Vermont committee revisits S71 definitions, debates consent and data‑minimization standards

The Vermont House Committee on Commerce and Economic Development continued its review of draft 3.3 of S71 on May 14, focusing largely on definitions and how consumer privacy rights should be authenticated and limited.

Rick Sele of the Office of Legislative Counsel told the committee he had the color‑coded draft on screen and that there were “no changes from what we last went over,” and he walked members through sections on definitions, authentication, biometric data and controller duties. Members repeatedly flagged the document’s mixed provenance — language drawn from Connecticut 2022 and 2025 and from California and other states — and asked staff to mark which text is borrowed and which is authored for Vermont.

Committee members pressed whether authentication of consumer requests should apply to all consumer rights, including opt‑out and profiling rights, and discussed whether the authentication standard should be broadened so a controller must use reasonable means to verify any consumer request. Members also debated whether Vermont should include a list of biometric examples (iris, retina, fingerprints) or leave the term broader.

Much of the debate centered on consent and data minimization. Some members said the shorter phrasing in earlier draft 2.3 — describing consent as a “clear affirmative act” — was preferable for clarity, while others said the more detailed California‑style phrasing could give businesses firmer guidance. Several members recommended hearing from business stakeholders and relying on forthcoming Attorney General rulemaking to resolve operational questions.

A handful of technical edits were proposed (for example, adding the word “controls” to the affiliate definition to avoid ambiguity) and counsel warned that a line‑by‑line, cross‑state comparison would be time consuming but may be necessary for Senate negotiations.

The committee did not adopt final language and agreed to continue work; several members asked staff to produce clearer provenance marking (which text comes from Connecticut, California or other models) and to solicit testimony from business groups and the Attorney General’s Office before settling contested definitions.

What’s next: The committee will return to S71 for further markup and to reconcile data‑minimization and consent language with enforcement provisions and possible AG rulemaking.