Vermont Children’s Privacy Laws (2026)

S.69 (Act 63)

Enacted, not yet effective · Design code · effective 2027-01-01 · binds operators

Ages: Minors under 18

Requires: Covered businesses (those earning most of their revenue from online services) whose products are reasonably likely to be accessed by minors owe a minimum duty of care to covered minors (users they actually know are minors, or label as minors under the Attorney General's age-assurance rules): their use of a covered minor's data and their design may not result in reasonably foreseeable emotional distress or compulsive use, or in discrimination on a protected basis. They must set covered minors' default privacy settings to the highest level, may not collect, sell, share, or retain a covered minor's data beyond what the service the minor is actively and knowingly using needs, or repurpose it, and may not use it to select, recommend, or prioritize media except on the minor's express request, user-selected privacy or accessibility settings, or a search query. Push notifications to covered minors are barred between 12:00 a.m. and 6:00 a.m., and a business must give a minor a conspicuous signal when it permits another person, including a parent, to monitor the minor's activity or location.

Timing: effective 2027-01-01 for every duty on covered businesses under Act 63 Sec. 2; only Sec. 2 itself and the Attorney General's rulemaking mandates in 9 V.S.A. 2449f(b) and 2449g(b) took effect earlier, on 2025-07-01. Those sections require the Attorney General to adopt rules on or before 2027-01-01 on data-processing and design practices that lead to compulsive use or impair user autonomy, and on age-assurance methods, age-determination appeals and age-assurance data protections. The Attorney General published proposed rules under both sections, held public hearings on 2026-09-09, 2026-09-21 and 2026-09-23, and set a comment deadline of 2026-10-02.

Litigation: No suit has been filed and no injunction is in effect against Vermont's AADC. NetChoice opposed S.69 on First Amendment grounds (citing NetChoice v. Bonta on California's CAADCA), but no challenge to the Vermont statute has been filed and no court has enjoined it.

Entry last reviewed 2026-10-01

S.71 (Act 145)

Enacted, not yet effective · Privacy law (minors) · effective 2028-01-01 · binds operators

Ages: Minors 13-17 where the controller has actual knowledge, and willfully disregards, that the consumer is 13-17; under 13 handled per COPPA

Requires: If a controller 'has actual knowledge, and willfully disregards,' that a consumer is at least 13 but younger than 18, the controller may not sell the consumer's personal data or process it for targeted advertising. Controllers that qualify as 'covered businesses' must also comply with the Vermont Age-Appropriate Design Code Act for 'covered minors,' and personal data collected from a consumer the controller has actual knowledge, or willfully disregards, is a child under 13 is sensitive data that must be processed in accordance with COPPA. Consumers may opt out of profiling in furtherance of automated decisions that produce legal or similarly significant effects. Enforced exclusively by the Vermont Attorney General.

Entry last reviewed 2026-10-01