Vermont Governor Vetoes Data Privacy Act

Following the Vermont Senate's failure to override Governor Phil Scott's veto of the Vermont Data Privacy Act (VDPA), the much-discussed bill will not be enacted into law – at least in its current form. As passed by the legislature, the VDPA was largely considered the strongest (i.e., most onerous) comprehensive data privacy law in the United States, at least since the California Consumer Privacy Act (CCPA).

In his June 13 letter to the Vermont General Assembly, Governor Scott outlined his areas of concern with the VDPA as well another proposed law, the Age-Appropriate Design Code (AADC). Governor Scott focused on three main areas of concern.

Private Right of Action

First, Governor Scott stated the VDPA's private right of action "would make Vermont a national outlier, and more hostile than any other state to many businesses and non-profits[.]" The bill provided a private right of action for consumers who were harmed by a data broker or large data