Update Applicable to:	Effective Date
All Covered Business	Rulemaking provisions – July 1, 2025 January 1, 2027

What happened?

On June 12, 2025, Vermont enacted the Age-Appropriate Design Code Act (S.69), a landmark online privacy law aimed at protecting minors. The law requires businesses to adopt privacy-focused design standards and age-appropriate data practices for online services likely to be accessed by users under 18.

Overview:

Vermont Age-Appropriate Design Code Act (S.69): the purpose is to protect children under 18 by requiring online services to adopt safer, more private, and age-appropriate design and data practices.

Who Must Comply? Businesses that:

• Operate in Vermont.
• Earn most of their revenue from online services.
• Collect or control the processing of personal data.
• Offer services likely to be accessed by minors (defined as under 18), including if at least 2% of users are minors.

Requirements For Business:

1. Duty of Care

Businesses must avoid:

• Causing emotional distress.
• Encouraging compulsive use.
• Discriminating based on identity traits (e.g., race, gender, disability).

2. Age Assurance

• Must estimate users’ ages using privacy-focused methods.
• Only collect data necessary for age checks.
• Delete age data immediately after use.
• Allow users to appeal age determinations.

• Privacy Defaults

For minors, businesses must:

• Hide profiles and content from adults unless allowed by the minor.
• Block direct messaging and push notifications.
• Disable search engine indexing.
• Prevent location and connection visibility.

4. Data Use Restrictions

• Only collect and use data necessary for the service.
• No secondary use unless required by law.
• No covert tracking or monitoring.
• No content recommendations unless requested by the minor or based on their settings or searches.
• No push notifications between midnight and 6 a.m.

5. Account Deletion

• Must offer a tool for minors to delete or unpublish their accounts.
• Requests must be made within 15 days.

6. Transparency

Businesses must clearly explain:

• What data they collect and why.
• How data is used, shared, and stored.
• How algorithmic recommendation systems work and what data they use.

7. Enforcement: The Vermont Attorney General will enforce the law under the state’s consumer protection rules.

• Violations are treated as unfair or deceptive business practices.

Additional Details:

Rulemaking: By January 1, 2027, the Attorney General must:

• Define acceptable age assurance methods.
• Prohibit harmful design practices.
• Establish appeal processes for age determinations.
• Provide additional privacy protections for age assurance data.

Source References

• Vermont SB 69 – An act relating to an age-appropriate design code
• Vermont Governor Press Release

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.