Second Time’s a Charm: Vermont Signs Age-Appropriate Design Code Into Law

On June 12, 2025, the Vermont governor signed Senate Bill 69 ( “VT AADC”) into law, creating the fourth standalone state “age-appropriate design code” law governing the design of services reasonably likely to be accessed by minors. Other AADC laws currently are being challenged on grounds they violate the First Amendment, and the Vermont governor vetoed a previous version of the VT AADC with similar concerns. But in signing this version, Vermont Governor Lamont said, “[w]ith ongoing lawsuits in other states, I recognize this new law will likely face a legal challenge. But I’m hopeful with the enactment of this law delayed until January 1, 2027, it will allow enough time to provide clarity and change the law if necessary.”

While the VT AADC is similar in many ways to California and Maryland’s AADC laws, it varies in several notable respects, including by having a private right of action, outlining a specific percentage of known minors that makes a service in scope, applying to known minors, setting forth specific requirements for social media services, providing algorithmic transparency requirements, and providing the Attorney General with rulemaking authority. While companies should be able to repurpose their efforts to comply with California and Maryland’s AADCs, in order to comply with the Vermont law, Vermont’s unique provisions will require evaluation and potentially some additional compliance efforts.

Background and Applicability

The VT AADC applies to “covered businesses” that generate a majority of annual revenue from online services and have online products, services, or features that are reasonably likely to be accessed by a covered minor. A “covered minor” is a user under 18 years old that a covered business “actually knows” is a minor or labels as a minor based on age assurance methods that the Vermont Attorney General may promulgate through its rulemaking authority.

“Reasonably likely to be accessed by a covered minor” means:

1. the service is directed to children, as defined by COPPA;
2. the service is routinely accessed by an audience that has at least 2% minors based on competent and reliable evidence;
3. the audience of the service, based on internal research, is composed of at least 2% minors; or
4. the covered business knew or should have known that at least 2% of the audience of the service includes minors.

As noted, the VT AADC allows for a private right of action under Vermont’s consumer protection law, which allows for actual damages or $500 per initial violation. The Vermont Attorney General may seek maximum penalties of $10,000 per violation.

Prohibitions

Among other requirements, such as providing a prominent and accessible tool for minors to request deletion of their social media accounts within 15 days, the VT AADC prohibits covered businesses from engaging in the following practices:

• Processing covered minors’ personal data that is not necessary to provide the specific services the covered minor actively uses;
• Using previously collected personal data from covered minors for any purpose other than the original purpose of collection (unless necessary to comply with other obligations under the VT AADC);
• Permitting anyone—including parents and guardians—from monitoring or tracking a covered minor without providing a conspicuous simultaneous signal to the covered minor;
• Using covered minors’ personal data to select, recommend, or prioritize certain content unless: (i) the minor expressly requests it, (ii) it is based on the minor’s selected privacy or accessibility settings, or (iii) the content is provided in response to a search query; and
• Sending push notifications to covered minors between midnight and 6:00 AM.

Notable Requirements and Differences from Other AADCs

The VT AADC contains some notable differences from the California and Maryland AADCs, including:

• Creating a numerical threshold for the “reasonably likely to be accessed” standard. Specifically, the VT AADC indicates that if there is evidence, research, or the business knows (or should have known) that at least 2% of its audience are known minors, then the service is considered “reasonably likely to be accessed” by minors.
• Imposing potentially broader standard for “reasonably foreseeable compulsive use.” The VT AADC implements a minimum duty of care that minors’ use of the services will not result in reasonably foreseeable compulsive use. In relevant part, “compulsive use” refers to the repetitive use of a service that materially disrupts one or more major life activities of a minor, including sleeping, eating, learning, reading, concentrating, communicating, or working. While other AADCs require certain assessments of and mitigation of potential harms related to features that can increase the extend use of services by a minor, the VT AADC standard of care related to “compulsive use” could be interpreted more broadly than other AADC laws. 
• Prohibiting a single setting to change highest default privacy settings for minors. Similar to other AADCs, Vermont requires privacy settings to be defaulted to a high level (though Vermont says “highest”). Notably, the VT AADC prohibits providing minors with a single setting that undoes the “highest privacy” settings or otherwise prompts the minor to make their setting less protective, unless strictly necessary for the service requested.
• Requiring increased transparency related to algorithmic recommendation systems. The VT AADC requires covered businesses to post information on their websites and/or or mobile applications regarding the purpose of each “algorithmic recommendation system” and those systems’ inputs, including whether the systems use covered minors’ personal data. Relatedly, the VT AADC also requires descriptions of each feature that uses covered minors’ personal data.
• Rulemaking. The VT AADC tasks the AG with conducting rulemaking regarding compulsive use and age assurance.
• Private right of action. The VT AADC treats a violation as an unfair trade practice, under which consumers can sue for damages.

Potential First Amendment Challenges

As with other challenges to AADCs, we expect stakeholders to lodge similar First Amendment challenges to the VT AADC.