Consumer Privacy Remains Focus for State Legislators

On June 16, Vermont became the 23rd state to enact a comprehensive consumer privacy law when Republican Gov. Phil Scott signed SB 71, the Vermont Data Privacy and Online Surveillance Act. The measure, now Act 145, takes effect Jan. 1, 2028.

The law gives consumers rights over their personal data and imposes obligations on businesses that collect, process or sell that data, while leaving enforcement to the state attorney general.

The enactment comes as the International Association of Privacy Professionals, or IAPP, says momentum for comprehensive privacy legislation at the state level is at an all-time high.

Comprehensive Privacy Laws Enacted in Nearly Half of States

As of June 29, 23 states had enacted comprehensive privacy laws, according to the International Association of Privacy Professionals’ Westin Research Center. Narrower or differently scoped privacy laws, such as Florida’s Digital Bill of Rights, are excluded from IAPP’s comprehensive-law count. But IAPP said comprehensive bills are still pending in four other states.

Vermont’s New Law Follows 2024 Veto

Two years ago, the Vermont legislature passed HB 121, the Vermont Data Privacy Act, sponsored by Rep. Michael Marcotte (R) and others. That bill sought to codify consumer protections, including a limited private right of action. But Scott vetoed it, saying it “creates an unnecessary and avoidable level of risk” and calling out the private right of action provision specifically.

“One area of risk comes from the bill’s ‘private right of action,’ which would make Vermont a national outlier, and more hostile than any other state to many businesses and non-profits — a reputation we already hold in a number of other areas,” Scott wrote in his veto message. “I appreciate this provision is narrow in its impact, but it will still negatively impact mid-sized employers, and is generating significant fear and concern among many small businesses.”

Privacy advocates, however, argued that HB 121 would have provided Vermonters with stronger protections by limiting the sale of sensitive data, restricting data collection and giving consumers a limited ability to enforce those rights.

Scott concluded his veto message by saying that “Vermont should adopt Connecticut’s data privacy law, which New Hampshire has largely done with its new law. Such regional consistency is good for both consumers and the economy.”

Connecticut Expands Privacy Agenda

Vermont’s new law, SB 71, “largely tracks the 2025 version of Connecticut’s data privacy law,” although it doesn’t include children’s privacy provisions, which the state passed through separate legislation, or a private right of action, according to privacy and cybersecurity consultant David Stauss.

Connecticut has continued to expand its privacy framework. This year, lawmakers enacted SB 4, a consumer privacy and protection law that amends the Connecticut Data Privacy Act by adding rules for data brokers, deletion requests, personalized algorithmic pricing, facial recognition technology and precise geolocation data.

Connecticut also enacted SB 5, an AI and online-safety law that sits alongside the state’s comprehensive consumer privacy regime. The multinational law firm Morrison Foerster called it “one of the most wide-ranging state AI laws to date,” noting that it reaches frontier AI models, AI companions, automated employment-related decision technology and content provenance.

Evolving State Privacy Law Landscape

Vermont’s new law adds to a broader state-by-state privacy map that continues to change quickly. The IAPP Westin Research Center tracks proposed and enacted comprehensive privacy bills on its website.

Under IAPP’s methodology, Vermont brings the number of states with comprehensive privacy laws to 23. That methodology matters, as IAPP excludes narrower or differently scoped privacy laws, such as Florida’s Digital Bill of Rights, from its comprehensive-law count.

But that list could soon grow. The tracker notes that comprehensive bills pending in Massachusetts and Pennsylvania have moved across chambers, while similar proposals in Michigan and North Carolina are pending in committee.

Litigation and Enforcement Add Pressure

The state legislative activity is unfolding against a broader backdrop of privacy litigation and enforcement pressure.

In January, the law firm Stinson LLP identified a “wave of new state privacy laws” and a “surge in online privacy lawsuits” as distinct but parallel developments in a privacy landscape shaped by pervasive data collection and online tracking technologies.

Stinson said the privacy litigation has been fueled by aggressive plaintiffs’ strategies and evolving interpretations of consumer protection, privacy and surveillance statutes. The firm cautioned, however, that the legislative and litigation trends are not directly connected because most state privacy laws do not include private rights of action. But it said both trends reflect growing scrutiny of online tracking technologies.

Global business law firm DLA Piper likewise said in the U.S. section of its Data Protection Laws of the World guide that recent enforcement and litigation trends underscore the need for businesses to keep pace with changing privacy and data-protection requirements.

The developments show that privacy remains an active state policy issue, with new proposals increasingly overlapping with AI, data brokerage, automated decision-making and online tracking.

—By SNCJ Correspondent BRIAN JOSEPH

Visit our webpage to connect with a LexisNexis® State Net® representative and learn how the State Net legislative and regulatory tracking service can help you identify, track, analyze and report on relevant legislative and regulatory developments.