Consumer-Backed State Privacy Bills Overcome Industry Opposition

Consumer privacy advocates plan to harness recent legislative wins in Maryland and Vermont to help other states strengthen protections for the personal information collected by companies.

Nineteen states have enacted laws giving residents more control over how businesses use their data, with the Vermont measure awaiting action by the governor. Maryland and Vermont are standouts among the seven states that have passed bills this year because of provisions that “significantly changed the conversation about privacy in the states,” said R.J. Cross, director of the Don’t Sell My Data Campaign at the Public Interest Research Group.

“This year was different,” Cross said. “We saw more pushback against weak privacy bills and industry lobbyists than we have before.”

Business groups have opposed the new language in state laws, which give consumers the right to know how businesses handle their information and opt out of certain uses. They raised concerns with Maryland’s limits on what data companies can collect as well as the right for individuals to sue over some privacy violations in the pending Vermont measure. Congress is considering a national standard that would largely preempt state laws.

The state privacy landscape is becoming more fragmented with significant differences among laws, said Lisa Sotto, partner and chair of the global privacy and cybersecurity practice at Hunton Andrews Kurth LLP. Variations range from what states must disclose to consumers to how the laws are enforced, with California creating a dedicated agency and states such as Virginia offering businesses a chance to fix violations before penalties.

“We’re in an absolute morass,” Sotto said.

Bloomberg Government

State Models Diverge

The Vermont and Maryland measures are stronger frameworks than most privacy laws enacted elsewhere, according to advocates. States overall aren’t doing enough to protect consumers with industry-friendly laws that put the onus on individuals to manage their privacy, according to a report this year by the Electronic Privacy Information Center and U.S. PIRG Education Fund.

Maryland takes a different approach—which Vermont would follow—by requiring data minimization, or limiting the data companies collect on a person from the outset. Companies can only collect the data needed to provide the requested service or product.

“It’s really that data minimization provision that has the biggest potential to change the equation and to make things easier for consumers,” Cross said.

The Maryland law, which takes effect Oct. 1, 2025, also prohibits the sale of sensitive data. That includes categories such as ethnic origin or religious beliefs.

Vermont’s privacy measure enforcement would go beyond other states to allow private lawsuits in some cases, instead of relying solely on the state attorney general. That lawsuit provision would be limited to sensitive data violations by data brokers or large data holders, and it would be repealed after two years.

A turning point in Vermont’s privacy debate came from a hearing that brought in lawmakers from other states, privacy bill sponsor state Rep. Monique Priestley (D) said. Legislators from Kentucky, Montana, and elsewhere shared similar experiences of industry pressure to limit their privacy requirements, which “reinforced that it is important for every state to try their hardest,” she said.

“A lot of fights we have in statehouses we do in bubbles, but we’re all facing the same thing,” Priestley said.

Vermont Gov. Phil Scott (R) has not said whether he will sign the measure, though he has raised concerns about the ability to sue. The Computer & Communications Industry Association is among organizations requesting a veto and said differences between the Vermont measure and other state privacy laws “will cause difficulty for businesses of all sizes.”

Priestley said she wants to help legislators elsewhere move the needle toward consumer protection. Vermont gives privacy advocates a model to point to apart from California, “which is not an example that flies in a lot of places,” Cross said. California has been at the forefront of consumer privacy with the country’s first comprehensive privacy law and a newer law making data deletion requests easier for individuals.

“Having Vermont pass a bill like this at all is going to be a huge conversation changer in other states,” Cross said.

Copycat Concerns

States following each other, though, is a concern for organizations such as the Association of National Advertisers, which opposed the Maryland and Vermont measures. Legislators often copy each other before they see the actual impact—and unintended consequences—of new laws, Chris Oswald, the group’s executive vice president for law, ethics, and government relations said in a statement.

“Each state that passes a new privacy law creates a new and potentially flawed model for other states,” he said.

A coalition of advertising groups said in veto letters that the Maryland and Vermont measures stand “in stark contrast” to the approach of other states. They called data collection limits overly restrictive.

“Data-driven advertising has benefited both consumers and businesses by reducing irrelevant ads and tailoring messages to the right audiences,” Oswald said.

Business groups also point to the complications of myriad new standards and compliance considerations as more states pass privacy laws. Maryland’s law, for instance, requires a closer look by companies at its “pretty strict, unique features,” said Sam Li, co-founder and CEO of Thoropass, which helps businesses with privacy law compliance. Companies will probably need to beef up their justifications for why they’re collecting certain data, he said.

“If we are to limit the data that we collect to only things that are related to the product or service that we offer, that—in principle—will take away a lot of data that you collect,” Li said.