On April 24, 2024, Senate Bill 289, for an act relating to age-appropriate design code was read for the second time in the Vermont State Senate. This follows its initial passage by the Senate on March 20, 2024, and referral by the Vermont House of Representatives, on March 22, 2024, back to the Senate.

The bill was amended on its passage by the Senate. 

What is the scope of the bill for the Vermont Age Appropriate Design Code Act?

The bill highlights its application to covered entities that:

• collect consumers' personal data or have consumers' personal data collected on its behalf by a third party;
• alone or jointly with others, determine the purposes and means of the processing of consumers' personal data;
• operate in Vermont; and
• alone or in combination, annually buy, receive for the covered entity's commercial purposes, sell, or share for commercial purposes, alone or in combination, the personal data of at least 50% of its consumers.

What are the prohibitions under the bill for the Vermont Age Appropriate Design Code Act?

Specifically, the bill provides for a 'minimum duty of care' for the use of the personal data of a minor consumer and the design of an online service, product, or feature, which will not benefit the covered entity to the detriment of a minor consumer, and will not result in:

• reasonably foreseeable and material physical or financial injury to a minor consumer;
• reasonably foreseeable emotional distress to a minor consumer;
• a highly offensive intrusion on the reasonable privacy expectations of a minor consumer;
• the encouragement of excessive or compulsive use of the online service, product, or feature by a minor consumer; or
• discrimination against the minor consumer based on race, ethnicity, sex, disability, sexual orientation, gender identity, gender expression, or national origin.

Prohibitions also extend to the use of low-friction variable reward design features that encourage excessive and compulsive use by a minor consumer, profiling a minor, selling the data of a minor consumer, and using dark patterns.

What are the obligations under the bill for the Vermont Age Appropriate Design Code Act?

Covered entities subject to the bill must:

• configure all default privacy settings provided to a minor consumer to a high level of privacy;
• provide privacy information in a language suited to the age of a minor consumer reasonably likely to access the service, product, or feature; and
• provide easily accessible age-appropriate tools for a minor consumer to limit the ability of users or covered entities to send unsolicited communications.

Notably, amendments to the bill remove the obligation to conduct a Data Protection Impact Assessment (DPIA).

You can read the bill as passed by the Senate here and track its progress here.