Hinsdale told VTDigger in an interview last week.
“When you talk about a strong law that impacts Vermont businesses, primarily you are exposing them to litigation from anyone in the country who wants to look at a small entity — that could be an immigrant business, it could be a small nonprofit, it could be a number of really small, vulnerable entities brought under this bill — and they could sue them,” Ram Hinsdale said.
H.121 would primarily impact businesses as it relates to commerce and data collection. Consumers’ data is collected — then used, or even sold — when customers make purchases or even just search for a product online. That data will then often be used in order to serve up subsequent targeted advertising. H.121, as passed by the House, would limit companies to using data only in ways consumers would expect or to which they have explicitly consented.
In the Senate economic development committee on Wednesday morning, Sen. Ann Cummings, D-Washington, questioned the “harm” done by such targeted advertising. She asked: How is it different from conventional advertisements she used to receive in the mail? (The Federal Trade Commission does offer guidance for how Americans can opt out of such forms of unsolicited advertising.)
Ram Hinsdale argued that local businesses have always conducted targeted advertising in some way. She equated online data collection and targeted advertising to a customer walking by a storefront and looking at a dress in a shop window. Shop owners would then want to talk to the prospective customers, she said.
“They want to follow customers like they used to in the old days,” Ram Hinsdale said.
Since H.121 passed the House and landed in her Senate committee, Ram Hinsdale has heard testimony from numerous Vermont-based businesses that have recently spoken out in opposition to the bill, citing their potential legal liability.
Among the loudest voices in dissent appear to have been large Vermont-based businesses that conduct nationwide sales, such as the Vermont Country Store, Orvis, King Arthur Baking and Gardener’s Supply.
The input of large, state-based retailers from similar data privacy discussions is far from unprecedented. In December, Politico reported that L.L. Bean tipped the scales in the Maine Legislature’s own data privacy debate.
“While we wholeheartedly support consumer privacy, we are extremely concerned about provisions in the current version of H.121 that would affect the ability of our businesses and other small to mid-size companies that also do business online,” Vermont Country Store President and CEO Jim Hall wrote to a slew of legislators last week, in an email obtained by VTDigger.
His top two requests? First, raise the “way too low” threshold of 6,500 customers. Second, “There should be no private right of action,” Hall wrote.
Private right of action, or no?
Ram Hinsdale’s committee got to work making changes to the bill. Senators raised the business size threshold to those that possess data from 6,500 consumers or more to 25,000 or more, nearly quadrupling the threshold.
“Based on fear-mongering and conjecture, they started making changes,” Rep. Edye Graning, D-Jericho, a member of House Commerce, said last week of the Senate panel.
And the committee’s work is not yet done. Last Friday, Ram Hinsdale told VTDigger that she was mulling the idea of scrapping the private right of action altogether.
Come Wednesday morning, with a potential vote on the bill scheduled, her committee revisited the idea — and was far from unified. Sen. Alison Clarkson, D-Windsor, told her committee-mates, “I really would prefer, if possible, to keep the private right of action.”
“We already have a lot in law that makes it not possible for there to be frivolous lawsuits,” Clarkson said. “I don’t see this injuring small business as much as other people do.”
Before the committee convened Wednesday morning, Vermont Attorney General Charity Clark, who has long pushed to implement data privacy rules in statute, sent a memo to the committee reiterating her support for the House-passed language. In the memo, she wrote that her support for a private right of action is “unwavering.”
“Vermonters deserve to be able to take action if their own data privacy has been violated,” Clark wrote Wednesday morning.
Last week, Clark told VTDigger that, even without the private right of action, H.121 would still be a step forward for the state. “But it would be a shame,” she said.
“If individuals aren’t bringing actions when companies violate data privacy, if they are not permitted to do that, then the attorney general is the only person who can,” Clark said. “Of course, I love that and feel strongly about data privacy and would love protecting Vermonters, but from a practical perspective, what that means is the burden of paying for enforcement falls to taxpayers.”
Rep. Michael Marcotte, R-Coventry, who chairs the House Commerce committee, told VTDigger last week that he has “never been a big fan of private right of action,” viewing it generally as a doorway to lucrative class action lawsuits. But H.121 is different, he said.
“If we can craft something that actually gives the individuals the ability to to try to remedy situations that the company won’t remedy, then I think we should be doing that,” he said.
If H.121 is, in the eyes of its detractors, so anti-business, Marcotte questioned: Why did he and all of his Republican colleagues vote in favor of it on the House floor?
‘Industry is our guess’
After years of workshopping the bill and a tripartisan House floor vote, Priestley and her committee-mates said the sudden, steady stream of opposition testimony cropping up in the Senate doesn’t pass the smell test.
Asked what force she thinks is behind the sudden wave of concern, Priestley answered quickly, “Industry is our guess.”
She pointed to a 2021 article by the watchdog group Tech Transparency Project, headlined, “Big Tech’s Go-To Defense: Hiding Behind Small Business.” In the report, the Tech Transparency Project wrote that the CEO of a Kansas City-based plumbing company began taking public stances against data privacy proposals — a seemingly “odd” crusader on the topic, but “not exactly a coincidence.”
The local plumbing company’s CEO at the time sat on the board of a Washington, D.C., nonprofit, Connected Commerce Council, that “bills itself as a voice for small business but appears to be little more than a front for the interests of tech giants like Facebook, Google, and Amazon,” according to the article.
“Tech giants use groups like the Connected Commerce Council to cultivate a hand-picked group of small business owners who can amplify their stances on privacy, antitrust, and other hot-button issues — without the industry’s fingerprints on it,” the Project wrote.
Now the Connected Commerce Council has dipped a toe into Vermont. According to records with the Vermont Secretary of State’s Office, the council retained four contract lobbyists from the Vermont-based lobbying firm MacLean Meehan & Rice on April 8. The council spent $620,000 in lobbying efforts nationwide in 2023, according to Open Secrets.
Hall, too, has pertinent professional affiliations outside of his day job at the Vermont Country Store. He is also the chair of the American Catalog Mailers Association, an industry group representing “catalog, online, direct mail, and other remote-selling merchants, as well as their suppliers,” according to the association’s website.
“Membership is open to any party with significant interests in the catalog/online/direct industry, including catalog mailers, e-commerce merchants, direct mail merchants, printers, paper companies, consultants, list firms, database marketing and other service providers,” the website reads.’
The American Catalog Mailers Association has not registered any lobbyists in Vermont as of Tuesday afternoon, according to the secretary of state’s database.
Silicon Valley’s most recognizable tech giants, however, have. Airbnb has contracted with eight lobbyists under the Golden Dome, Amazon seven, Apple five, Google four, Meta four and Microsoft six. They employ some of the same lobbyists, but together their efforts amount to more than 20 people representing their interests at the Statehouse.
‘They already have strong data privacy policies’
Last week, Christopher Curtis, who directs the Consumer Assistance Program in the Attorney General’s Office, sent legislators an email obtained by VTDigger. In it, he tried to ease legislators’ worries about H.121’s impacts on Vermont businesses.
To do so, Curtis “did some checking on privacy policies from some of the businesses that have testified on the bill,” he wrote to committee members, including the Vermont Country Store, Orvis, King Arthur Baking and Gardener’s Supply.
“It does appear that a number of Vermont companies with an interest in H.121 are already in compliance with various state privacy laws,” Curtis wrote. “So, that is great news because it means the burdens of compliance are manageable and are likely met (or easily adapted) by them. And, they likely provide a helpful roadmap for others.”
In other words: The companies conduct e-commerce nationwide, and already abide by other states’ stringent data privacy requirements. Why wouldn’t they be able to in Vermont?
In response, Ram Hinsdale wrote to Curtis, “This is exactly what the businesses were saying — they already have strong data privacy policies because it’s good for business.”
Of most concern to her, she continued, are H.121’s private right of action and data assessment provisions, “and anything that is confusing or ambiguous that veers from the norm in most states.” She pointed directly to Hall’s email, sent to lawmakers one day prior.
“Jim Hall, who wrote the email, is actually the chair of the data privacy committee for the American Mail Catalogue Association (sic),” Ram Hinsdale wrote. “So I actually think they have more of a grasp on these things than any of us. This is their livelihood.”
Playing hardball
Even with the possibility of gutting the private right of action on the table, Ram Hinsdale still left open the possibility of putting H.121 on ice until a future year, telling VTDigger she thinks the bill still requires further vetting.
The stakes of dropping H.121 at this juncture are high, according to the House commerce committee. Without H.121 this year, the Legislature won’t have a base upon which to add regulations on artificial intelligence come next legislative session. With new AI advancements arriving by the day, and the legal landscape of AI-generated content more ambiguous than ever, lawmakers said they can’t wait another year to start tackling the issue.
“Data privacy is not a one-and-done, because the world is changing so fast,” Graning said last week. “We don’t think we’ll ever be ahead of the curve because things are just changing so fast … but we do want to be able to be in the same decade. And I think the longer we wait, the farther behind we get, and the harder it is to catch up.”
So the House committee is playing hardball. Faced with the possibility of a gutted H.121, the committee has threatened to hold the Senate’s own Big Tech bill, S.289, hostage.
S.289 is modeled after draft language authored by the national digital privacy advocacy group Kids Code Coalition, which is pushing for similar legislation in a handful of other states. The bill would place algorithm and coding restrictions on social media platforms for users under the age of 18 — such as ending “unlimited scroll” for children — in an attempt to reduce the negative mental health impacts of addictive social media use on developing minds.
‘I want to go after Big Tech’
Big Tech is by no means in favor of S.289. Numerous tech industry representatives vehemently testified against the bill to the House commerce committee earlier this month in a hearing reminiscent of Congress’s famed Big Tobacco hearings.
Throughout the hearing, representatives of tech industry groups such as NetChoice, the Computer and Communications Industry Association, Chamber of Progress, TechNet and R Street Institute offered a nearly identical refrain: If legally compelled by the state to adjust codes and algorithms for underage users, social media companies would overcompensate and require users to verify their ages with personal identifying information. Such personal collection, the tech representatives said, would be antithetical to lawmakers’ goals to protect Vermonters’ sensitive data.
Committee members didn’t buy it.
“So you’re telling me there’s no other way that these tech companies — that are sifting through emails, text messages, online browsing, phones and devices — have no other way, other than asking you for (a) birthday, to figure out how old, or in what what spectrum, a person falls?” Priestley interrogated a representative of the Computer and Communications Industry Association.
It’s a common trick, Priestley told VTDigger after the hearing: Faced with the prospect of regulation, tech companies will threaten to implement new regulations so poorly that lawmakers throw up their hands and give up.
S.289 is a top priority for Ram Hinsdale’s this year, and she is its primary sponsor. As her committee took testimony on the bill, she told VTDigger, she “cried almost every day.”
“As a new mom, and having teenagers come into the committee, I want to go after Big Tech with all of my might,” Ram Hinsdale said. “People around the country have now seen me do battle with their industry representatives over the sale of children’s data.”
The House commerce committee’s threat to stall S.289 is undoubtedly a personal blow to Ram Hinsdale. Still, she said she wasn’t surprised by the move.
“We’re not talking about just letting the bottom fall out of data privacy,” Ram Hinsdale said when asked about the House committee’s plan. “We’re talking about a fair path forward … that we have struck the balance between any harm that’s caused, and helping businesses comply.”
Now, neither bill is likely to move forward until later this week, at the earliest. If either chamber passes the other’s bill with substantial changes, and if the chamber of origin refuses to concur with those changes, each bill would then head into a conference committees with House and Senate members to reconcile those differences.
“The ultimate would be for us to be able to work it all out,” Marcotte told VTDigger. “They might have to go to conference. But I mean, in my mind, right now, the way things are going, I don’t know how we avoid conference. Unless, you know, things get pulled back.”