Vermont Age-Appropriate Design Code Act

Law & policy information

Name
Vermont Age-Appropriate Design Code Act

Jurisdiction
Vermont, United States

Instrument type
Enacted state law

Bill / legal citation
2025 Act 63 (S.69); 9 V.S.A. §§ 2449a–2449j.

Legislative or adoption status
Signed June 12, 2025; principal duties have future statutory commencement.

Effective dates
January 1, 2027, except effective-date and specified rulemaking provisions effective July 1, 2025.

Last source verification
October 27, 2026 — complete revised draft rules and current rulemaking records; enacted act reviewed October 17.

The Vermont Age-Appropriate Design Code Act is Act 63 of 2025, enacted through S.69 and signed June 12, 2025. It adds 9 V.S.A. §§ 2449a–2449j, addressing minors’ personal data, online design and algorithmic recommendation systems. Its principal requirements take effect January 1, 2027; the effective-date section and specified Attorney General rulemaking authority took effect July 1, 2025.

Scope and definitions

The definition of a covered business combines conducting business in Vermont, deriving a majority of annual revenue from online services, products reasonably likely to be accessed by minors, collecting consumers’ personal data and determining the purposes and means of processing it. Minors are under 18. A covered minor is a Vermont consumer the business actually knows is a minor or labels as a minor under Attorney General age-assurance rules. The act specifies indicators for products reasonably likely to be accessed by minors, including audience-composition tests using a two-percent threshold.

Section 2449b excludes government entities in their ordinary operations, specified health information and research, qualifying journalism entities and financial institutions subject to the cited Gramm-Leach-Bliley Act provisions. The definitions also distinguish covered digital services from telecommunications, broadband and physical products.

Data, design and recommendations

The minimum duty of care addresses reasonably foreseeable emotional distress, compulsive use and specified discrimination arising from personal-data use and product design. The act says media content viewed by a minor does not establish those harms and does not require businesses to block access to particular media.

Default privacy settings must be at the highest level. Specified protections concern account visibility, adult feedback and messaging, location, connected-user information, search indexing and push notifications. A prominent account-unpublishing or deletion tool must honor a covered minor’s request within 15 days. Transparency requirements include the purposes and inputs of recommendation systems, how inputs are measured and weighted, and how features collect, use, share and retain minors’ data.

Section 2449f restricts unnecessary collection, sale, sharing or retention of minors’ data and changes of purpose. It requires a conspicuous signal for activity or location monitoring, including parental monitoring. Personal data may select or prioritize media only within the listed exceptions, including express requests for particular feeds or categories, privacy or accessibility settings, and search queries used to answer that search. Push notifications are prohibited between midnight and 6 a.m.

Age assurance and enforcement

Age-assurance data must be limited to what is strictly necessary, deleted after the determination except for the age range, kept from other uses and combinations, and not disclosed to nonprocessor third parties. Users must have an appeal process. The Attorney General must adopt rules by January 1, 2027 on specified harmful design practices and age-assurance methods; age-assurance rulemaking must prioritize privacy and accessibility over accuracy.

Violations constitute unfair and deceptive acts in commerce under 9 V.S.A. § 2453. The act gives the Attorney General rulemaking, civil-investigation, civil-action and assurance-of-discontinuance authority. It preserves limits concerning 47 U.S.C. § 230 and minors’ deliberate searches or specific media requests.

Rulemaking record

The Attorney General’s rulemaking page records September 9, 21 and 23, 2026 public hearings and an October 2 comment deadline. The Secretary of State’s records reviewed October 27 identify 26P027 (Prohibited Data and Design Practices) and 26P028 (Age Assurance Privacy) as proposed rules, posted August 5. The linked drafts specify January 1, 2027 as their proposed effective date.

Proposed implementing rules (2026)

The Attorney General’s page now links clean and redlined revised drafts bearing October 19, 2026 filenames. The following describes those clean drafts, replacing the July 8 versions previously summarized here. Both official status postings still identify the rules as proposed when checked October 27; the drafts’ January 1, 2027 effective-date lines do not establish final adoption.

Data and design practices — 26P027

The revised § 2449f draft would assess design and processing practices against compulsive-use and meaningful impairment-of-choice standards. Increased engagement, longer sessions, autoplay, continuous scrolling, variable rewards or social features would not alone establish a violation. The Attorney General could consider testing, known effects, design and safeguards as evidence, but this provision would not independently require testing, risk assessments or documentation.

The draft addresses asymmetrical interfaces, autoplay, continuous feeds, notifications, reinforcement and social-pressure features according to those standards. Its behavioral-recommendation provision would preserve the statute’s listed exceptions for express requests, privacy or accessibility settings and search queries. Its push-notification provision expressly preserves the statutory midnight-to-6 a.m. prohibition. Modified practices would violate the anti-circumvention provision only if an operative prohibition is established; resemblance or increased engagement alone would not suffice.

Age assurance privacy — 26P028

The revised § 2449g draft would require proportionate age assurance when reasonably necessary for statutory compliance, prioritizing privacy and accessibility over marginal accuracy gains. No technology or identity-verification method would inherently be required or preferred. A business could avoid collecting additional personal data by treating a user as a covered minor where that meets its obligations. Selection would consider privacy risks, reasonably available alternatives, reliability and user burdens; materially increased privacy risk would require an explanation supported by documentation.

Personal data collected for age assurance would have to be deleted immediately after the determination, except for the age range. The draft expressly creates no additional retention exception for auditing, fraud prevention, security or compliance. Reverification and tracking would be limited to specified necessity grounds and would remain subject to the immediate-deletion requirement. Third-party processing would not remove the covered business’s responsibility.

Accessible alternatives would be required where available. Users could contest determinations materially affecting access through correction, automated reconsideration or another meaningful process; human review would be available where those options cannot reasonably resolve the dispute. Compliance documentation could not retain prohibited underlying personal data, and the absence of a particular document would not itself create a presumption of substantive violation. These remain proposed implementing provisions, distinct from the enacted statute.

Related coverage

• Vermont enacted AI-related laws
• Children and companion chatbots
• October 9 coverage of rulemaking comments
• October 9 monthly news record

References