Vermont’s law is a great first step, but also a very kid gloves approach. It appears their disclosure requirements are minimal, basically that the company exists and how to opt out. What I would love to see is a requirement to notify the party that their data is being sold. Yeah, that might be a pain, but they are after all selling something that arguably is not theirs. Does anyone know if other similar laws are in place for other states? Or are in the works?