The Vermont Statutes Online
The Statutes below include the actions of the 2025 session of the General Assembly.
NOTE: The Vermont Statutes Online is an unofficial copy of the Vermont Statutes Annotated that is provided as a convenience.
Title 9 : Commerce and Trade
Chapter 062 : Protection of Personal Information
Subchapter 006 : VERMONT AGE-APPROPRIATE DESIGN CODE ACT
(Cite as: 9 V.S.A. § 2449f)-
§ 2449f. Prohibited data and design practices [Effective January 1, 2027]
[Subsection (a) effective January 1, 2027.]
(a) Data privacy. A covered business shall not:
(1) collect, sell, share, or retain any personal data of a covered minor that is not necessary to provide an online service, product, or feature with which the covered minor is actively and knowingly engaged;
(2) use previously collected personal data of a covered minor for any purpose other than a purpose for which the personal data was collected, unless necessary to comply with any obligation under this chapter;
(3) permit any individual, including a parent or guardian of a covered minor, to monitor the online activity of a covered minor or to track the location of the covered minor without providing a conspicuous signal to the covered minor when the covered minor is being monitored or tracked;
(4) use the personal data of a covered minor to select, recommend, or prioritize media for the covered minor, unless the personal data is:
(A) the covered minor’s express and unambiguous request to receive:
(i) media from a specific account, feed, or user, or to receive more or less media from that account, feed, or user;
(ii) a specific category of media, such as “cat videos” or “breaking news,” or to see more or less of that category of media; or
(iii) more or less media with similar characteristics as the media they are currently viewing;
(B) user-selected privacy or accessibility settings; or
(C) a search query, provided the search query is only used to select and prioritize media in response to the search; or
(5) send push notifications to a covered minor between 12:00 midnight and 6:00 a.m.
(b) Rulemaking. The Attorney General shall, on or before January 1, 2027, adopt rules pursuant to this subchapter that prohibit data processing or design practices of a covered business that, in the opinion of the Attorney General, lead to compulsive use or subvert or impair user autonomy, decision making, or choice during the use of an online service, product, or feature of the covered business. The Attorney General shall, at least once every two years, review and update these rules as necessary to keep pace with emerging technology. (Added 2025, No. 63, § 1, eff. January 1, 2027.)
