Privacy Law Library

Vermont Age-Appropriate Design Code Act

VT AADC

Children · Artificial intelligence · Location

Vermont's Kids Code requires online businesses likely to be used by minors to design their services so that the use of minors' data does not cause foreseeable emotional distress, compulsive use or discrimination. It sets most-protective default privacy settings for minors, limits data collection and personalised feeds, bans overnight push notifications, requires algorithm transparency and restricts reuse of age assurance data. The Attorney General's implementing rules on design practices and age assurance must be adopted by Jan. 1, 2027 and were out for public comment in September 2026.

Where
Vermont
Citation
9 V.S.A. ch. 62, subch. 6 (9 V.S.A. §§ 2449a-2449j), added by 2025 Acts and Resolves No. 63 (S.69)
Status
Enacted, not yet in force
In force since
2027-01-01
Enforced by
Vermont Attorney General (rulemaking and enforcement under the Consumer Protection Act, 9 V.S.A. ch. 63)
People can sue
Limited
Penalties
A violation of the subchapter or its rules is an unfair and deceptive act under 9 V.S.A. § 2453; the AG may seek civil penalties up to $10,000 per violation (9 V.S.A. § 2458), injunctions and assurances of discontinuance. Section 2449h does not create a separate private action, but because violations are § 2453 violations, a consumer suit under 9 V.S.A. § 2461(b) may be arguable; this has not been tested.
Applies to
  • Covered businesses: entities doing business in Vermont that earn a majority of annual revenue from online services, whose online products, services or features are reasonably likely to be accessed by a minor, that collect consumers' personal data and determine the purposes and means of processing
  • Protects covered minors: consumers under 18 whom the business actually knows are minors or labels as minors under Attorney General age assurance rules
  • Age assurance privacy duties also bind processors
  • Excludes listed entities such as HIPAA covered entities and GLBA Title V financial institutions (§ 2449b)

What a privacy notice must say

  • Publish privacy information and terms, the purpose and inputs of each algorithmic recommendation system, and a description of every feature that uses minors' personal data, including sharing and retention.9 V.S.A. § 2449e · From 2027-01-01

Rights it gives people

  • Provide a prominent tool for a minor to unpublish or delete a social media account and honor the request within 15 days.9 V.S.A. § 2449d(b) · From 2027-01-01

Practices it requires

  • Do not offer a single setting that lowers all privacy defaults at once or prompt minors to weaken settings unless strictly necessary for a requested feature.9 V.S.A. § 2449d(a)(2) · From 2027-01-01
  • Owe covered minors a minimum duty of care: use of their data and service design must not cause reasonably foreseeable emotional distress, compulsive use, or discrimination on protected grounds.9 V.S.A. § 2449c · From 2027-01-01
  • Give a conspicuous signal to a minor whenever another person, including a parent, monitors their activity or tracks their location.9 V.S.A. § 2449f(a)(3) · From 2027-01-01
  • Do not use a minor's personal data to recommend or prioritise media except express requests, user-selected settings or search queries; no push notifications between midnight and 6 a.m.9 V.S.A. § 2449f(a)(4)-(5) · From 2027-01-01
  • Collect, sell, share or retain only the minor's personal data necessary for a service the minor is actively and knowingly using, and do not repurpose it.9 V.S.A. § 2449f(a)(1)-(2) · From 2027-01-01
  • Set minors' default privacy settings to the highest level, including hiding accounts, posts and connections from unknown adults, blocking adult direct messages, hiding location, disabling search indexing and no push notifications.9 V.S.A. § 2449d(a)(1) · From 2027-01-01

Security duties

  • Age assurance data must be limited to what is strictly necessary, deleted immediately after the age determination, not reused, combined or disclosed to non-processors, and subject to an appeal process.9 V.S.A. § 2449g(a) · From 2027-01-01

Other duties

  • The Attorney General must adopt rules on compulsive or autonomy-impairing design practices and on age assurance methods by Jan. 1, 2027 (rulemaking authority effective July 1, 2025).9 V.S.A. §§ 2449f(b), 2449g(b); 2025 Acts No. 63, Sec. 2 · From 2025-07-01

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Litigation: no lawsuit challenging the Vermont AADC was found. CourtListener searches of District of Vermont dockets (NetChoice, CCIA, 'Age-Appropriate Design', '2449a') returned no challenge as of 2026-09-25, and the AGO's Aug. 2026 rulemaking notice mentions none. Some secondary summaries imply a NetChoice suit; that appears to confuse Vermont with Maryland (NetChoice v. Brown) and was not confirmed. PACER was not checked directly. | Whether the AG's final rules will be adopted by Jan. 1, 2027 (comments were due Oct. 2, 2026).

Research reference, not legal advice.