The fluorescent lights of the Vermont House Committee hummed. Eric Null, looking remarkably human for someone speaking about digital rights, stood at the podium. He wasn’t selling snake oil. He was talking about privacy. Strong privacy. Comprehensive privacy.
And here we are. Another state, another committee, another call for privacy protections. It’s become a familiar song, hasn’t it? The Center for Democracy & Technology (CDT), through its director Eric Null, trotted out to Vermont to champion S.71. They want lawmakers to bake in privacy protections. Null, a local Vermonter no less, invoked the state’s ‘deep-rooted culture of privacy.’ Bless his heart.
Look, it’s easy to stand up and talk about values. It’s even easier for a legislature to nod along, murmur about ‘Vermonters’ best interests,’ and then… do absolutely nothing. This isn’t exactly a novel tactic. Lobbyists do it, activists do it, even corporations do it when they’re trying to look good before they inevitably sell your data to the highest bidder. The trick, the real magic trick, is getting them to pass something meaningful. Something that actually bites.
So, What’s the Big Deal with S.71?
Apparently, S.71 is supposed to be the knight in shining armor. Null’s testimony, if you bothered to read the breathless press release, was all about strong, comprehensive protections. He talked about reflecting Vermonters’ values. The usual song and dance. But what does ‘strong’ and ‘comprehensive’ actually mean when it hits the legislative sausage grinder? Because usually, what emerges is something a bit… mangled. And a lot less effective.
CDT’s Director of the Privacy & Data Project, Eric Null, delivered testimony in support of S.71, urging lawmakers to adopt strong, comprehensive privacy protections that reflect Vermonters’ longstanding values.
It’s a nice sentiment. It’s what you want to hear. But I’ve been covering this space for longer than I care to admit, and ‘longstanding values’ often get trampled by ‘business interests’ or ‘technological inevitability.’ We’ve seen this movie before, haven’t we? California does its thing, everyone else sighs, and then eventually, grudgingly, follows. Or they pass something so watered down it’s barely a puddle.
Are We Just Yelling into the Void?
Here’s the thing. Null is right to push. Someone has to. But the real test isn’t the testimony; it’s the follow-through. Is Vermont going to be another state that issues a report, holds a few hearings, and then lets the digital privacy train roll right past the station? Or will they actually craft legislation that gives consumers real control? Control over what data is collected, how it’s used, and who it’s sold to. Because right now, most of the internet runs on the assumption that your data is a free-for-all.
My own cynical take? They’ll probably pass something. But it won’t be as strong as CDT wants. It’ll be a compromise. A weak tea version of real privacy. Just enough to say they did something. Enough to check a box. And then, in a few years, we’ll be back here, doing this all over again when the next privacy crisis hits.
It’s not about the technology itself, you see. It’s about the incentives. And right now, the incentives are heavily skewed towards data collection. Until that changes, until lawmakers feel the real heat from constituents who are tired of being tracked and profiled, we’re just going to keep having the same conversations. Different state, same outcome.
The Ghost of Privacy Past
This feels eerily similar to the early days of consumer protection laws. You had advocates warning about the dangers of unchecked industrialization, of predatory practices. They were met with assurances that ‘the market will regulate itself’ or ‘this is just progress.’ Progress that often left a lot of people behind, or worse, exploited.
Privacy is the next frontier. And like so many before it, it’s going to be a messy, hard-fought battle. Kudos to Null and CDT for showing up. But Vermont, the ball’s in your court. Don’t drop it.
