Cybersecurity Policy Report, Vermont Governor Signs Age-Appropriate Design Code Act Into Law, (Jun 13, 2025)
Vermont Gov. Phil Scott (R.) has signed into law the Vermont Age-Appropriate Design Code Act to establish a comprehensive framework for protecting the privacy and personal data of minors who access online services, products, or features. The new law is set to take effect on Jan. 1, 2027.
“As we see more and more kids using technology, I believe most would agree we need to take steps to protect them in a reasonable and responsible way when they’re online. With ongoing lawsuits in other states, I recognize this new law will likely face a legal challenge. But I’m hopeful with the enactment of this law delayed until January 1, 2027, it will allow enough time to provide clarity and change the law if necessary,” Gov. Scott said in signing the bill late yesterday.
SB 69 will require businesses to provide tools for minors to manage their privacy settings and delete their accounts and prohibit certain data practices, such as sending push notifications during late-night hours. It will also require businesses to configure all default privacy settings provided to a minor through the online service, product, or feature to the highest level of privacy.
The new law directs the state attorney general to adopt rules to ensure compliance and update the rules at least every two years to keep pace with technological advancements. It also includes a private right of action that will allow consumers to file lawsuits.
“With the Governor’s signature, the Age-Appropriate Design Code is officially law in Vermont,” said the bill’s sponsor, state Rep. Monique Priestley (D.). “This is a big step forward for families across our state. It sends a clear message that we won’t let Big Tech write the rules when it comes to protecting kids online. Our children deserve platforms built with their well-being in mind, not designed to exploit their data. I’m so grateful to the Governor, our Attorney General, committee leaders, and everyone who worked so hard to make this possible. This was a team effort, and it shows what we can do when we put kids first.”
The bill (S.B. 69, Reg Sess.) was also sponsored by state Sen. Wendy Harrison (D.).
The Electronic Privacy Information Center (EPIC) said the new law would ensure children’s safety online by “prohibiting abusive data and design practices.”
“For too long, Big Tech has exploited the presence of children on their platforms to turn a profit while ignoring the privacy and safety risks their design choices cause kids,” Megan Iorio, senior counsel at EPIC, said in a statement. “The Vermont Age-Appropriate Design Code effectively mitigates these privacy and safety risks and does so in a way that Big Tech’s lawyers won’t be able to easily overturn in court.”
EPIC said it expected the new law would withstand constitutional scrutiny.
“Unlike the California AADC, the Vermont AADC does not require companies to assess or report on whether content may harm minors. The transparency provisions are instead focused on providing users with factual information about companies’ data and design practices,” according to EPIC.
EPIC also points out that any personal data collected for age assurance purposes under the new law is protected by “strong privacy requirements along with a private right of action that allows users to sue for improper collection, use, and disclosure of their data.”
News: StateLegislation DataPrivacy