House Concurred in Senate Amendment to H.121, Adopting a Compromise Vermont Data Privacy Act With Age‑Appropriate Design Code; Roll Call 139‑3

The House of Representatives on May 9 voted to concur in the Senate proposal of amendment with further amendment to H.121, a comprehensive data‑privacy bill that blends the Vermont Data Privacy Act with an age‑appropriate design code intended to protect children’s online experiences.

Member from Bradford, the bill presenter, described the further proposal of amendment as a negotiated compromise between earlier House language and changes made in the Senate. Bradford said the amendment retains strong consumer protections, preserves an age‑appropriate design code (the 'Vermont kids code'), and adopts a stepped threshold approach to bring more entities under the law over time.

Key provisions described on the floor include definitions (biometric data; 'consumer' as applied to adults vs. minors), a new term 'large data holder' (someone who processed personal data for at least 100,000 consumers in the preceding calendar year), and thresholds that start higher and step down over three years so the law reaches more businesses over time. Bradford summarized the stepped thresholds as Year 1: personal data of 25,000 consumers (or related blended thresholds), Year 2 and Year 3 step‑downs were read into the record and are printed in the amendment. The bill also preserves data protection assessments and protections for minors, retains exemptions (HIPAA entities and certain nonprofit enrollment‑data services), and clarifies that the chapter does not authorize law‑enforcement use of facial‑recognition technology.

A central change from the Senate version was enforcement: the Senate removed a private right of action and gave the attorney general exclusive authority; the House’s further amendment limits a private right of action to data brokers and very large companies while keeping attorney‑general enforcement powers for others. Members on the floor debated that balance: Member from Coventry said the private‑action limitation was intended to protect small Vermont businesses while holding large actors and data brokers accountable; Member from Franklin asked about safeguards against frivolous lawsuits and was told existing Vermont law addresses frivolous‑suit conduct.

Several members spoke in support. Member from Williston described a recent local incident involving an anonymous app, 'Fizz', that caused harm in a school community, saying "H.121 and S.289 take necessary and long overdue first steps to regulate a dangerously unregulated industry that consistently places profits over people." Member from Northfield said they lacked a side‑by‑side comparison of changes and would vote no because they could not understand the 127‑page package.

After requesting a roll‑call vote, the clerk recorded 139 votes in favor and 3 against. Madam Speaker announced the result (Yes 139, No 3). Member from St. Alban's Town then moved to suspend rules to message the House’s action on H.121 to the Senate; the motion carried by voice vote and the House scheduled a recess until 5:30 p.m.

What the bill does not yet resolve on the floor: questions about whether 'neural data' would be clearly covered prompted an exchange in which Bradford said the bill’s definitions likely cover certain physiological biometric data but that the Legislature could revisit neural‑specific language in future sessions or during summer work. Effective dates read into the record: sections on public education/outreach, protection of personal information, and data‑broker opt‑out study take effect July 1, 2024; the data‑privacy chapter and age‑appropriate design code largely take effect July 1, 2025; threshold step‑downs take effect in 2026 and 2027 for later phases.

Next steps: House leadership said H.121 would be messaged to the Senate forthwith for further action.