Washington – The Computer & Communications Industry Association (CCIA) has urged Vermont Governor Phil Scott to veto H.121, a bill proposing the Vermont Data Privacy Act and an age-appropriate design code standard in the state. While the CCIA supports Vermont's aim to enhance data privacy protections and online safety for minors, it raises concerns about several components of H.121 that present constitutional and compliance issues.

The CCIA emphasizes the need for clear compliance guidelines to help businesses avoid unintentional violations of the regulations aimed at protecting children online. According to the association, although the legislation sets broad expectations, it lacks specific guidance on how businesses can meet these objectives. A significant point of contention is Section 7 of H.121, which outlines mechanisms for estimating user ages. The CCIA argues that these age-estimation mechanisms are unreliable and could expose businesses to liability if they inaccurately identify users under 18.

Additionally, the CCIA opposes Section 1 of the bill, which includes a private right of action allowing consumers to sue businesses for potential regulatory violations. The association warns that this provision could overwhelm Vermont’s courthouses with minor claims lacking substantial evidence of actual injury, resulting in costly and time-consuming legal battles that could negatively impact the state's economy. Furthermore, Section 1 introduces unique definitions and compliance requirements specific to Vermont, potentially hindering interoperability with other state privacy laws and complicating compliance efforts for businesses operating within Vermont.

Alex Spyropoulos, CCIA Northeast Regional Policy Manager, stated: “The importance of data privacy and the safety of young people online cannot be understated, but it is vital that in lieu of a single federal framework, any law pursued should prioritize interoperability and avoid running afoul of the Constitution. The First Amendment guarantees everyone, including teenagers, the right to access information, and this proposal would violate these rights. Teens should not be restricted in their ability to access online content solely because lawmakers rather than parents deem it unsuitable for their age group. Furthermore, the proposed Vermont Data Privacy Act would subject businesses to a unique set of privacy standards and frivolous lawsuits, complicating compliance efforts.”