Vermont

Overview: Data-powered online ads help small businesses cost-effectively reach new customers and remind previous customers of new opportunities, e.g., discounts and new products. Without data, small business ads are at significant risk of not being in consumers’ preferred language or presenting correctly on devices. Without general location and interest data, small business ads could be entirely wasted.

Over-regulating data collection and processing will make advertising more expensive and less effective for small businesses.

Specific Problems with H. 121: 

Problem #1: The private right of action sets up small businesses to be victimized by plaintiffs’ lawyers. Just as happened with patent infringement and still happens with ADA lawsuits, small businesses will be sued for over-collecting or over-processing consumer data and then will be offered the “opportunity” to settle for payments that are unfairly costly but well below the costs of litigation defense.

Problem #2: The “data minimization” limit will stop small businesses from knowing and communicating with their customers because it limits collection to only data “necessary… to provide the services for which the personal data was collected.” This overrides other provisions in the bill that permit data collection, in particular relating to advertising and communication that is critical to small businesses. Specifically, this limitation:

• Prevents businesses from contacting existing customers about upcoming sales, new products, or other marketing updates.
• Prevents businesses from using customer location data to decide where to open new locations.
• Prevents businesses and their marketing partners from collecting traffic data needed to measure and improve website performance.
• Prevents businesses and their advertising partners from collecting consumer data necessary to measure and improve advertising effectiveness.

Consumer advocates have recognized in other states that data minimization provisions conflict with carefully considered “do not sell my data” provisions and that “data minimization” exceptions are needed to ensure that otherwise permitted advertising is allowed.

Problem #3: Data protection assessments are a new concept requiring expensive lawyers and consultants. The requirement that all businesses with more than 6,500 consumer interactions produce “data protection assessments” for every data processing activity “that creates a heightened risk of harm” will crush small businesses.

• “Heightened risk” processing includes all data related to targeted advertising and “sensitive data,” including data identifying a consumer’s race, religion, or health.
• A purchase of makeup or hair products could identify race. A purchase of religious products could identify religion. A purchase of Tylenol could be considered health data or revealing health status.

Problem #4: The browser-level “do not sell my data” command will be poorly understood by consumers and supersede website opt-ins, blocking businesses from advertising to consumers who request engagement.

Problem #5: The definition of “biometric data” is so broad that explicit permission is required before live event venues can publish crowd photographs on their websites and newspapers can publish people’s photographs.