House advances comprehensive data-privacy bill with private right-of-action clarified

Lawmakers spent substantial floor time on H 121, the proposed Vermont Data Privacy Act, which would grant residents rights to access, correct and delete personal data, opt out of targeted advertising and data sales, and create heightened protections for sensitive and health-related data.

Representative Priestley (member from Bradford) summarized the bill as a framework modeled on other state laws but adapted for Vermont. The act would apply to entities meeting thresholds for processing Vermont residents' data and would require controllers to provide clear privacy notices, opt-out mechanisms and perform data-protection assessments for high-risk processing. The bill creates special rules for online services directed at minors, bans certain dark patterns, and requires controllers and processors to adopt security and contractual safeguards.

On the floor Representative from Orwell introduced an amendment to clarify the private right of action language so that a consumer must first notify a controller and give an opportunity to cure within 60 days before filing suit — matching the legislative intent expressed to the judiciary committee. The amendment reorganized the sentence structure to make the notice-and-cure prerequisite to filing explicit.

The committee and floor supporters emphasized alignment with other states' protections and a combination of an Attorney General enforcement path plus a narrowed private right of action with a cure period and damages limited to $1,000 or actual damages following unsuccessful cure. Opponents raised practical implementation and compliance concerns; the bill includes a public-education role for the AG and Agency of Commerce and Community Development and a planned effective date of July 1, 2025.

The House adopted the committee-recommended amendment package as amended and ordered third reading.