Committee reviews S.69, bill that would impose ‘‘duty of care’’ and privacy rules for online services used by Vermont children

The Vermont House Committee on Commerce and Economic Development heard an overview Tuesday of S.69, a proposed state law that would require certain online services to design features and handle data so they are “not unreasonably harmful to children,” and would impose a minimum duty of care on covered businesses.

Senator Andrew Harrison, who summarized the bill, told the committee S.69 is an “Internet child protection bill” aimed at “protecting the safety and privacy of children in Vermont” and said the measure passed the Vermont Senate 25-5. “It requires businesses that offer certain online services that are directed to children to design their services in a way that is not unreasonably harmful to children,” Harrison said. He added the bill would require covered businesses to “owe a duty of care to the children whose data is processed.”

The bill would apply to larger digital companies that meet a five-part definition of “covered business” and to online services reasonably likely to be accessed by minors, while carving out exemptions for entities such as government agencies, covered health-care entities subject to HIPAA, certain research, and smaller businesses that process fewer than 25,000 consumers or meet specified revenue thresholds. Legislative staff said the Senate inserted those thresholds to reduce the likelihood that Vermont-based small businesses would be covered.

Why it matters: supporters argue that current platform design and algorithmic recommendation systems intentionally push content that increases screen time and can produce compulsive use and emotional harm in children. Harrison cited evidence discussed in the Senate and a recounting by attorney Laura Marquez Garrett of the Social Media Victims Law Center of two Vermont girls who signed up for Snapchat, were treated as minors, and were later recommended to an adult user; Harrison said the example illustrated how design and friend-recommendation systems can expose children to predators.

Key provisions described to the committee include: a minimum duty of care that bars design and data-processing practices reasonably likely to cause emotional distress or compulsive use by a covered minor; default privacy settings for covered minors that, by default, prevent unknown adults from viewing accounts, messaging, liking or commenting; a transparency requirement to publish detailed descriptions of algorithmic recommendation systems; prohibitions on using personal data of covered minors for purposes other than the service the child actively and knowingly engaged with; a restriction on push notifications to covered minors between midnight and 6 a.m.; a requirement that covered businesses provide a prominent tool to request account deletion and honor it within 15 days; and a rulemaking role for the attorney general to address emerging technologies and practices.

Rick Segal of Legislative Counsel walked the committee through the bill’s definitions and structure, noting the measure is lengthy and that many pages set out definitions (age assurance, covered minor, covered business, social media platform, deidentified data, profiling and various forms of sensitive data). He highlighted that “age assurance” methods will be critical for determining whether a user is a covered minor, and that the attorney general is required to publish feasible methods and guidance on or before July 1, 2027.

Committee members asked about several practical tensions in the bill. One member asked whether the prohibition in a subsection that would prevent a parent or guardian from monitoring a covered minor without giving the child a conspicuous signal would limit parental intervention. Harrison said the bill requires a “conspicuous signal” when a parent is monitoring and that committee discussion could consider tailoring that requirement by age, because a visible signal could prompt minors to move to other services and defeat the law’s intent. Counsel confirmed the bill as written would require such a signal.

Members also queried the carve-outs that exclude smaller processors (the 25,000-consumer threshold and revenue exemptions) and asked why the Senate added those provisions; Legislative Counsel said the provisions were adopted in the Senate to avoid capturing many smaller businesses, including some out-of-state companies that process limited numbers of Vermonters. Segal noted that the bill’s effective date is July 1, 2026, to give covered businesses time to comply.

The bill attaches civil enforcement to the Vermont Consumer Protection Act and gives the attorney general authority to adopt rules, review them at least every two years, and investigate alleged violations.

The committee did not take a vote during the portion of the hearing recorded in the transcript. Committee members asked for further clarification on age-assurance methods, how default settings would be implemented in practice, and whether parental monitoring provisions should be modified to avoid unintended consequences.

The hearing continued with technical questions and follow-up as staff and members prepared for testimony from outside witnesses later in the session.