Vermont is developing new rules that will determine how online services must protect children’s privacy, estimate users’ ages and avoid product designs that encourage compulsive use.
The Vermont Attorney General’s Office opened the rulemaking process under the state’s Age-Appropriate Design Code, which was enacted through Act 63 in May 2025.
The law and any implementing rules are scheduled to take effect Jan. 1, 2027.
Vermont’s approach reaches beyond traditional privacy notices and parental consent. It addresses how digital products are designed, how much information they collect from minors and whether interface features manipulate young users into remaining online.
Highest Privacy Settings Must Be the Default for Minors
Covered businesses will be required to provide minors with the highest available level of privacy by default.
The law also restricts businesses from collecting or sharing a minor’s personal information unless the processing is necessary to provide the requested service.
This creates a stricter standard than simply allowing a child or parent to locate privacy settings later.
Companies will need to examine what happens when a young person first creates an account or accesses a digital product.
Default settings involving location, profiling, targeted advertising, public visibility and data sharing should not expose minors to unnecessary collection while waiting for them to opt out.
Vermont Will Regulate Compulsive Design
The Attorney General is required to adopt rules prohibiting data practices and design features that lead to compulsive use or interfere with a user’s autonomy, decision-making or ability to make a meaningful choice.
That mandate could affect common engagement features such as:
- Infinite scrolling
- Autoplay
- Frequent notifications
- Streaks and reward systems
- Designs that pressure users to return
- Repeated prompts that discourage privacy choices
- Interfaces that make leaving or logging out difficult
The final rules will determine which practices cross the line from ordinary product engagement into legally restricted manipulation.
Businesses should expect regulators to examine the combined effect of a product’s features rather than evaluating each feature in isolation.
Monitoring a Minor May Require a Visible Signal
Vermont’s law also restricts companies from allowing another person to monitor a minor’s activity or location without providing a conspicuous signal to the minor.
This requirement is intended to prevent invisible monitoring.
Digital services should review features that allow parents, guardians, employers, schools or other users to view a minor’s location or activity.
The child-facing notice must be sufficiently clear for the minor to understand that monitoring is occurring.
Age Assurance Must Protect Privacy
One of the most difficult parts of the rulemaking concerns how businesses determine whether a user is a minor.
The Attorney General must identify age assurance methods that are commercially reasonable and technically feasible.
Importantly, the law directs the office to prioritize privacy and accessibility over perfect accuracy.
That distinction reflects a central problem with age verification.
A business may reduce children’s access by requiring government identification, facial analysis or other sensitive information. Those methods, however, can create a new database of identification and biometric data belonging to every user, including adults.
Vermont’s rules must consider:
- The size and resources of the business
- The cost and effectiveness of available technology
- The effect on user safety and accessibility
- The effect on the user experience
- Whether transparency would increase consumer trust
- Whether existing information can be used instead of collecting more data
- Whether age assurance systems should be interoperable
- Whether users should receive several verification options
The rules must also establish a process for users to appeal an incorrect age designation.
This matters because an inaccurate result could prevent an adult from using a service or expose a child to a product that should have applied stronger protections.
Companies Should Prepare Before 2027
Businesses likely to be accessed by Vermont minors should not wait for the final rules before reviewing their products.
Preparation should include:
- Identifying which products are likely to be used by minors
- Mapping the personal information collected from young users
- Reviewing default privacy settings
- Evaluating targeted advertising and profiling
- Documenting why each category of data is necessary
- Reviewing location and activity-monitoring features
- Testing potentially compulsive design features
- Assessing available age assurance methods
- Creating a process for disputed age classifications
Product, privacy, engineering, marketing and trust-and-safety teams will need to work together. Many of the requirements concern the operation and design of the product, not language that can be added to a privacy policy after development is complete.
Vermont Is Part of a Broader Youth Privacy Movement
Vermont’s rulemaking reflects a wider shift in children’s privacy regulation.
States are moving beyond rules focused solely on parental consent and beginning to regulate product design, default settings, profiling, location collection and engagement mechanisms.
The practical expectation is that services likely to be used by children should be designed with children’s privacy and safety in mind from the beginning.
Companies that rely on adult-oriented defaults and place the burden on minors to protect themselves may face increasing regulatory exposure.
Captain Compliance Helps Businesses Prepare for Youth Privacy Requirements
Captain Compliance helps organizations assess children’s and teen privacy obligations, map personal information, review consent and default settings, evaluate age assurance practices and document privacy-by-design controls.
Vermont’s Age-Appropriate Design Code takes effect Jan. 1, 2027.
For businesses operating digital products used by minors, the implementation work should begin well before that date.
Frequently Asked Questions
When does Vermont’s Age-Appropriate Design Code take effect?
The law and its implementing rules are scheduled to take effect Jan. 1, 2027.
What must businesses do with privacy settings for minors?
Covered businesses must apply the highest available level of privacy by default when a digital product is used by a minor.
Does the law prohibit collecting children’s data?
It restricts the collection and sharing of a minor’s personal information unless the processing is necessary to provide the relevant service.
What are compulsive design practices?
The final rules will define the prohibited practices. The law directs the Attorney General to address designs that lead to compulsive use or interfere with autonomy, decision-making or choice.
Will companies have to verify every user’s age?
The rulemaking will identify commercially reasonable and technically feasible methods for determining whether a user is a covered minor. The law requires privacy and accessibility to be prioritized over perfect accuracy.