Senate committee reviews House changes to bill on minors’ online privacy; rule deadline moved to 2027

MONTPELIER, Vt. — The Vermont Senate Committee on Institutions on May 27 reviewed House amendments to Senate Bill 69, called "Kids Cove," focusing on how the bill would regulate online services that interact with minors and on a new rulemaking deadline for the Attorney General, committee counsel Rick Siegel said.

The review matters because the changes alter who the bill would cover, what types of personal data and design practices are prohibited, and how the law would be enforced; those changes affect covered businesses, processors (including some government entities), and minors across Vermont.

Rick Siegel, an attorney serving as counsel to the committee, walked members through a side-by-side comparison of the Senate-passed text and the House amendments. "Green means that their language was added to the House version. Red means language was removed from the Senate version," Siegel said as he described the document the committee used to compare the two versions. He summarized multiple substantive changes the House made to definitions, exclusions, enforcement, and rulemaking responsibilities.

Major definitional changes in the House amendment include adding an "age range" definition to clarify references to an interval or a label indicating ages above or below a specific age; removing definitions tied to "sensitive data" (for example, neural data and precise geolocation were removed where the House excised sensitive-data requirements); and broadening the definition of "processor" to include federal, state, tribal, or local government entities in some contexts.

The House language also expanded the scope of profiling to add "identifying characteristics," and it altered the definition of "publicly available information" to include material made available through government records or from widely distributed media. Siegel told the committee the latter change can reduce the amount of information that receives privacy protection under the bill.

On who would be excluded, the House removed a prior Senate exemption tied to small-scale controllers/processors (the Senate text had proposed exemptions for entities processing personal data for not more than 25,000 or 50,000 consumers and for entities with annual revenue under $1,000,000). Siegel cautioned members that adding many exclusions based on revenue or processing volume can make a privacy bill vulnerable to legal challenge and said the House changes generally narrow the list of exclusions.

The House also removed a common financial-sector exception often described alongside the Gramm–Leach–Bliley Act; Siegel said taking out that exception increases the number of entities the bill would cover.

On social media platforms and minors, the House removed a clause that had excluded certain services (for example, services primarily providing news, sports, entertainment, games, or e-commerce) from the definition of "social media platform." The change matters primarily for requirements about default privacy settings for minors: the bill requires more protective default settings and limits how easy it is for minors to undo those settings.

The House version changes several items tied to age assurance and how a covered business may identify whether a user is a "covered minor." The House allows businesses to accept an age-range determination rather than a binary covered-minor determination in some contexts, and it adds specificity about what businesses must do during age-assurance processing. Siegel said the House language gives covered businesses more flexibility in how they assess age ranges but also inserts explicit prohibitions on combining data collected for age assurance with other personal data except for the age-determination outcome.

The amendment sets explicit rulemaking deadlines for the Attorney General. "The AG now has a specific deadline to create rules on or before 01/01/2027," Siegel said, noting the House moved the bill's effective date from July 1, 2026, in the Senate text to Jan. 1, 2027, to give the Attorney General more time to adopt rules.

Enforcement remains through the Vermont Consumer Protection Act, Siegel said. Committee members asked whether the House received testimony from the State of Vermont about how Vermont agencies or third-party processors operate, and Siegel said he did not recall specific state testimony but noted Vermont uses third parties in some capacities.

Committee members and counsel discussed constitutional and practical risks, including compelled-speech concerns where the House altered transparency requirements (the House version asks for the purpose of algorithmic systems rather than detailed descriptions or factor lists that companies might treat as trade secrets). Siegel also highlighted language intended to reduce the number of businesses unintentionally swept into the law while noting that removing too many exclusions could invite legal scrutiny.

No formal vote or motion occurred at the May 27 meeting. Committee members asked for the list of House witnesses and indicated they might invite additional witnesses back to testify. The committee did not take final action on the bill at this session.