State Collaboration Continues Growing as Vermont Joins Consortium of Privacy Regulators

August 4, 2026

SACRAMENTO, CA — The California Privacy Protection Agency (CalPrivacy) today announced that Vermont has become the latest state to join the Consortium of Privacy Regulators, a bipartisan effort announced last year to implement and enforce state privacy laws across the country. Collaboration with the Vermont Attorney General’s Office comes on the heels of Governor Phil Scott’s June 16 signing of the Vermont Data Privacy and Online Surveillance Act, the state’s new comprehensive privacy law.

“We welcome the opportunity to collaborate with the Green Mountain State as jurisdictions nationwide continue working together,” said Michael Macko, head of enforcement at CalPrivacy. “These partnerships benefit consumers and promote a predictable, rights-oriented enforcement landscape for businesses.”

Similar to privacy rights in California and many other states, Vermont’s privacy law grants consumers certain rights over how businesses use consumers’ personal data, including rights to delete, correct, and opt out. States nationwide continue collaborating on the implementation and enforcement of their privacy laws with the shared goal of protecting consumers across jurisdictions. With the addition of Vermont, a dozen privacy regulators have now joined this nationwide effort.

“Vermonters should not have to give up their privacy to participate in modern life,” said Attorney General Clark. “Whether we’re shopping online, using social media, or simply carrying a smartphone, companies are collecting enormous amounts of our personal information. Vermont’s new privacy law gives each of us greater control over corporate use of our data, and joining this consortium will help my office work with other states to enforce those protections effectively and hold companies accountable when they violate the law.”

“Big businesses are harnessing more and more data about us,” said Tom Kemp, CalPrivacy’s Executive Director. “Collaboration across states empowers consumers and leads to better privacy protections for everyone.”

The participating regulators established the Consortium of Privacy Regulators to share expertise and resources, as well as coordinate efforts to investigate potential violations of applicable laws. Although each state has its own law, they share fundamental features to protect privacy with rights to access, delete, and stop the sale of personal information, and similar obligations on businesses. These similarities pave the way for like–minded applications across jurisdictions and give the Consortium the ability to work together on a common goal of promoting the privacy rights of consumers. Commonalities in the laws make this collaboration possible.

The Consortium holds regular meetings and coordinates enforcement, as appropriate, based on the members’ common interests. With today’s addition, members now include the California Privacy Protection Agency and state Attorneys General from California, Colorado, Connecticut, Delaware, Indiana, New Hampshire, New Jersey, Maryland, Minnesota, Oregon, and Vermont.

CalPrivacy’s Recent Enforcement Actions to Protect Californians

CalPrivacy is actively enforcing California’s cutting-edge privacy laws. Recent actions include:

• Partnering with California Attorney General Rob Bonta and state District Attorneys to hold General Motors accountable for data sharing practices from connected vehicles, resulting in a $12.75 million civil penalty and injunctive terms. 
• Issuing a decision requiring PlayOn Sports, the provider of digital ticketing platforms for high school sporting events, to pay a $1.10 million fine and change its practices to remedy privacy violations.
• Requiring Ford Motor Company to pay a $375,703 fine and change its practices to remove unnecessary friction in the opt-out process for Californians.
• Securing a settlement requiring Datamasters, a data broker, to pay a fine and stop selling lists of Californians who have Alzheimer’s disease and other health conditions.
• Issuing a decision requiring Tractor Supply Company, the nation’s largest rural lifestyle retailer, to pay a $1.35 million fine and change its business practices for California Consumer Privacy Act (CCPA) violations.
• Issuing a decision requiring a nationwide clothing retailer, Todd Snyder, Inc., to change its business practices and pay a $345,178 fine for CCPA violations.
• Issuing a decision requiring American Honda Motor Co. to change its business practices and pay a $632,500 fine for CCPA violations.
• Securing a settlement agreement requiring data broker Background Alert — which promoted its ability to dig up “scary” amounts of information about people — to shut down or pay a steep fine.
• Bringing more than ten enforcement actions against additional unregistered data brokers.
• Launching the bipartisan Consortium of Privacy Regulators to collaborate with states across the country to implement and enforce privacy laws nationwide.
• Partnering with the data protection authorities in Korea, France, and the United Kingdom to share information and advance privacy protections for Californians.

About Us

The California Privacy Protection Agency (CalPrivacy) is committed to promoting the education and awareness of consumers’ privacy rights and businesses’ responsibilities under the California Consumer Privacy Act, Delete Act, and Opt Me Out Act.

Consumers can visit Privacy.ca.gov to access helpful and up-to-date information and tips on how to exercise their rights, protect their personal information, and learn about the Delete Request and Opt-out Platform (DROP). In addition, CalPrivacy’s website provides important information about Board Meetings, announcements, and the rulemaking process.