The Vermont Office of the Attorney General (“Vermont AG”) has issued Proposed Rules under the Vermont Age-Appropriate Design Code Act, Act 63 (S.69) (“Vermont AADC”). The statute takes effect January 1, 2027. The Proposed Rules are not final: the comment period closes October 2, 2026, and §2449f(b) directs the Vermont AG to adopt final rules on or before January 1, 2027.
At its core, the statute imposes on covered businesses a “minimum duty of care” for Vermont users under the age of 18: companies’ use of a minor’s personal data, and the design of their online services, cannot cause “reasonably foreseeable compulsive use,” “emotional distress,” or specified forms of discrimination. The law also prohibits covered businesses from using a covered minor’s personal data to “select, recommend, or prioritize media for the covered minor,” subject to carve-outs for the minor’s “express and unambiguous request,” “user-selected privacy or accessibility settings,” and search queries.
But the Proposed Rules would go well beyond personal data prohibitions, and also expressly forbid using “behavioral data” (“clicks, scrolls, dwell time, viewing history, and navigation patterns”) and “inferred preferences” (preferences “predicted, derived, or estimated from” that activity). The Proposed Rules give several examples of prohibited and limited “addictive” features, including personalized feeds, autoplay, infinite scroll, engagement counts, rewards, streaks, and certain popularity indicators. User-directed experiences would remain available in specified circumstances. Compounding these challenges, if implemented, the Proposed Rules would require businesses to assess the final requirements and implement any necessary changes before the January 1, 2027 effective date of the statute.
The Proposed Rules come in two parts. The first targets the features users interact with every day: personalized feeds, recommendation systems, most notifications, autoplay, infinite scroll, engagement (likes/comments), rewards, social pressure features like streaks, and interfaces that make leaving harder than staying. Some practices would be prohibited outright for covered minors; others would turn on their purpose, design, or likely effect on engagement. The Proposed Rules do not provide for parental consent override.
The second part governs age assurance: how a business determines which users are minors. The framework is flexible on its face, requiring no specific technology and no identity verification. While the presumption is that a business should use a “low intrusive” age assurance method, the Proposed Rules also require the method to “achieve [a] reasonably necessary level of accuracy or confidence” (without defining what that means), and require a higher intrusive method if the platform or feature presents a “reasonably foreseeable risk of material privacy, safety, or accessibility harms to covered minors.”
Compliance with either part could demand changes to core product functionality for some companies, and because the Vermont AADC is not limited to social media companies, that burden could land on a wide range of consumer-facing online businesses.
This Legal Update breaks down the details of the law, who is covered, the details of the Proposed Rules, and the steps that remain before the Proposed Rules take effect.
Who is Covered: the 2% Threshold
The Vermont AADC applies to a “covered business,” which is a business that:
- Conducts business in Vermont;
- Earns most of its annual revenue from online services;
- Offers products, services, or features reasonably likely to be accessed by a minor;
- Collects consumers’ personal data, itself or through a vendor; and
- Controls how that data is used.
The third factor decides most cases—and is easier to satisfy than it sounds, because a service need not be designed for minors—or even popular with minors—to be covered. A service qualifies if:
- Competent and reliable evidence shows that minors ages 2-17 make up at least 2% of its audience;
- Internal company research shows that composition;
- The business knew or should have known that at least 2% of the audience consisted of minors ages 2-17; or
- It is directed to children under the Children’s Online Privacy Protection Act (“COPPA”).
The statute includes several exclusions, including certain financial institutions, journalism entities, government entities, and specified health and research information. Whether an exclusion applies may depend on the entity, the data involved, or the context in which the data is processed.
The Duty of Care: A Broader Standard Than It Appears
Under 9 V.S.A. §2449c(a)–(b), a covered business that processes a covered minor’s data owes a minimum duty of care: the use of a covered minor’s personal data and the design of an online service must not result in reasonably foreseeable emotional distress, reasonably foreseeable compulsive use, or discrimination.
The statute prohibits certain practices outright, but §2449f(b) leaves to rulemaking the question of which design features amount to compulsive use. That gap is the central issue for companies.
The Vermont AADC defines “compulsive use” narrowly, as repetitive use that “materially disrupts one or more major life activities of a minor,” such as sleeping or learning. §2449a(8). The Proposed Rules (as discussed below) would use a different standard, deeming a practice to “lead to compulsive use” wherever it “relies on engagement optimization techniques” or is “reasonably likely to increase, prolong, or intensify” interaction.
The Vermont AADC does include an exception for user-generated content. Under §2449c(c), the content of the media a covered minor views cannot itself establish emotional distress, compulsive use, or discrimination. §2449c(d) confirms that nothing requires a covered business to block access to specific media, and §2449i adds that nothing may prevent a covered minor from deliberately searching for or requesting any media.
Proposed Rule 1: Prohibited Data and Design Practices
Personalized Feeds, Autoplay, and Infinite Scroll
As discussed above, the Vermont AADC’s core prohibition hinges on a single input: a covered minor’s personal data cannot be used to select, recommend, or prioritize media, subject to carve-outs for express requests, user-selected settings, and search.
The Proposed Rules would keep that prohibition and layer on two additional inputs: “behavioral data” (clicks, scrolls, dwell time, viewing history, navigation patterns) and “inferred preferences” (predictions drawn from that activity). They would also broaden the definition of “prioritizing media” to include filtering and amplifying. There is no exception for user or parental consent.
Neither autoplay nor infinite scroll appears in the statute. The Proposed Rules would prohibit both—and crucially, would do so regardless of personalization, meaning that disabling personalized feeds or features for covered minors would not fix the problem. The autoplay ban prohibits both automatic playback and auto-advancing content. For infinite scroll, the Proposed Rules would prohibit interfaces that load additional media in response to ordinary scrolling or swiping, and would require “a discrete and intentional action beyond ordinary scrolling or navigation,” such as a “Load More” button.
The Proposed Rules would preserve room for user-directed experiences. A covered business may still show a covered minor media from a specific account, feed, or creator the minor requests; a category the minor selects; media similar to what the minor affirmatively chose to view; or search results. Privacy, accessibility, and display settings the minor configures would also be permitted. Subscription feeds, chronological ordering, and search functions would therefore remain the most defensible product designs—though each permitted request must be specific and contemporaneous, not inferred from prior activity.
Notifications, Rewards, and Social Pressure Features
The Vermont AADC already bars push notifications to covered minors between midnight and 6 a.m., and makes suppression the default. The Proposed Rules would go significantly further: a covered business could not deploy any notification feature designed or reasonably likely to encourage, increase, prolong, or reinitiate engagement through personal data, behavioral data, or inferred preferences. Any push notification based on personal data, activity, or behavioral data would also be prohibited. The Proposed Rules would preserve notifications needed to provide a requested service, as well as transactional, safety, and account-related communications that are not designed to increase engagement.
The Proposed Rules would also prohibit “variable or intermittent rewards” (e.g., “likes, badges, points”), “social pressure features” (e.g., “streaks,” “popularity indicators”), and “interfaces that make continued engagement substantially easier than disengagement.”
Proposed Rule 2: Age Assurance
The second Proposed Rule tackles age assurance—how a covered business determines whether a user is a covered minor. While the Vermont AADC reaches only minors a business actually knows are minors, the Proposed Rules would go further, reaching minors the business has reason to know are minors, a standard deemed met whenever the service is one that minors are likely to use or whenever the business collects or infers information indicating a user’s minority status.
The Proposed Rules would use a tiered approach for age assurance, organized around one main principle: use the least intrusive method that is still accurate enough (without defining the level of accuracy required). The Proposed Rules require a business to start at the lowest of three tiers, and allow the business to escalate only when the level below falls short:
- Low-intrusion: Asking users their age with reasonable safeguards, using age signals the business already has, or drawing on account or session indicators.
- Moderate-intrusion: Estimating age from device data, account information, or usage patterns is permitted only where a low-intrusion method is not reasonably available or sufficient.
- Higher-intrusion: Checking credentials is permitted only where lower methods are neither available nor sufficient, and where the service poses a reasonably foreseeable risk of material privacy, safety, or accessibility harm to minors.
The statute requires the Vermont AG to prioritize privacy and accessibility over accuracy, §2449g(b)(2)(A). The Proposed Rules includes the following obligations:
- Before escalating to a higher tier, a business must evaluate a lower-intrusion alternative and document why it falls short.
- It must test its method’s error rates at least annually, including whether errors fall disproportionately on particular groups of minors.
- It must delete the underlying data as soon as the determination is made, subject to narrow security, legal, and audit exceptions.
- It must offer a backup method if the first process fails, an appeals process reviewed by a person independent of the original decision, and a written assessment before launch.
- Using a higher-intrusive method without proper documentation justifying the method is presumed non-compliant.
Where a vendor performs age assurance, the business remains on the hook—and may rely on that vendor only after vetting its processes, requiring compliance by contract, and monitoring performance.
What Comes Next
The Proposed Rules remain open for comment until October 2, 2026, and §2449f(b) directs the Vermont AG to adopt final rules on or before January 1, 2027—the same date the Vermont AADC takes effect. Companies should anticipate little or no gap between the final rules and the compliance date.
Visit us at mayerbrown.com
Mayer Brown is a global services provider comprising associated legal practices that are separate entities, including Mayer Brown LLP (Illinois, USA), Mayer Brown International LLP (England & Wales), Mayer Brown (a Hong Kong partnership) and Tauil & Chequer Advogados (a Brazilian law partnership) and non-legal service providers, which provide consultancy services (collectively, the "Mayer Brown Practices"). The Mayer Brown Practices are established in various jurisdictions and may be a legal person or a partnership. PK Wong & Nair LLC ("PKWN") is the constituent Singapore law practice of our licensed joint law venture in Singapore, Mayer Brown PK Wong & Nair Pte. Ltd. Details of the individual Mayer Brown Practices and PKWN can be found in the Legal Notices section of our website. "Mayer Brown" and the Mayer Brown logo are the trademarks of Mayer Brown.
© Copyright 2026. The Mayer Brown Practices. All rights reserved.
This Mayer Brown article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.
[View Source]
