Senate Institutions reviews S.69, a bill to curb online targeting of minors

The Senate Institutions Committee on Feb. 13 received a walkthrough of S.69, titled “protection of personal information and privacy of minors,” with Rick Siegel, legislative counsel, describing the bill’s definitions, default privacy settings, limits on algorithmic recommendations for minors, and enforcement mechanism.

The bill sets detailed definitions for terms such as “covered business,” “covered minor” (an individual under 18), “biometric data,” “neural data,” “precise geolocation data” and “algorithmic recommendation system.” Siegel characterized S.69 as “a very technical bill” and said much of the language came from multiple stakeholder groups that will testify in committee.

S.69 would apply to a business that conducts activity in Vermont and whose online products, services or features are reasonably likely to be accessed by a minor and that collects consumer personal data or has consumer personal data collected on its behalf. The bill excludes state, federal and local government entities in the ordinary course of their operations, HIPAA-covered protected health information processed by covered entities or business associates, certain public-health activities, and journalistic organizations that meet the bill’s workforce test.

Key provisions laid out in the walkthrough include: default privacy settings for accounts identified as belonging to minors (for example, not displaying the existence of the minor’s account to known adult users unless the minor ‘‘expressly and unambiguously’’ allows it); restrictions on adult interactions (no likes/comments/direct messages from known adult users unless expressly permitted); preventing display of a minor’s location or connections by default; and requiring that deletion requests be honored within 15 days.

The bill would also prohibit a covered business from using a covered minor’s personal data to select, recommend or prioritize media for that minor unless the minor has made an express, unambiguous request to receive that category of media. It would bar covered businesses from sending push notifications to a covered minor between midnight and 6 a.m., and require that any change that makes privacy settings less protective be granular (multiple affirmative choices) rather than a single global opt-out toggle.

S.69 introduces a minimum duty of care for covered businesses that process minors’ data. Under that standard, the design and use of a service must not result in reasonably foreseeable severe emotional distress or materially disruptive compulsive use for a covered minor. Siegel said the bill defines “compulsive use” to mean repetitive use that materially disrupts one or more major life activities, such as sleeping, eating, learning or concentrating.

The bill contains extensive rulemaking authority for the Vermont attorney general, who would be empowered to adopt rules that could prohibit data-processing or design practices that lead to compulsive use or impair user autonomy. The attorney general would be required to review and update those rules at least once every two years.

On age assurance, S.69 would allow businesses to use commercially reasonable, technically feasible methods to determine whether a user is a minor but would limit the data collected for that purpose to what is strictly necessary. Once a business determines a user’s age it must delete other personal data collected for age assurance (keeping only the age determination), offer an appeal process for users to contest an age designation, and prioritize privacy and accessibility over age-assurance accuracy when feasible.

Transparency measures in the bill would require covered businesses to publish clear privacy information and provide detailed descriptions of each algorithmic recommendation system in use, including the factors used by the system and how each factor is applied. Siegel warned the committee that businesses may raise concerns about trade secrets and that the provision could prompt pushback from industry witnesses.

Enforcement would be through existing consumer-protection law: the bill invokes the Vermont Consumer Protection Act and would allow the attorney general to pursue violations and, subject to the statute, permit private actions by harmed individuals. Siegel said enforcement would likely be monetary penalties, injunctions and potential private suits under the consumer-protection statute.

Committee members raised implementation questions and practical concerns. Members asked how businesses can reliably distinguish minors from adults when users falsify dates of birth or use shared devices, whether transparency requirements would force disclosure of trade secrets, and how the draft balances first-amendment protections when minors request content.

One committee member said the risk of minors bypassing protections by claiming an adult age creates a “slippery slope,” and another interjected, “This is dangerous,” expressing concern about how the law would work in practice when minors intentionally present themselves as adults. A number of members asked for witnesses and real-world examples before advancing the bill.

Siegel told the committee the bill’s effective date is July 1, 2026, to give companies time to update terms, defaults and systems. He also said many details — including technical standards for age-assurance methods and the scope of prohibited design practices — would be filled in by attorney-general rulemaking.

No vote was taken; the committee signaled it would invite witnesses and continue review at a later meeting.