Vermont Age-Appropriate Design Code: the 1 January 2027 app checklist

Summary. Vermont's Age-Appropriate Design Code (Act 63, S.69) was signed on 12 June 2025 and adds 9 V.S.A. §§ 2449a to 2449j, which take effect on 1 January 2027. It covers a business that operates in Vermont, earns most of its revenue from online services, collects Vermonters' personal data and runs a service reasonably likely to be accessed by minors, including any service whose audience is at least 2 percent aged 2 to 17. There is no size floor. For users a business knows are under 18, or labels as minors under the Attorney General's age-assurance rules, privacy defaults must be at the highest level, push notifications are off by default and barred from midnight to 6 am, and personal data may not rank media unless the minor asks. A violation is an unfair and deceptive act, with civil penalties of up to $10,000 per act. The Attorney General's two proposed rules, on engagement design and age assurance, are due by 1 January 2027 and were still listed as proposed on 12 November 2026. We found no court challenge to Vermont's code; California's code is partly enjoined and South Carolina's faces a NetChoice lawsuit.

About this article. For product, engineering and compliance teams shipping apps or websites that Vermont teenagers use. We read the enacted statute, the Vermont rulemaking record, the South Carolina and California texts, and court-tracking pages from NetChoice and one law firm, checked on 12 November 2026. The Vermont General Assembly and Attorney General sites were unreachable from our network, so we read their pages as archived copies, and could not open any rule text revised after 12 October 2026. This is general information, not legal advice; confirm applicability with counsel. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What applies on 1 January 2027, and what is still moving

The statute is settled. The two rules that give it operational detail are not, and the law requires them by the same date. The dates below come from the act, the Secretary of State's rules service and the Attorney General's rulemaking pages.

Build to the statute now, since its text will not change before 1 January, and treat the July drafts as a guide to direction rather than final law.

Who the code covers

A covered business, or an affiliate of one, must meet all five tests in § 2449a(10):

1. It conducts business in Vermont.

1. It generates a majority of its annual revenue from online services.

1. Its online products, services or features are reasonably likely to be accessed by a minor.

1. It collects consumers' personal data, or a processor does so on its behalf.

1. It alone or jointly determines the purposes and means of processing.

Reasonably likely to be accessed. Any one of four indicators is enough: the service is directed to children under COPPA; competent and reliable audience evidence shows at least 2 percent of its audience is aged 2 to 17; internal company research shows that 2 percent share; or the business knew or should have known it.

Who gets the protections. A consumer is a Vermont resident acting outside a work role, and a minor is anyone under 18. A covered minor is a consumer the business actually knows is a minor, or labels as one under age-assurance methods set by Attorney General rules. That second limb is why the age-assurance rule matters: it decides when you are expected to find out.

Exclusions. Government entities, HIPAA-covered health information, public health information, regulated human-subjects research, journalism organisations whose workforce is mostly journalists, and financial institutions subject to the Gramm-Leach-Bliley Act.

The Future of Privacy Forum noted that most websites are likely to reach at least some minors, so the audience test rarely excludes a consumer service. The revenue test cuts the other way: a retailer whose app is a sideline may not earn most of its revenue online. Several defaults apply only to a social media platform, a service primarily intended for social interaction with profiles, connection lists or posts; email-only, messaging-only and school-directed services are outside it.

Vermont's comprehensive privacy law, Act 145, is separate and takes effect on 1 January 2028. It tells covered businesses to follow the design code for covered minors, and says the more privacy-protective law wins in a conflict. Our guide to the 2027 and 2028 state privacy laws covers it.

The statutory duties, section by section

Minimum duty of care (§ 2449c)

Data use and service design must not result in reasonably foreseeable emotional distress, reasonably foreseeable compulsive use, or discrimination. Compulsive use means repetitive use that materially disrupts a minor's major life activities, such as sleeping, eating, learning, reading, concentrating, communicating or working. The content of media a minor views cannot by itself establish a breach, and no business must block a minor from any media.

Default privacy settings and tools (§ 2449d)

All default privacy settings offered to a covered minor must be set to the highest level of privacy, including these eight. A known adult is a user the business knows is an adult, or labels as one under the age-assurance rules.

Two design bans sit alongside the list. You may not offer a single control that makes all defaults less protective at once, and you may not prompt a minor to weaken a setting unless the change is strictly necessary for a feature they have expressly asked for. A business must also provide a prominent tool for a minor to unpublish or delete their social media account, and honour the request within 15 days.

Transparency (§ 2449e)

Covered businesses must publish their privacy information, terms and community standards; the purpose of each recommendation system; each input, with how it is measured, how it uses minors' data, how it influences results and how it is weighted; and, for every feature using minors' data, its purpose, the data collected and used, recipients and retention. That needs a maintained feature-to-data inventory.

Prohibited data and design practices (§ 2449f)

The statute itself bars five things for covered minors:

1. Collecting, selling, sharing or retaining personal data not necessary for a feature the minor is actively and knowingly engaged with.

1. Using previously collected data for a different purpose.

1. Letting anyone, parents included, monitor activity or track location without a conspicuous signal to the minor.

1. Using personal data to select, recommend or prioritise media, unless the data is the minor's express request (a specific account, a category such as cat videos, or more or less of similar media), their privacy or accessibility settings, or a search query used only for that search.

1. Sending push notifications between midnight and 6 am.

Age assurance privacy (§ 2449g)

When a business or its processor runs age assurance, it may collect only data strictly necessary for that purpose, must delete it as soon as it determines whether the user is a covered minor (keeping only the age range), may not reuse or combine it, may disclose it only to processors, and must offer an appeal. In writing its rules, the Attorney General must put user privacy and accessibility ahead of the accuracy of age-assurance methods.

The Attorney General's draft rules: what they add

The two drafts dated 8 July 2026 carry an effective date of 1 January 2027. The summary below reflects those drafts. Neither has been adopted, and we could not confirm whether a revised final proposed version has been filed, so check the Attorney General's page before you finalise designs.

Prohibited data and design practices (26P027). The draft treats a business as having reason to know a user is a covered minor when its service is reasonably likely to be accessed by minors. It then names practices prohibited for covered minors:

• For You and other behavioural recommendation feeds, and training recommenders on minors' data.

• Autoplay, and infinite scroll that loads media without a discrete, intentional action.

• Engagement-based notifications, such as alerts that new posts are waiting, or reminders after inactivity.

• Likes, badges, points, streaks, missed-activity alerts and popularity counts.

• Interfaces that make leaving harder than staying, and redesigns that keep the same engagement effect.

A monitoring signal must be continuous, real-time and visible in the minor's main interface, such as a persistent icon. Transactional, safety and requested notifications stay allowed. If a business's own testing or analytics show a feature materially raises engagement, the draft presumes it leads to compulsive use, and the business must rebut that with clear and convincing evidence. The Attorney General's hearing slides stress that a feature does not breach the rule merely because a young person uses a service more.

Age assurance (26P028). We could not open this draft, so this summary relies on the official notice and published comments. The notice says the rule requires the least intrusive method reasonably available that gives the confidence needed, with requirements on data protection, accuracy, fallback options, appeals and documentation. The Future of Privacy Forum reads it as graduated escalation, with moderate and higher-intrusion methods used only where lower-intrusion ones fall short. According to NetChoice, it also requires proportionate age assurance on any service reasonably likely to be accessed by covered minors, an eight-factor assessment before deployment, periodic re-review, and a presumption of non-compliance where documentation is missing.

NetChoice's comments, dated 29 September, argue the drafts exceed the authority the legislature delegated and ask for at least 12 months after adoption to comply. Whether the adopted rules keep the feed, autoplay and streak bans is the biggest open question for product teams.

Enforcement and exposure

Under § 2449h, a covered business or processor that breaks the subchapter or its rules commits an unfair and deceptive act under 9 V.S.A. § 2453, and the Attorney General has its usual Consumer Protection Act powers: rules, civil investigations, civil actions and assurances of discontinuance. A court can impose a civil penalty of up to $10,000 for each unfair or deceptive act or practice. The act sets no cure period. It does not mention private lawsuits, but Vermont's Consumer Protection Act already lets an injured consumer sue for damages, fees and exemplary damages, so ask counsel how that applies. Section 2449i says nothing in the code imposes liability inconsistent with 47 U.S.C. § 230.

How Vermont compares with California and South Carolina

Litigation over earlier design codes shaped Vermont's drafting, and the court record is the best guide to where Vermont may be tested. The table draws on the three statutes and the case records cited in this section.

California. In NetChoice v. Bonta, the Ninth Circuit on 12 March 2026 lifted the injunction against the act as a whole and its age-estimation provision, but kept four data-use restrictions and the dark-patterns ban enjoined as too vague, because they turn on material detriment and the best interests of children. The impact-assessment and notice-and-cure provisions stay enjoined. DLA Piper reads the ruling as leaving high-privacy defaults, monitoring signals and geolocation limits outside any injunction. The case is back in the district court.

California SB 976. From 1 January 2027, an operator of an addictive service may show an addictive feed, or send notifications during set night and school hours, to a California user only if it actually knows the user is not a minor, reasonably determines that, or has verifiable parental consent. The Department of Justice published proposed age-assurance regulations on 15 May 2026, and comments closed on 30 June. Its rulemaking page said on 12 November that it is still reviewing comments, with Office of Administrative Law review to follow. NetChoice filed an amended complaint in its challenge on 13 October 2026.

South Carolina. Act 96 took effect on signature on 5 February 2026. It requires an independent audit report by 1 July each year, tools for all users to disable covered design features, treble damages, and personal liability for officers and employees in wilful and wanton cases. NetChoice sued on 9 February 2026; its case page lists only the complaint.

Vermont's statute avoids the phrases that sank California's data-use rules: no best-interests standard, no impact assessment, and content alone cannot establish harm. So far, critics have aimed at the rules instead.

Where this sits next to app store and age-signal laws

Three US models land in 2027. App store accountability acts make the store verify age and collect parental consent: Alabama's applies from 1 January 2027 and Louisiana's from 1 July 2027. Our App Store Accountability Act guide covers both. California's Digital Age Assurance Act (AB 1043), operative on 1 January 2027, makes operating system providers send developers an age-bracket signal; see our AB 1043 developer checklist. Vermont's code governs how your service behaves once you know, or are expected to determine, that a user is a minor.

They interlock. A store or operating system signal saying a Vermont user is 13 to 15 likely gives you the actual knowledge that makes that user a covered minor. One age-signal service feeding per-state policy is the sensible design, and Vermont's statute asks the Attorney General to weigh reuse of existing data and interoperable methods. Apple's Declared Age Range framework lets people share an age range with an app, and Google's Play Age Signals API, still in beta, returns signals only in some jurisdictions so far. Our 2027 compliance calendar for software teams lists the other US state dates.

Decision table: what changes for your product

Worked example: a teen-heavy fitness app

Take a hypothetical US fitness app with 1.2 million monthly active users, 85 percent of revenue from app store subscriptions, and a 2026 in-app survey showing 5 percent of users are aged 13 to 17. Five percent is above 2 percent, so the internal-research indicator puts it in scope.

Analytics shows 2,400 Vermont accounts. Users enter a date of birth at sign-up; assume 5 percent of them, 2,400 x 0.05 = 120 accounts, give an age under 18. The business actually knows those 120 are minors, so they are covered minors from 1 January 2027. The feature audit finds six changes:

1. 8 pm streak reminder push: off by default for the 120; the draft rule would remove streaks for them.

1. Leaderboard with likes: if social interaction is the app's main purpose, it is a social media platform and known adults cannot see or like a minor's posts by default. If not, the social-media defaults fall away, but the location, indexing and push defaults still apply.

1. For You workout feed: replace with followed coaches, chosen categories and search.

1. Route sharing: location hidden by default.

1. Parent dashboard: a persistent indicator in the teen's interface while it runs.

1. Date-of-birth gate: keep it as the low-intrusion step, add an appeal route, delete age-check data after the decision, and document why the method is proportionate.

For the other 2,400 - 120 = 2,280 Vermont accounts, option A applies minor mode to every unconfirmed account: simple, but it changes the product for adults, and the draft still expects proportionate age assurance. Option B reuses platform age signals where Apple and Google return them and adds estimation only for flagged accounts, which fits the draft's graduated model.

The act does not say how violations are counted. Purely as an illustration, counting each covered minor once at the $10,000 statutory ceiling gives 120 x $10,000 = $1,200,000. Any real figure would be set by the Attorney General and the courts.

Checklist for 1 January 2027

1. Run the five-part scope test and record the audience evidence and revenue mix.

1. Map age knowledge: sign-up, store and operating system signals, support tickets, marketing segments.

1. Build a covered-minor flag keyed to Vermont residence plus knowledge or an age-assurance label.

1. Ship the eight defaults, remove all-in-one less-private toggles, and add the 15-day delete flow.

1. Gate feeds to express requests, settings and search.

1. Gate notifications: default off, a midnight to 6 am block, and a transactional and safety allowlist.

1. Add monitoring signals to parent or guardian tracking.

1. Publish transparency pages for recommenders and per-feature data use.

1. Isolate age-assurance data and add an appeal route.

1. Put engagement features named in the draft rule behind per-state flags, and track the adopted rules.

If you also serve UK users, see our piece on the Online Safety Act in 2027.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our age assurance and app compliance service builds covered-minor flags, platform age-signal integrations, default settings and notification curfews behind per-state feature flags, for your counsel to review. Talk to us at /contact-us/.

Last updated: 12 November 2026.

References

1. S.69 (Act 63), an act relating to an age-appropriate design code: bill status and statutes affected — Vermont General Assembly

1. Act 63 (S.69) as enacted, an act relating to an age-appropriate design code — Vermont General Assembly

1. 9 V.S.A. § 2458, restraining prohibited acts — Vermont General Assembly

1. Proposed rule 26P027, Prohibited Data and Design Practices — Vermont Secretary of State Rules Service

1. Litigation Center — NetChoice

1. Proposed rule 26P028, Age Assurance Privacy — Vermont Secretary of State Rules Service

1. Vermont Age-Appropriate Design Code rulemaking — Office of the Vermont Attorney General

1. Age-Appropriate Design Code rulemaking feedback — Office of the Vermont Attorney General

1. Vermont and Nebraska: diverging experiments in state age-appropriate design codes, 4 June 2025 — Future of Privacy Forum

1. Act 145 (S.71) as enacted, an act relating to consumer data privacy and online surveillance — Vermont General Assembly

1. Draft rule under 9 V.S.A. § 2449f, prohibited data and design practices, 8 July 2026 — Office of the Vermont Attorney General

1. Age-Appropriate Design Code: public hearing on proposed rules (slides) — Office of the Vermont Attorney General

1. Comments on Vermont Age-Appropriate Design Code rulemaking, 2 October 2026 — Future of Privacy Forum

1. NetChoice comments for the record on the proposed rules implementing Vermont's Age-Appropriate Design Code, 29 September 2026 — NetChoice

1. 9 V.S.A. § 2461, civil penalty — Vermont General Assembly

1. The Ninth Circuit's latest CAADCA ruling: navigating an evolving compliance landscape, 26 March 2026 — DLA Piper

1. Civil Code § 1798.99.30, California Age-Appropriate Design Code Act definitions — California Legislative Information

1. H.3431, South Carolina Social Media Regulation Act, text — South Carolina General Assembly

1. H.3431 bill history (Act 96 of 2026) — South Carolina General Assembly

1. NetChoice v. Bonta (California AADC) case page — NetChoice

1. Notice of proposed rulemaking, Protecting Our Kids from Social Media Addiction Act regulations, 15 May 2026 — California Department of Justice

1. SB 976 regulations rulemaking page — California Department of Justice

1. NetChoice v. Bonta (California SB 976) case page — NetChoice

1. NetChoice v. Wilson (South Carolina) case page — NetChoice

1. HB 161 enrolled, App Store Accountability Act — Alabama Legislature

1. Act No. 185 (HB 977), 2026 Regular Session, enrolled — Louisiana State Legislature

1. Declared Age Range — Apple Developer Documentation

1. Play Age Signals overview — Android Developers