EPIC Applauds Vermont Governor Phil Scott for Signing Age-Appropriate Design Code into Law

This afternoon, Governor Phil Scott signed the Vermont Age-Appropriate Design Code (AADC) into law. The Vermont AADC protects kids’ privacy, enhances kids’ autonomy, and ensures their online safety by prohibiting abusive data and design practices. The law will take effect Jan. 1, 2027.

“As we see more and more kids using technology, I believe most would agree we need to take steps to protect them in a reasonable and responsible way when they’re online,” the Governor remarked upon signing.

“With the Governor’s signature, the Age-Appropriate Design Code is officially law in Vermont,” said sponsor Representative Monique Priestley. “This is a big step forward for families across our state. It sends a clear message that we won’t let Big Tech write the rules when it comes to protecting kids online. Our children deserve platforms built with their well-being in mind, not designed to exploit their data. I’m so grateful to the Governor, our Attorney General, committee leaders, and everyone who worked so hard to make this possible. This was a team effort, and it shows what we can do when we put kids first.”

“For too long, Big Tech has exploited the presence of children on their platforms to turn a profit while ignoring the privacy and safety risks their design choices cause kids,” said Megan Iorio, Senior Counsel at EPIC and director of EPIC’s program on Platform Governance and Accountability. “The Vermont Age-Appropriate Design Code effectively mitigates these privacy and safety risks and does so in a way that Big Tech’s lawyers won’t be able to easily overturn in court.”

Significant provisions of the Vermont AADC include:

• Requiring covered businesses to configure minors’ default privacy settings to the highest level of privacy.
• Providing minors with the ability to limit unwanted adult contact.
• Regulating how minors’ personal data is used to ensure that personalized feeds are not driven by surveillance data, but instead by minors’ express preferences.  
• Requiring companies to be transparent about how they use minors’ personal data.
• Requiring the Attorney General to update rules prohibiting abusive data processing or design practices that “lead to compulsive use or subvert or impair user autonomy, decision making, or choice” at least once every two years.
• Requiring the Attorney General to issue rules about how covered businesses can use age assurance technology in a privacy-protective way.
• A private right of action that will allow Vermonters to enforce their rights in court.

The Vermont AADC was carefully drafted to withstand constitutional scrutiny.

• Unlike the California AADC, the Vermont AADC does not require companies to assess or report on whether content may harm minors. The transparency provisions are instead focused on providing users with factual information about companies’ data and design practices.
• The duty of care is narrowly scoped and explicitly does not include a duty to mitigate harm stemming from content, ensuring that the provision does not interfere with companies’ editorial discretion or users’ rights to information.
• Any personal data collected for age assurance purposes is protected by strong privacy requirements along with a private right of action that allows users to sue for improper collection, use, and disclosure of their data.
• The law applies to businesses regardless of the content they host and does not include unjustified carveouts for special interests or industries.

EPIC has supported the Vermont AADC in its journey through the Vermont Legislature. EPIC testified in support of the bill and submitted additional written testimony. EPIC regularly advocates for privacy for minors online and platform accountability and governance policies that protect the speech, privacy, anti-discrimination, and safety rights of internet users, including minors. In court, EPIC has filed amicus briefs in cases involving the intersection of privacy, kids’ safety, and First Amendment. EPIC also filed extensive comments about age assurance best practices in the New York Attorney General’s rulemaking to implement the NY SAFE for Kids Act.