Senate committee hears bill to set ‘privacy by default’ for children online

Sen. Wendy Harrison, chair of the Senate Committee on Institutions, introduced S.B.69 on Feb. 18, saying the Vermont Age Appropriate Design Code (also called the Vermont Kids Code) "aims to create a safer and more appropriate online environment for Vermont's minors" by focusing regulation on platform design and data practices rather than content.

The bill would require covered businesses to set all default privacy settings for minors to the most protective option, prohibit certain data-mining and design practices that promote compulsive use, limit push notifications, and require transparency about algorithmic recommendation systems. Enforcement and rulemaking would be handled by the Vermont attorney general, who the bill directs to promulgate privacy-protective age-assurance rules and to update rules at least every two years.

The measure's sponsor, Sen. Harrison, told the committee the law is intended to protect children from harms such as addiction, cyberbullying and emotional distress and to make platforms more transparent so minors can control their online experiences. "The purpose of the bill ... is to protect children," Harrison said, and she emphasized the bill is designed to be content-agnostic in order to avoid First Amendment problems.

Zaman Qureshi, co-chair of the youth advocacy coalition Design It For Us, testified in support, describing the bill as a way to hold major platforms accountable. "The Vermont Kids Code is the first step to holding big tech accountable," Qureshi said, arguing that default privacy settings and limits on design patterns such as endless scroll and autoplay put the onus on companies rather than on children or parents.

Suzanne Bernstein, counsel at the Electronic Privacy Information Center (EPIC), also supported the bill and walked the committee through key provisions: a "minimum duty of care" focused on data and design practices (not content), default privacy settings and tools (including the ability for minors to delete accounts), transparency about recommendation systems and service features that use minors' data, prohibitions on excessive data collection and on monitoring a minor without conspicuous notice to the minor, and an age-assurance framework the attorney general would refine by rule. "It is content agnostic," Bernstein told the committee.

Members asked questions about how the law would be applied. Bernstein said the bill creates two ways a business could identify minors: an "actual knowledge" standard (similar to COPPA) or an age-assurance method developed under AG rulemaking, and that the law would require appeals and privacy protections for any age-assurance method.

A committee member raised concerns about the bill's reach and potential burden on businesses and about parental responsibilities, saying the bill "is putting the cart before the horse" and that state regulation may be overbroad for problems not solely created by businesses. The committee did not take a vote; the hearing continued with additional witnesses scheduled later in the week, including testimony from the attorney general's office.

The committee discussion emphasized that the bill is intended to be narrowly targeted at data-processing and design techniques rather than content moderation, and that enforcement would come through the state attorney general, with rulemaking to address technical details such as age-assurance methods and emerging design practices.

The committee requested concrete examples and screen captures from proponents to illustrate harmful design patterns and to inform drafting. The bill remains under consideration and will return to the committee's agenda as witnesses and the attorney general provide further testimony.