Text of VT S 69 (2025)

BILL AS INTRODUCED S.69 2025 Page 1 of 23 VT LEG #380778 v.1 S.69 1 Introduced by Senators Harrison, Bongartz, Brennan, Clarkson, Collamore, 2 Cummings, Hashim, Lyons, Major, Perchlik, Plunkett, Watson, 3 Weeks and White 4 Referred to Committee on 5 Date: 6 Subject: Commerce and trade; protection of personal information; privacy of 7 minors 8 Statement of purpose of bill as introduced: This bill proposes to require that 9 any covered business that develops and provides online services, products, or 10 features that children are reasonably likely to access must not use abusive or 11 privacy-invasive design features on children. 12 An act relating to an age-appropriate design code 13 It is hereby enacted by the General Assembly of the State of Vermont: 14 Sec. 1. 9 V.S.A. chapter 62, subchapter 6 is added to read: 15 Subchapter 6. Vermont Age-Appropriate Design Code Act 16 § 2449a. DEFINITIONS 17 As used in this subchapter: 18 BILL AS INTRODUCED S.69 2025 Page 2 of 23 VT LEG #380778 v.1 (1)(A) “Affiliate” means a legal entity that shares common branding 1 with another legal entity or controls, is controlled by, or is under common 2 control with another legal entity. 3 (B) As used in subdivision (A) of this subdivision (1), “control” or 4 “controlled” means: 5 (i) ownership of, or the power to vote, more than 50 percent of the 6 outstanding shares of any class of voting security of a company; 7 (ii) control in any manner over the election of a majority of the 8 directors or of individuals exercising similar functions; or 9 (iii) the power to exercise controlling influence over the 10 management of a company. 11 (2) “Age assurance” encompasses a range of methods used to determine, 12 estimate, or communicate the age or an age range of an online user. 13 (3) “Algorithmic recommendation system” means a system that uses an 14 algorithm to select, filter, and arrange media on a covered business’s website 15 for the purpose of selecting, recommending, or prioritizing media for a user. 16 (4)(A) “Biometric data” means data generated from the technological 17 processing of an individual’s unique biological, physical, or physiological 18 characteristics that allow or confirm the unique identification of the consumer, 19 including: 20 BILL AS INTRODUCED S.69 2025 Page 3 of 23 VT LEG #380778 v.1 (i) iris or retina scans; 1 (ii) fingerprints; 2 (iii) facial or hand mapping, geometry, or templates; 3 (iv) vein patterns; 4 (v) voice prints or vocal biomarkers; and 5 (vi) gait or personally identifying physical movement or patterns. 6 (B) “Biometric data” does not include: 7 (i) a digital or physical photograph; 8 (ii) an audio or video recording; or 9 (iii) any data generated from a digital or physical photograph, or 10 an audio or video recording, unless such data is generated to identify a specific 11 individual. 12 (5) “Business associate” has the same meaning as in HIPAA. 13 (6) “Collect” means buying, renting, gathering, obtaining, receiving, or 14 accessing any personal data by any means. This includes receiving data from 15 the consumer, either actively or passively, or by observing the consumer’s 16 behavior. 17 (7) “Compulsive use” means the repetitive use of a covered business’s 18 service that materially disrupts one or more major life activities of a minor, 19 including sleeping, eating, learning, reading, concentrating, communicating, or 20 working. 21 BILL AS INTRODUCED S.69 2025 Page 4 of 23 VT LEG #380778 v.1 (8)(A) “Consumer” means an individual who is a resident of the State. 1 (B) “Consumer” does not include an individual acting in a 2 commercial or employment context or as an employee, owner, director, officer, 3 or contractor of a company, partnership, sole proprietorship, nonprofit, or 4 government agency whose communications or transactions with the covered 5 business occur solely within the context of that individual’s role with the 6 company, partnership, sole proprietorship, nonprofit, or government agency. 7 (9) “Consumer health data” means any personal data that a controller 8 uses to identify a consumer’s physical or mental health condition or diagnosis, 9 including gender-affirming health data and reproductive or sexual health data. 10 (10) “Controller” means a person who, alone or jointly with others, 11 determines the purpose and means of processing personal data. 12 (11) “Covered business” means a sole proprietorship, partnership, 13 limited liability company, corporation, association, other legal entity, or an 14 affiliate thereof, that conducts business in this State and whose online products, 15 services, or features are reasonably likely to be accessed by a minor and that: 16 (A) collects consumers’ personal data or has consumers’ personal 17 data collected on its behalf by a processor; and 18 (B) alone or jointly with others determines the purposes and means of 19 the processing of consumers personal data. 20 (12) “Covered entity” has the same meaning as in HIPAA. 21 BILL AS INTRODUCED S.69 2025 Page 5 of 23 VT LEG #380778 v.1 (13) “Covered minor” is a consumer who a covered business actually 1 knows is a minor or labels as a minor pursuant to age assurance methods in 2 rules adopted by the Attorney General. 3 (14) “Default” means a preselected option adopted by the covered 4 business for the online service, product, or feature. 5 (15) “De-identified data” means data that does not identify and cannot 6 reasonably be used to infer information about, or otherwise be linked to, an 7 identified or identifiable individual, or a device linked to the individual, if the 8 covered business that possesses the data: 9 (A)(i) takes reasonable measures to ensure that the data cannot be 10 used to reidentify an identified or identifiable individual or be associated with 11 an individual or device that identifies or is linked or reasonably linkable to an 12 individual or household; and 13 (ii) for purposes of this subdivision (A), “reasonable measures” 14 includes the de-identification requirements set forth under 45 C.F.R. § 164.514 15 (other requirements relating to uses and disclosures of protected health 16 information); 17 (B) publicly commits to process the data only in a de-identified 18 fashion and not attempt to reidentify the data; and 19 (C) contractually obligates any recipients of the data to comply with 20 all provisions of this subchapter. 21 BILL AS INTRODUCED S.69 2025 Page 6 of 23 VT LEG #380778 v.1 (16) “Derived data” means data that is created by the derivation of 1 information, data, assumptions, correlations, inferences, predictions, or 2 conclusions from facts, evidence, or another source of information or data 3 about a minor or a minor’s device. 4 (17) “Genetic data” means any data, regardless of its format, that results 5 from the analysis of a biological sample of an individual, or from another 6 source enabling equivalent information to be obtained, and concerns genetic 7 material, including deoxyribonucleic acids (DNA), ribonucleic acids (RNA), 8 genes, chromosomes, alleles, genomes, alterations or modifications to DNA or 9 RNA, single nucleotide polymorphisms (SNPs), epigenetic markers, 10 uninterpreted data that results from analysis of the biological sample or other 11 source, and any information extrapolated, derived, or inferred therefrom. 12 (18) “Identified or identifiable individual” means an individual who can 13 be readily identified, directly or indirectly, including by reference to an 14 identifier such as a name, an identification number, specific geolocation data, 15 or an online identifier. 16 (19) “Known adult” is a consumer who a covered business actually 17 knows is an adult or labels as an adult pursuant to age assurance methods in 18 rules adopted by the Attorney General. 19 (20) “Minor” means an individual under 18 years of age who is a 20 resident of the State. 21 BILL AS INTRODUCED S.69 2025 Page 7 of 23 VT LEG #380778 v.1 (21) “Neural data” means information that is collected through 1 biosensors and that could be processed to infer or predict mental states. 2 (22) “Online service, product, or feature” means a digital product that is 3 accessible to the public via the internet, including a website or application, and 4 does not mean any of the following: 5 (A) telecommunications service, as defined in 47 U.S.C. § 153; 6 (B) a broadband internet access service as defined in 47 C.F.R. 7 § 54.400; or 8 (C) the sale, delivery, or use of a physical product. 9 (23)(A) “Personal data” means any information, including derived data 10 and unique identifiers, that is linked or reasonably linkable to an identified or 11 identifiable individual or to a device that identifies, is linked to, or is 12 reasonably linkable to one or more identified or identifiable individuals in a 13 household. 14 (B) Personal data does not include de-identified data or publicly 15 available information. 16 (24)(A) “Precise geolocation data” means information derived from 17 technology that reveals the past or present physical location of a consumer or 18 device that identifies or is linked or reasonably linkable to one or more 19 consumers with precision and accuracy within a radius of 1,850 feet. 20 (B) “Precise geolocation data” does not include: 21 BILL AS INTRODUCED S.69 2025 Page 8 of 23 VT LEG #380778 v.1 (i) the content of communications; 1 (ii) data generated by or connected to an advanced utility metering 2 infrastructure system; 3 (iii) a photograph, or metadata associated with a photograph or 4 video, that cannot be linked to an individual; or 5 (iv) data generated by equipment used by a utility company. 6 (25) “Process” or “processing” means any operation or set of operations 7 performed, whether by manual or automated means, on personal data or on sets 8 of personal data, such as the collection, use, storage, disclosure, analysis, 9 deletion, modification, or otherwise handling of personal data. 10 (26) “Processor” means a person who processes personal data on behalf 11 of a covered business. 12 (27) “Profiling” means any form of automated processing performed on 13 personal data to evaluate, analyze, or predict personal aspects related to an 14 identified or identifiable individual’s economic situation, health, personal 15 preferences, interests, reliability, behavior, location, or movements. 16 (28)(A) “Publicly available information” means information that: 17 (i) is made available through federal, state, or local government 18 records; or 19 (ii) a controller has a reasonable basis to believe that the consumer 20 has lawfully made available to the general public. 21 BILL AS INTRODUCED S.69 2025 Page 9 of 23 VT LEG #380778 v.1 (B) “Publicly available information” does not include: 1 (i) biometric data collected by a business about a consumer 2 without the consumer’s knowledge; 3 (ii) information that is collated and combined to create a consumer 4 profile that is made available to a user of a publicly available website either in 5 exchange for payment or free of charge; 6 (iii) information that is made available for sale; 7 (iv) an inference that is generated from the information described 8 in subdivision (ii) or (iii) of this subdivision (28)(B); 9 (v) any obscene visual depiction, as defined in 18 U.S.C. § 1460; 10 (vi) any inference made exclusively from multiple independent 11 sources of publicly available information that reveals sensitive data with 12 respect to a consumer; 13 (vii) personal data that is created through the combination of 14 personal data with publicly available information; 15 (viii) genetic data, unless otherwise made publicly available by the 16 consumer to whom the information pertains; 17 (ix) information provided by a consumer on a website or online 18 service made available to all members of the public, for free or for a fee, where 19 the consumer has maintained a reasonable expectation of privacy in the 20 information, such as by restricting the information to a specific audience; or 21 BILL AS INTRODUCED S.69 2025 Page 10 of 23 VT LEG #380778 v.1 (x) intimate images, authentic or computer-generated, known to be 1 nonconsensual. 2 (29) “Reasonably likely to be accessed” means an online service, 3 product, or feature that is reasonably likely to be accessed by a covered minor 4 based on any of the following indicators: 5 (A) the online service, product, or feature is directed to children, as 6 defined by the Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501– 7 6506 and the Federal Trade Commission rules implementing that Act; 8 (B) the online service, product, or feature is determined, based on 9 competent and reliable evidence regarding audience composition, to be 10 routinely accessed by an audience that is composed of at least two percent 11 minors two through 17 years of age; 12 (C) the online service, product, or feature contains advertisements 13 marketed to minors; 14 (D) the audience of the online service, product, or feature is 15 determined, based on internal company research, to be composed of at least 16 two percent minors two through 17 years of age; or 17 (E) the covered business knew or should have known that at least two 18 percent of the audience of the online service, product, or feature includes 19 minors two through 17 years of age, provided that, in making this assessment, 20 the business shall not collect or process any personal data that is not reasonably 21 BILL AS INTRODUCED S.69 2025 Page 11 of 23 VT LEG #380778 v.1 necessary to provide an online service, product, or feature with which a minor 1 is actively and knowingly engaged. 2 (30) “Sensitive data” means personal data that: 3 (A) reveals a consumer’s government-issued identifier, such as a 4 Social Security number, passport number, state identification card, or driver’s 5 license number, that is not required by law to be publicly displayed; 6 (B) reveals a consumer’s racial or ethnic origin; national origin; 7 citizenship or immigration status; religious or philosophical beliefs; a mental 8 or physical health condition, diagnosis, disability, or treatment; status as 9 pregnant; income level or indebtedness; or union membership; 10 (C) reveals a consumer’s sexual orientation, sex life, sexuality, or 11 status as transgender or non-binary; 12 (D) reveals a consumer’s status as a victim of a crime; 13 (E) is a consumer’s tax return and account number, financial account 14 log-in, financial account, debit card number, or credit card number in 15 combination with any required security or access code, password, or 16 credentials allowing access to an account; 17 (F) is consumer health data; 18 (G) is collected and analyzed concerning consumer health data that 19 describes or reveals a past, present, or future mental or physical health 20 condition, treatment, disability, or diagnosis, including pregnancy, to the extent 21 BILL AS INTRODUCED S.69 2025 Page 12 of 23 VT LEG #380778 v.1 the personal data is used by the controller for a purpose other than to identify a 1 specific consumer’s physical or mental health condition or diagnosis; 2 (H) is biometric or genetic data; 3 (I) is collected from a covered minor; 4 (J) is precise geolocation data; 5 (K) are keystrokes; 6 (L) is driving behavior; or 7 (M) is neural data. 8 (31)(A) “Social media platform” means a public or semipublic internet- 9 based service or application that is primarily intended to connect and allow a 10 user to socially interact within such service or application and enables a user 11 to: 12 (i) construct a public or semipublic profile for the purposes of 13 signing into and using such service or application; 14 (ii) populate a public list of other users with whom the user shares 15 a social connection within such service or application; or 16 (iii) create or post content that is viewable by other users, 17 including content on message boards and in chat rooms, and that presents the 18 user with content generated by other users. 19 (B) “Social media platform” does not mean a public or semipublic 20 internet-based service or application that: 21 BILL AS INTRODUCED S.69 2025 Page 13 of 23 VT LEG #380778 v.1 (i) exclusively provides email or direct messaging services; 1 (ii) primarily consists of news, sports, entertainment, interactive 2 video games, electronic commerce, or content that is preselected by the 3 provider for which any interactive functionality is incidental to, directly related 4 to, or dependent on the provision of such content; or 5 (iii) is used by and under the direction of an educational entity, 6 including a learning management system or a student engagement program. 7 (32) “Third party” means a natural or legal person, public authority, 8 agency, or body other than the covered minor or the covered business. 9 § 2449b. EXCLUSIONS 10 This subchapter does not apply to: 11 (1) a federal, state, tribal, or local government entity in the ordinary 12 course of its operation; 13 (2) protected health information that a covered entity or business 14 associate processes in accordance with, or documents that a covered entity or 15 business associate creates for the purpose of complying with, HIPAA; 16 (3) information used only for public health activities and purposes 17 described in 45 C.F.R. § 164.512; 18 (4) information that identifies a consumer in connection with: 19 (A) activities that are subject to the Federal Policy for the Protection 20 of Human Subjects as set forth in 45 C.F.R. Part 46; 21 BILL AS INTRODUCED S.69 2025 Page 14 of 23 VT LEG #380778 v.1 (B) research on human subjects undertaken in accordance with good 1 clinical practice guidelines issued by the International Council for 2 Harmonisation of Technical Requirements for Pharmaceuticals for Human 3 Use; 4 (C) activities that are subject to the protections provided in 21 C.F.R. 5 Part 50 and 21 C.F.R. Part 56; or 6 (D) research conducted in accordance with the requirements set forth 7 in subdivisions (A)–(C) of this subdivision (4) or otherwise in accordance with 8 State or federal law; and 9 (5) an entity whose primary purpose is journalism as defined in 10 12 V.S.A. § 1615(a)(2) and that has a majority of its workforce consisting of 11 individuals engaging in journalism. 12 § 2449c. MINIMUM DUTY OF CARE 13 (a) A covered business that processes a covered minor’s data in any 14 capacity owes a minimum duty of care to the covered minor. 15 (b) As used in this subchapter, “a minimum duty of care” means the use of 16 the personal data of a covered minor and the design of an online service, 17 product, or feature will not result in: 18 (1) reasonably foreseeable emotional distress as defined in 13 V.S.A. 19 § 1061(2) to a covered minor; 20 BILL AS INTRODUCED S.69 2025 Page 15 of 23 VT LEG #380778 v.1 (2) reasonably foreseeable compulsive use of the online service, 1 product, or feature by a covered minor; or 2 (3) discrimination against a covered minor based upon race, ethnicity, 3 sex, disability, sexual orientation, gender identity, gender expression, or 4 national origin. 5 (c) The content of the media viewed by a covered minor shall not establish 6 emotional distress or compulsive use as those terms are used in subsection (b) 7 of this section. 8 (d) Nothing in this section shall be construed to require a covered business 9 to prevent or preclude a covered minor from accessing or viewing any piece of 10 media or category of media. 11 § 2449d. REQUIRED DEFAULT PRIVACY SETTINGS AND TOOLS 12 (a) Default privacy settings. 13 (1) A covered business shall configure all default privacy settings 14 provided to a covered minor through the online service, product, or feature to 15 the highest level of privacy, including the following default settings: 16 (A) not displaying the existence of the covered minor’s social media 17 account to any known adult user unless the covered minor has expressly and 18 unambiguously allowed a specific known adult user to view their account or 19 has expressly and unambiguously chosen to make their account’s existence 20 public; 21 BILL AS INTRODUCED S.69 2025 Page 16 of 23 VT LEG #380778 v.1 (B) not displaying media created or posted by the covered minor on 1 a social media platform to any known adult user unless the covered minor has 2 expressly and unambiguously allowed a specific known adult user to view their 3 media or has expressly and unambiguously chosen to make their media 4 publicly available; 5 (C) not permitting any known adult users to like, comment on, or 6 otherwise provide feedback on the covered minor’s media on a social media 7 platform unless the covered minor has expressly and unambiguously allowed a 8 specific known adult user to do so; 9 (D) not permitting direct messaging on a social media platform 10 between the covered minor and any known adult user unless the covered minor 11 has expressly and unambiguously decided to allow direct messaging with a 12 specific known adult user; 13 (E) not displaying the covered minor’s location to other users, unless 14 the covered minor expressly and unambiguously shares their location with a 15 specific user; 16 (F) not displaying the users connected to the covered minor on a 17 social media platform unless the covered minor expressly and unambiguously 18 chooses to share the information with a specific user; 19 (G) disabling search engine indexing of the covered minor’s account 20 profile; and 21 BILL AS INTRODUCED S.69 2025 Page 17 of 23 VT LEG #380778 v.1 (H) not sending push notifications to the covered minors. 1 (2) A covered business shall not: 2 (A) provide a covered minor with a single setting that makes all of 3 the default privacy settings less protective at once; or 4 (B) request or prompt a covered minor to make their privacy settings 5 less protective, unless the change is strictly necessary for the covered minor to 6 access a service or feature they have expressly and unambiguously requested. 7 (b) Timely deletion of account. A covered business shall: 8 (1) provide a prominent, accessible, and responsive tool to allow a 9 covered minor to request the covered minor’s social media account be 10 unpublished or deleted; and 11 (2) honor that request not later than 15 days after a covered business 12 receives the request. 13 § 2449e. TRANSPARENCY 14 (a) A covered business shall prominently and clearly provide on their 15 website or mobile application: 16 (1) the covered business’ privacy information, terms of service, policies, 17 and community standards; 18 (2) detailed descriptions of each algorithmic recommendation system in 19 use by the covered business, including the factors used by the algorithmic 20 recommendation system and how each factor: 21 BILL AS INTRODUCED S.69 2025 Page 18 of 23 VT LEG #380778 v.1 (A) is measured or determined; 1 (B) uses the personal data of covered minors; 2 (C) influences the recommendation issued by the system; and 3 (D) is weighed relative to the other factors listed in this subdivision 4 (2); and 5 (3) descriptions, for every feature of the service that uses the personal 6 data of covered minors, of: 7 (A) the purpose of the service feature; 8 (B) the personal data collected by the service feature; 9 (C) the personal data used by the service feature; 10 (D) how the personal data is used by the service feature; 11 (E) any personal data transferred to or shared with a processor or 12 third party by the service feature, the identity of the processor or third party, 13 and the purpose of the transfer or sharing; and 14 (F) how long the personal data is retained. 15 § 2449f. PROHIBITED DATA AND DESIGN PRACTICES 16 (a) Data privacy. A covered business shall not: 17 (1) collect, sell, share, or retain any personal data of a covered minor 18 that is not necessary to provide an online service, product, or feature with 19 which the covered minor is actively and knowingly engaged; 20 BILL AS INTRODUCED S.69 2025 Page 19 of 23 VT LEG #380778 v.1 (2) use previously collected personal data of a covered minor for any 1 purpose other than a purpose for which the personal data was collected, unless 2 necessary to comply with any obligation under this chapter; 3 (3) permit any consumer, including a parent or guardian of a covered 4 minor, to monitor the online activity of a covered minor or to track the location 5 of the covered minor without providing a conspicuous signal to the covered 6 minor when the covered minor is being monitored or tracked; 7 (4) use the personal data of a covered minor to select, recommend, or 8 prioritize media for the covered minor, unless the personal data is: 9 (A) the covered minor’s express and unambiguous request to receive: 10 (i) media from a specific account, feed, or user, or to receive more 11 or less media from that account, feed, or user; 12 (ii) a specific category of media, such as “cat videos” or “breaking 13 news,” or to see more or less of that category of media; or 14 (iii) more or less media with similar characteristics as the media 15 they are currently viewing; 16 (B) user-selected privacy or accessibility settings; or 17 (C) a search query, provided the search query is only used to select 18 and prioritize media in response to the search; or 19 (5) send push notifications to a covered minor between 12:00 midnight 20 and 6:00 a.m. 21 BILL AS INTRODUCED S.69 2025 Page 20 of 23 VT LEG #380778 v.1 (b) Rulemaking. The Attorney General shall have the authority to adopt 1 rules pursuant to this subchapter that prohibits data processing or design 2 practices of a covered business that, in the opinion of the Attorney General, 3 lead to compulsive use or subvert or impair user autonomy, decision making, 4 or choice during the use of an online service, product, or feature of the covered 5 business. The Attorney General shall, at least once every two years, review 6 and update these rules as necessary to keep pace with emerging technology. 7 § 2449g. AGE ASSURANCE PRIVACY 8 (a) Privacy protections for age assurance data. Covered businesses and 9 processors shall: 10 (1) only collect personal data of a user that is strictly necessary for age 11 assurance; 12 (2) immediately upon determining whether a user is a covered minor, 13 delete any personal data collected of that user for age assurance, except 14 whether the user is or is not determined to be a covered minor; 15 (3) not use any personal data of a user collected for age assurance for 16 any other purpose; 17 (4) not combine personal data of a user collected for age assurance with 18 any other personal data of the user, except whether the user is or is not 19 determined to be a covered minor; and 20 BILL AS INTRODUCED S.69 2025 Page 21 of 23 VT LEG #380778 v.1 (5) implement a review process to allow users to appeal their age 1 designation. 2 (b) Rulemaking. 3 (1) Subject to subdivision (2) of this subsection, the Attorney General 4 shall, on or before July 1, 2027, adopt rules identifying commercially 5 reasonable and technically feasible methods for covered businesses and 6 processors to determine if a user is a covered minor, describing appropriate 7 review processes for users appealing their age designations, and providing any 8 additional privacy protections for age assurance data. The Attorney General 9 shall periodically review and update these rules as necessary to keep pace with 10 emerging technology. 11 (2) In adopting these rules, the Attorney General shall: 12 (A) prioritize user privacy and accessibility over the accuracy of age 13 assurance methods; and 14 (B) consider: 15 (i) the size, financial resources, and technical capabilities of 16 covered businesses and processors; 17 (ii) the costs and effectiveness of available age assurance methods; 18 (iii) the impact of age assurance methods on users’ safety, utility, 19 and experience; 20 BILL AS INTRODUCED S.69 2025 Page 22 of 23 VT LEG #380778 v.1 (iv) whether and to what extent transparency measures would 1 increase consumer trust in an age assurance method; and 2 (v) the efficacy of requiring covered businesses and processors to: 3 (I) use previously collected data to determine user age; 4 (II) adopt interoperable age assurance methods; and 5 (III) provide users with multiple options for age assurance. 6 § 2449h. ENFORCEMENT 7 (a) A covered business or processor that violates this subchapter or rules 8 adopted pursuant to this subchapter commits an unfair and deceptive act in 9 commerce in violation of section 2453 of this title. 10 (b) The Attorney General shall have the same authority under this 11 subchapter to make rules, conduct civil investigations, bring civil actions, 12 and enter into assurances of discontinuance as provided under chapter 63 of 13 this title. 14 § 2449i. LIMITATIONS 15 Nothing in this subchapter shall be interpreted or construed to: 16 (1) impose liability in a manner that is inconsistent with 47 U.S.C. 17 § 230; or 18 (2) prevent or preclude any covered minor from deliberately or 19 independently searching for, or specifically requesting, any media. 20 BILL AS INTRODUCED S.69 2025 Page 23 of 23 VT LEG #380778 v.1 § 2449j. RIGHTS AND FREEDOMS OF COVERED MINORS 1 It is the intent of the General Assembly that nothing in this subchapter may 2 be construed to infringe on the existing rights and freedoms of covered minors 3 or be construed to discriminate against the covered minors based on race, 4 ethnicity, sex, disability, sexual orientation, gender identity, gender expression, 5 or national origin. 6 Sec. 2. EFFECTIVE DATE 7 This act shall take effect on July 1, 2026. 8

No. 63 Page 1 of 20 2025 VT LEG #384287 v.1 No. 63. An act relating to an age-appropriate design code. (S.69) It is hereby enacted by the General Assembly of the State of Vermont: Sec. 1. 9 V.S.A. chapter 62, subchapter 6 is added to read: Subchapter 6. Vermont Age-Appropriate Design Code Act § 2449a. DEFINITIONS As used in this subchapter: (1)(A) “Affiliate” means a legal entity that shares common branding with another legal entity or controls, is controlled by, or is under common control with another legal entity. (B) As used in subdivision (A) of this subdivision (1), “control” or “controlled” means: (i) ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a company; (ii) control in any manner over the election of a majority of the directors or of individuals exercising similar functions; or (iii) the power to exercise controlling influence over the management of a company. (2) “Age assurance” encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user. (3) “Age range” means either an interval with an upper and lower age limit or a label indicating age above or below a specific age. No. 63 Page 2 of 20 2025 VT LEG #384287 v.1 (4) “Algorithmic recommendation system” means a system that uses an algorithm to select, filter, and arrange media on a covered business’s website for the purpose of selecting, recommending, or prioritizing media for a user. (5)(A) “Biometric data” means data generated from the technological processing of an individual’s unique biological, physical, or physiological characteristics that allow or confirm the unique identification of the consumer, including: (i) iris or retina scans; (ii) fingerprints; (iii) facial or hand mapping, geometry, or templates; (iv) vein patterns; (v) voice prints or vocal biomarkers; and (vi) gait or personally identifying physical movement or patterns. (B) “Biometric data” does not include: (i) a digital or physical photograph; (ii) an audio or video recording; or (iii) any data generated from a digital or physical photograph, or an audio or video recording, unless such data is generated to identify a specific individual. (6) “Business associate” has the same meaning as in the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191 (HIPAA). No. 63 Page 3 of 20 2025 VT LEG #384287 v.1 (7) “Collect” means buying, renting, gathering, obtaining, receiving, or accessing any personal data by any means. This includes receiving data from the consumer, either actively or passively, or by observing the consumer’s behavior. (8) “Compulsive use” means the repetitive use of a covered business’s service that materially disrupts one or more major life activities of a minor, including sleeping, eating, learning, reading, concentrating, communicating, or working. (9)(A) “Consumer” means an individual who is a resident of the State. (B) “Consumer” does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency whose communications or transactions with the covered business occur solely within the context of that individual’s role with the company, partnership, sole proprietorship, nonprofit, or government agency. (10) “Covered business” means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (A) that conducts business in this State; (B) that generates a majority of its annual revenue from online services; No. 63 Page 4 of 20 2025 VT LEG #384287 v.1 (C) whose online products, services, or features are reasonably likely to be accessed by a minor; (D) that collects consumers’ personal data or has consumers’ personal data collected on its behalf by a processor; and (E) that alone or jointly with others determines the purposes and means of the processing of consumers personal data. (11) “Covered entity” has the same meaning as in HIPAA. (12) “Covered minor” is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the Attorney General. (13) “Default” means a preselected option adopted by the covered business for the online service, product, or feature. (14) “De-identified data” means data that does not identify and cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to the individual, if the covered business that possesses the data: (A)(i) takes reasonable measures to ensure that the data cannot be used to reidentify an identified or identifiable individual or be associated with an individual or device that identifies or is linked or reasonably linkable to an individual or household; and (ii) for purposes of this subdivision (A), “reasonable measures” includes the de-identification requirements set forth under 45 C.F.R. § 164.514 No. 63 Page 5 of 20 2025 VT LEG #384287 v.1 (other requirements relating to uses and disclosures of protected health information); (B) publicly commits to process the data only in a de-identified fashion and not attempt to reidentify the data; and (C) contractually obligates any recipients of the data to comply with all provisions of this subchapter. (15) “Derived data” means data that is created by the derivation of information, data, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or another source of information or data about a minor or a minor’s device. (16) “Genetic data” means any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material, including deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), epigenetic markers, uninterpreted data that results from analysis of the biological sample or other source, and any information extrapolated, derived, or inferred therefrom. (17) “Identified or identifiable individual” means an individual who can be readily identified, directly or indirectly, including by reference to an identifier such as a name, an identification number, specific geolocation data, or an online identifier. No. 63 Page 6 of 20 2025 VT LEG #384287 v.1 (18) “Known adult” is a consumer who a covered business actually knows is an adult or labels as an adult pursuant to age assurance methods in rules adopted by the Attorney General. (19) “Minor” means an individual under 18 years of age. (20) “Online service, product, or feature” means a digital product that is accessible to the public via the internet, including a website or application, and does not mean any of the following: (A) telecommunications service, as defined in 47 U.S.C. § 153; (B) a broadband internet access service as defined in 47 C.F.R. § 54.400; or (C) the sale, delivery, or use of a physical product. (21)(A) “Personal data” means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household. (B) Personal data does not include de-identified data or publicly available information. (22) “Process” or “processing” means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, modification, or otherwise handling of personal data. No. 63 Page 7 of 20 2025 VT LEG #384287 v.1 (23) “Processor” means a person who processes personal data on behalf of: (A) a covered business; (B) another processor; or (C) a federal, state, tribal, or local government entity. (24) “Profiling” means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects, including an individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, movements, or identifying characteristics. (25)(A) “Publicly available information” means information that: (i) is made available through federal, state, or local government records or to the general public from widely distributed media; or (ii) a covered business has a reasonable basis to believe that the consumer has lawfully made available to the general public. (B) “Publicly available information” does not include: (i) biometric data collected by a business about a consumer without the consumer’s knowledge; (ii) information that is collated and combined to create a consumer profile that is made available to a user of a publicly available website either in exchange for payment or free of charge; No. 63 Page 8 of 20 2025 VT LEG #384287 v.1 (iii) information that is made available for sale; (iv) an inference that is generated from the information described in subdivision (ii) or (iii) of this subdivision (25)(B); (v) any obscene visual depiction, as defined in 18 U.S.C. § 1460; (vi) personal data that is created through the combination of personal data with publicly available information; (vii) genetic data, unless otherwise made publicly available by the consumer to whom the information pertains; (viii) information provided by a consumer on a website or online service made available to all members of the public, for free or for a fee, where the consumer has maintained a reasonable expectation of privacy in the information, such as by restricting the information to a specific audience; or (ix) intimate images, authentic or computer-generated, known to be nonconsensual. (26) “Reasonably likely to be accessed” means an online service, product, or feature that is reasonably likely to be accessed by a covered minor based on any of the following indicators: (A) the online service, product, or feature is directed to children, as defined by the Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501– 6506 and the Federal Trade Commission rules implementing that Act; (B) the online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be No. 63 Page 9 of 20 2025 VT LEG #384287 v.1 routinely accessed by an audience that is composed of at least two percent minors two through 17 years of age; (C) the audience of the online service, product, or feature is determined, based on internal company research, to be composed of at least two percent minors two through 17 years of age; or (D) the covered business knew or should have known that at least two percent of the audience of the online service, product, or feature includes minors two through 17 years of age, provided that, in making this assessment, the business shall not collect or process any personal data that is not reasonably necessary to provide an online service, product, or feature with which a minor is actively and knowingly engaged. (27)(A) “Social media platform” means a public or semipublic internet- based service or application that is primarily intended to connect and allow a user to socially interact within such service or application and enables a user to: (i) construct a public or semipublic profile for the purposes of signing into and using such service or application; (ii) populate a public list of other users with whom the user shares a social connection within such service or application; or (iii) create or post content that is viewable by other users, including content on message boards and in chat rooms, and that presents the user with content generated by other users. No. 63 Page 10 of 20 2025 VT LEG #384287 v.1 (B) “Social media platform” does not mean a public or semipublic internet-based service or application that: (i) exclusively provides email or direct messaging services; or (ii) is used by and under the direction of an educational entity, including a learning management system or a student engagement program. (28) “Third party” means a natural or legal person, public authority, agency, or body other than the covered minor or the covered business. § 2449b. EXCLUSIONS This subchapter does not apply to: (1) a federal, state, tribal, or local government entity in the ordinary course of its operation; (2) protected health information that a covered entity or business associate processes in accordance with, or documents that a covered entity or business associate creates for the purpose of complying with, HIPAA; (3) information used only for public health activities and purposes described in 45 C.F.R. § 164.512; (4) information that identifies a consumer in connection with: (A) activities that are subject to the Federal Policy for the Protection of Human Subjects as set forth in 45 C.F.R. Part 46; (B) research on human subjects undertaken in accordance with good clinical practice guidelines issued by the International Council for No. 63 Page 11 of 20 2025 VT LEG #384287 v.1 Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; (C) activities that are subject to the protections provided in 21 C.F.R. Part 50 and 21 C.F.R. Part 56; or (D) research conducted in accordance with the requirements set forth in subdivisions (A)–(C) of this subdivision (4) or otherwise in accordance with State or federal law; (5) an entity whose primary purpose is journalism as defined in 12 V.S.A. § 1615(a)(2) and that has a majority of its workforce consisting of individuals engaging in journalism; and (6) a financial institution subject to Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, and regulations adopted to implement that act. § 2449c. MINIMUM DUTY OF CARE (a) A covered business that processes a covered minor’s data in any capacity owes a minimum duty of care to the covered minor. (b) As used in this subchapter, “a minimum duty of care” means the use of the personal data of a covered minor and the design of an online service, product, or feature will not result in: (1) reasonably foreseeable emotional distress as defined in 13 V.S.A. § 1061(2) to a covered minor; (2) reasonably foreseeable compulsive use of the online service, product, or feature by a covered minor; or No. 63 Page 12 of 20 2025 VT LEG #384287 v.1 (3) discrimination against a covered minor based upon race, ethnicity, sex, disability, sexual orientation, gender identity, gender expression, religion, or national origin. (c) The content of the media viewed by a covered minor shall not establish emotional distress, compulsive use, or discrimination, as those terms are used in subsection (b) of this section. (d) Nothing in this section shall be construed to require a covered business to prevent or preclude a covered minor from accessing or viewing any piece of media or category of media. § 2449d. REQUIRED DEFAULT PRIVACY SETTINGS AND TOOLS (a) Default privacy settings. (1) A covered business shall configure all default privacy settings provided to a covered minor through the online service, product, or feature to the highest level of privacy, including the following default settings: (A) not displaying the existence of the covered minor’s account on a social media platform to any known adult user unless the covered minor has expressly and unambiguously allowed a specific known adult user to view their account or has expressly and unambiguously chosen to make their account’s existence public; (B) not displaying media created or posted by the covered minor on a social media platform to any known adult user unless the covered minor has expressly and unambiguously allowed a specific known adult user to view their No. 63 Page 13 of 20 2025 VT LEG #384287 v.1 media or has expressly and unambiguously chosen to make their media publicly available; (C) not permitting any known adult users to like, comment on, or otherwise provide feedback on the covered minor’s media on a social media platform unless the covered minor has expressly and unambiguously allowed a specific known adult user to do so; (D) not permitting direct messaging on a social media platform between the covered minor and any known adult user unless the covered minor has expressly and unambiguously decided to allow direct messaging with a specific known adult user; (E) not displaying the covered minor’s location to other users, unless the covered minor expressly and unambiguously shares their location with a specific user; (F) not displaying the users connected to the covered minor on a social media platform unless the covered minor expressly and unambiguously chooses to share the information with a specific user; (G) disabling search engine indexing of the covered minor’s account profile; and (H) not sending push notifications to the covered minors. (2) A covered business shall not: (A) provide a covered minor with a single setting that makes all of the default privacy settings less protective at once; or No. 63 Page 14 of 20 2025 VT LEG #384287 v.1 (B) request or prompt a covered minor to make their privacy settings less protective, unless the change is strictly necessary for the covered minor to access a service or feature they have expressly and unambiguously requested. (b) Timely deletion of account. A covered business shall: (1) provide a prominent, accessible, and responsive tool to allow a covered minor to request the covered minor’s account on a social media platform be unpublished or deleted; and (2) honor that request not later than 15 days after a covered business receives the request. § 2449e. TRANSPARENCY A covered business shall prominently and clearly provide on their website or mobile application: (1) the covered business’ privacy information, terms of service, policies, and community standards; (2) the purpose of each algorithmic recommendation system in use by the covered business; (3) inputs used by the algorithmic recommendation system and how each input: (A) is measured or determined; (B) uses the personal data of covered minors; No. 63 Page 15 of 20 2025 VT LEG #384287 v.1 (C) influences the recommendation issued by the system; and (D) is weighed relative to the other inputs reported in this subdivision (3); and (4) descriptions, for every feature of the service that uses the personal data of covered minors, of: (A) the purpose of the service feature; (B) the personal data collected by the service feature; (C) the personal data used by the service feature; (D) how the personal data is used by the service feature; (E) any personal data transferred to or shared with a processor or third party by the service feature, the identity of the processor or third party, and the purpose of the transfer or sharing; and (F) how long the personal data is retained. § 2449f. PROHIBITED DATA AND DESIGN PRACTICES (a) Data privacy. A covered business shall not: (1) collect, sell, share, or retain any personal data of a covered minor that is not necessary to provide an online service, product, or feature with which the covered minor is actively and knowingly engaged; (2) use previously collected personal data of a covered minor for any purpose other than a purpose for which the personal data was collected, unless necessary to comply with any obligation under this chapter; No. 63 Page 16 of 20 2025 VT LEG #384287 v.1 (3) permit any individual, including a parent or guardian of a covered minor, to monitor the online activity of a covered minor or to track the location of the covered minor without providing a conspicuous signal to the covered minor when the covered minor is being monitored or tracked; (4) use the personal data of a covered minor to select, recommend, or prioritize media for the covered minor, unless the personal data is: (A) the covered minor’s express and unambiguous request to receive: (i) media from a specific account, feed, or user, or to receive more or less media from that account, feed, or user; (ii) a specific category of media, such as “cat videos” or “breaking news,” or to see more or less of that category of media; or (iii) more or less media with similar characteristics as the media they are currently viewing; (B) user-selected privacy or accessibility settings; or (C) a search query, provided the search query is only used to select and prioritize media in response to the search; or (5) send push notifications to a covered minor between 12:00 midnight and 6:00 a.m. (b) Rulemaking. The Attorney General shall, on or before January 1, 2027, adopt rules pursuant to this subchapter that prohibits data processing or design practices of a covered business that, in the opinion of the Attorney General, lead to compulsive use or subvert or impair user autonomy, decision making, No. 63 Page 17 of 20 2025 VT LEG #384287 v.1 or choice during the use of an online service, product, or feature of the covered business. The Attorney General shall, at least once every two years, review and update these rules as necessary to keep pace with emerging technology. § 2449g. AGE ASSURANCE PRIVACY (a) Privacy protections for age assurance data. During the process of conducting age assurance, covered businesses and processors shall: (1) only collect personal data of a user that is strictly necessary for age assurance; (2) immediately upon determining whether a user is a covered minor, delete any personal data collected of that user for age assurance, except the determination of the user’s age range; (3) not use any personal data of a user collected for age assurance for any other purpose; (4) not combine personal data of a user collected for age assurance, except the determination of the user’s age range, with any other personal data of the user; (5) not disclose personal data of a user collected for age assurance to a third party that is not a processor; and (6) implement a review process to allow users to appeal their age determination. No. 63 Page 18 of 20 2025 VT LEG #384287 v.1 (b) Rulemaking. (1) Subject to subdivision (2) of this subsection, the Attorney General shall, on or before January 1, 2027, adopt rules identifying commercially reasonable and technically feasible methods for covered businesses and processors to determine if a user is a covered minor, describing appropriate review processes for users appealing their age designations, and providing any additional privacy protections for age assurance data. The Attorney General shall periodically review and update these rules as necessary to keep pace with emerging technology. (2) In adopting these rules, the Attorney General shall: (A) prioritize user privacy and accessibility over the accuracy of age assurance methods; and (B) consider: (i) the size, financial resources, and technical capabilities of covered businesses and processors; (ii) the costs and effectiveness of available age assurance methods; (iii) the impact of age assurance methods on users’ safety, utility, and experience; (iv) whether and to what extent transparency measures would increase consumer trust in an age assurance method; and (v) the efficacy of requiring covered businesses and processors to: No. 63 Page 19 of 20 2025 VT LEG #384287 v.1 (I) use previously collected data to determine user age; (II) adopt interoperable age assurance methods; and (III) provide users with multiple options for age assurance. § 2449h. ENFORCEMENT (a) A covered business or processor that violates this subchapter or rules adopted pursuant to this subchapter commits an unfair and deceptive act in commerce in violation of section 2453 of this title. (b) The Attorney General shall have the same authority under this subchapter to make rules, conduct civil investigations, bring civil actions, and enter into assurances of discontinuance as provided under chapter 63 of this title. § 2449i. LIMITATIONS Nothing in this subchapter shall be interpreted or construed to: (1) impose liability in a manner that is inconsistent with 47 U.S.C. § 230; or (2) prevent or preclude any covered minor from deliberately or independently searching for, or specifically requesting, any media. § 2449j. RIGHTS AND FREEDOMS OF COVERED MINORS It is the intent of the General Assembly that nothing in this subchapter may be construed to infringe on the existing rights and freedoms of covered minors or be construed to discriminate against the covered minors based on race, No. 63 Page 20 of 20 2025 VT LEG #384287 v.1 ethnicity, sex, disability, sexual orientation, gender identity, gender expression, religion, or national origin. Sec. 2. EFFECTIVE DATES This act shall take effect on January 1, 2027, except that this section (effective dates) and, in Sec. 1, 9 V.S.A. § 2449f(b) and 9 V.S.A. § 2449g(b) (rulemaking authority) shall take effect on July 1, 2025. Date Governor signed bill: June 12, 2025