Senate committee weighs nonprofit exemption and timeline in Vermont data-privacy amendment

The Senate Institutions committee on May 29, 2026 took testimony and debated changes to a proposed data-privacy amendment that members said could conflict with other bills and may unduly burden nonprofit organizations.

Committee members opened the session to consider an amendment associated with Senator Ron Pinsdale and noted overlap with other measures, including a recently passed S21 and a House bill cited as H211. Lawmakers said inconsistent definitions of terms such as "publicly available information" and "biometric data" across bills and in the "kids code" risk creating confusion for organizations that must follow multiple statutes.

A senator who spoke during the discussion said the second instance of the amendment appears to exempt nonprofits but expressed concern about the process. "It would set a bad precedent to get a bill that we have in our possession for roughly two days and not hear from one of the groups that's most impacted," the senator said, arguing many nonprofits have not had adequate time to assess the technical language.

Tina Zuk, government relations director for the American Heart Association in Vermont and in Colchester, told the committee the association supports the legislature's privacy goals but urged either an entity-level nonprofit exemption or more practical alternatives. "Every dollar that we spend on compliance for data privacy takes away from our mission," Zuk said, adding that smaller nonprofits may lack in-house counsel or technical staff to implement complex requirements.

Zuk said she had emailed the committee proposed language that would exempt personal data collected, processed, maintained, secured, or disclosed by a nonprofit when the program is validated by a third-party national charity-accountability organization; she also suggested a waiting or transition period to allow nonprofits to prepare. She said the national American Heart Association has lawyers and complies with other states' laws but that local and smaller organizations would struggle without assistance.

Committee members discussed the amendment's compliance timeline. The bill text cited an 18-month compliance period, with an additional 18 months to cure certain defects — a timeline some senators characterized as effectively three years in practice but too short for many small nonprofits. Members also raised a widely cited compliance-cost estimate from California of $40,000 for some entities and noted United Way and other intermediaries sometimes hold higher-risk funds for smaller groups; the Vermont immigration legal defense fund was described as approaching $1 million in recent fundraising.

Lawmakers referenced that many states with comprehensive privacy laws often exempt nonprofits — members named California, Connecticut and New Hampshire as examples — and suggested Vermont could follow those precedents or provide longer, conditional compliance windows tied to technical assistance. No formal vote on the amendment was recorded in the committee during the session.

The committee asked witnesses and stakeholders to continue submitting proposed language and guidance; members emphasized the need for clear statutory definitions so nonprofits, businesses and out-of-state entities can determine whether and how the law applies. The committee did not take a final vote and left the matter for further consideration and possible amendment.