The Vermont Attorney General's Office briefed the Senate Institutions committee on Thursday on its work to implement Act 63, the Age Appropriate Design Code, which the office said establishes baseline privacy, safety and design protections for minors using online services.

Sarah Estevez, an assistant attorney general in the consumer protection division, told senators the law focuses on product design and data collection rather than content moderation and lays out several core duties for covered businesses. "Essentially, what it does is it establishes baseline privacy, safety, and design protections for minors 18 when they use online services," she said.

The law's principal design requirements outlined by the AG's office include a duty of care to avoid "reasonably foreseeable harms" (such as compulsive or addictive use, emotional and psychological harm, and algorithm-driven exploitation or discrimination); high privacy defaults for minors (limiting data collection, restricting public visibility and reducing unsolicited contact and profiling by default); limits on the use and retention of minors' data and on manipulative or addictive design features; and clear transparency for young users and their parents about what data is collected and how recommendation or ranking systems affect content exposure.

The office emphasized an age-assurance requirement that companies must implement with safeguards. "Companies must determine when users are minors, and they have to apply the protections for minors accordingly while ensuring ... that their age verification data is not repurposed and that their additional privacy risks are minimized," Estevez said.

Estevez said the AG's office will enforce the law under the state's Consumer Protection Act and that "any violations of the law will be treated as unfair or deceptive acts." She told the committee the statute takes effect on Jan. 1, 2027, and that the office is responsible for adopting rules to clarify compliance and age-assurance standards.

Senators pressed the office on operational details. One senator asked how the state will know whether businesses are reaching minors and whether companies would be penalized for unknowingly having a minor user base. Estevez said that the rulemaking process must define what constitutes a "reasonable belief" that a service is reaching minors and that enforcement will often begin with investigations rather than immediate penalties. As an example, she pointed to the data-broker registration regime, where some violations are evident and enforced directly, while other cases require more nuanced inquiry.

Committee members also asked whether the AG would report back if the law or rules produce unintended consequences. Estevez said the office has a history of communicating with the legislature when laws need improvement and expected to do the same here.

On timeline and outreach, Estevez said the AGO is soliciting informal comments now via a web form and email, continuing research and stakeholder conversations through mid-spring, then plans to file a proposed rule with the Secretary of State roughly one month before formal publication. The office expects public hearings and formal comment periods and noted executive review bodies under Title 3 will review the rules after formal filing. She said the office is coordinating with other states' work and stakeholders, mentioning New York's analogous effort as a source of models for possible thresholds and methods.

The committee chair emphasized the harms lawmakers heard during the bill's consideration — testimony from pediatricians, teachers and young people about exploitative contacts and other harms — and reiterated bipartisan support for the statute. The committee requested an update in roughly 2–3 months and adjourned with no formal votes on implementation recorded at the hearing.

What happens next: the AG's office will continue informal outreach, produce a proposed rule for formal filing on its timeline and hold public hearings; enforcement authorities will be exercised under the Consumer Protection Act once the rule and statute are in effect on Jan. 1, 2027.

(Quotation attributions are taken from the meeting transcript.)