Vermont committee continues S.71 privacy markup, debates HIPAA exemptions and business burdens

The Vermont House Committee on Commerce and Economic Development resumed consideration of S.71 on May 14, 2026, continuing a line-by-line review of definitions, exemptions and consumer rights. The session focused on when the bill would apply, HIPAA-related exemptions for health providers, and practical burdens the bill would place on small businesses.

Rick Sele of the Office of Legislative Council led the committee through the draft. He summarized the bill's primary coverage thresholds: a controller that "controls or processes the personal data of not fewer than 35,000 consumers" (Vermont residents) would fall under S.71, and any controller that processes consumer "sensitive data" would meet the threshold regardless of the number of consumers. Sele said the sensitive-data trigger would capture entities "one or more" processing such data and that the drafters modeled parts of the bill on recent Connecticut language.

Committee members questioned the sensitive-data trigger. One member said the clause "pushes you over no matter what the amount" and asked whether small providers would be swept in. Members discussed adding a patient-count cap for medical practices that are not covered entities under federal law and whether the Attorney General could rescind an exemption if a practice failed to maintain HIPAA protections; staff said the AG's office would likely be the enforcer but recommended getting the AG on the record.

The committee reviewed a long list of standard exemptions (public-health activities, human-research records, substance-use records, and certain credit-reporting and financial regulatory exceptions). Members noted the House draft differs in structure and wording from the Senate version and that the exemptions generally exist because state or federal laws already regulate the subject matter.

On consumer rights, the draft gives Vermont residents multiple rights: to confirm whether a controller processes their data; to access data; to receive a portable copy in a readily usable format; to obtain a list of third parties to whom data has been sold (with a trade-secret exception); to opt out of targeted advertising, sale of personal data and certain profiling; and to challenge profiling outcomes and correct inaccurate data. The draft treats verifiable parental consent under COPA as satisfying consent obligations for controllers dealing with minors.

The staff reviewed controller duties and timelines. The bill uses a 45-day response window for most consumer requests, with the possibility of extension if a controller notifies the consumer, and a 60-day deadline in the appeals process for a final decision. The draft allows controllers to refuse to comply when they cannot authenticate a request using commercially reasonable efforts for certain rights, although committee members asked whether opt-out requests such as cookie-based preferences should require authentication.

The committee also addressed implementation for small businesses. Staff described an initial compliance "lift" (data mapping, privacy notices and establishing a method to receive and process data-subject requests) and ongoing governance responsibilities. Members noted many Vermont small businesses rely on simple loyalty practices (physical punch cards, rolodex lists) and questioned whether those businesses would have to hire contractors or adopt automated systems to comply. Staff pointed members to NIST data-protection guidelines emailed to the committee as practical, small-business-oriented guidance.

Members debated consent language and the bill's anti-dark-pattern provisions. The draft requires methods that are "easy to understand" and "easy to execute" and prohibits language or interactive elements that impair choice; some members argued this narrows the statutory definition of consent and asked staff to align the consent clause with the bill's consent definition and to confirm that revoking consent is as easy as giving it.

The committee did not take votes on S.71. They agreed to continue the markup the following morning after returning from the floor.