Law / United States / 
Vermont
S.69 (2025), Vermont Age-Appropriate Design Code Act (Act 63 of 2025)
An age-appropriate design code rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to covered businesses offering online services, products or features reasonably likely to be accessed by minors under 18.
- Minimize the collection and use of covered minors' personal data.NIST Privacy FrameworkGV.PO-P1
- Do not use minors' data in algorithmic recommendation systems except at the minor's request.NIST Privacy FrameworkCT.PO-P1
- Do not monitor a minor or track their location without signaling it to them.NIST Privacy FrameworkCM.AW-P3
- Do not send push notifications to minors between midnight and 6:00 a.m.no control in the NIST Privacy Framework
- Protect age assurance data.NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P3System/product/service design enables data processing visibility.
- PR.DS-P5Protections against data leaks are implemented.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalties
Enforceable as an unfair or deceptive act or practice under the Vermont Consumer Protection Act, 9 V.S.A. sections 2451 et seq.
Penalty structure
This civil penalty, sought by the Attorney General under 9 V.S.A. Sec. 2458(b)(1) as incorporated by 9 V.S.A. Sec. 2449h(b), is separate from the exemplary damages available to a consumer under 9 V.S.A. Sec. 2461(b).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Vermont Attorney General, with the same authority to make rules, conduct civil investigations, bring civil actions, and enter into assurances of discontinuance as under chapter 63 of Title 9. The Act deems a violation an unfair and deceptive act in violation of section 2453, so a consumer injured by it may sue under the Consumer Protection Act, 9 V.S.A. 2461(b).
Settledness
The Attorney General has published proposed rules under 9 V.S.A. Sections 2449f and 2449g and took comments until . The rules are a draft and are not adopted.
- As of
- Open questions
- Until the Attorney General adopts the rules that 9 V.S.A. Section 2449g(b) requires, how can a covered business "label" a user as a minor or an adult for the definitions of "covered minor" and "known adult" in Section 2449a, beyond what it actually knows?
- What revenue counts as coming from "online services" for the test that a business "generates a majority of its annual revenue from online services" in the definition of "covered business" in 9 V.S.A. Section 2449a(10)(B)?
What it reaches
Age threshold
18
Covered services
Online services, products, or features reasonably likely to be accessed by minors under 18.
How the hook was established
express
What makes it apply
Market targeting
Obligation class
Design code
Applicability criteria
Each criterion is one paragraph of the definition of covered business in 9 V.S.A. sec. 2449a(10), and a business must meet all five.
- As of
- Combinator
- All of
- Criteria
- that conducts business in this State
- that generates a majority of its annual revenue from online services
- whose online products, services, or features are reasonably likely to be accessed by a minor
- that collects consumers’ personal data or has consumers’ personal data collected on its behalf by a processor
- that alone or jointly with others determines the purposes and means of the processing of consumers’ personal data
What it makes you log
What the log must hold
Age assurance result
Log retention
Section 2449f(a)(1) also bars retaining a covered minor's personal data that is not necessary to provide the service the minor is actively and knowingly engaged with.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Personal data collected from a user for age assurance, which must be deleted immediately upon determining whether the user is a covered minor, except the determination of the user's age range
Logging duty
Section 2449g(a)(2) requires a covered business or processor, immediately upon determining whether a user is a covered minor, to delete the personal data collected for age assurance except the determination of the user's age range, so the age-range determination is the record the Act leaves in place, and (a)(6) requires a review process for users to appeal an age determination. The Act sets no retention period for the determination and gives no party a right to demand it; the Attorney General's enforcement in 2449h uses the Consumer Protection Act's investigative authority.
- Kind
- Explicit
- As of
- Provision
- 9 V.S.A. section 2449g(a)(2) and (6) (Act 63 of 2025, effective )
- Trigger
- age_assurance
What this law does
Requires covered businesses offering online services, products, or features reasonably likely to be accessed by minors under 18 to minimize collection and use of covered minors' personal data, refrain from using minors' data in algorithmic recommendation systems except at the minor's request, bar unsignaled monitoring or location tracking of minors, prohibit push notifications to minors between midnight and 6:00 a.m., and protect age assurance data. Violations are unfair and deceptive acts in commerce under 9 V.S.A. section 2453.
When LexLint raises it
When your app profile says your app operates a social platform or serves under-18s.
Back to the example · Lint your app
Page updated .