S 69 — An act relating to an age-appropriate design code

BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 1 of 2325 S.69 AnIntroduced actby relatingSenators toHarrison, anBongartz, age-appropriateBrennan, designClarkson, codeCollamore, ItCummings, isHashim, herebyLyons, enactedMajor, byPerchlik, thePlunkett, GeneralWatson, AssemblyWeeks, ofWestman theand StateWhite ofReferred Vermont:to Committee on Institutions Date:

February 13, 2025 Subject:

Commerce and trade;

protection of personal information;

privacy of minors Statement of purpose of bill as introduced:

This bill proposes to require that any covered business that develops and provides online services, products, or features that children are reasonably likely to access must not use abusive or privacy-invasive design features on children.

An act relating to an age-appropriate design code It is hereby enacted by the General Assembly of the State of Vermont:

Vermont Age-Appropriate Design Code Act §§ 2449a. 2449a.

BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 2 of 25 (1)(A) “Affiliate” means a legal entity that shares common branding with another legal entity or controls, is controlled by, or is under common control with another legal entity.

VT LEG #381718 v.1 AS PASSED BY SENATE S.69 Page 2 of 23 (3) “Algorithmic recommendation system” means a system that uses an algorithm to select, filter, and arrange media on a covered business’s website for the purpose of selecting, recommending, or prioritizing media for a user.

BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 3 of 25 (i) iris or retina scans;

VT LEG #381718 v.1 AS PASSED BY SENATE S.69 Page 3 of 23 (5) “Business associate” has the same meaning as in theHIPAA. Health Insurance Portability and Accountability Act of 1996, Pub.

(5) “Business associate” has the same meaning as in the Health Insurance Portability and Accountability Act of 1996, Pub.

(7) “Compulsive use” means the repetitive use of a covered business’s service that materially disrupts one or more major life activities of a minor, BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 4 of 25 including sleeping, eating, learning, reading, concentrating, communicating, or working.

VT LEG #381718 v.1 AS PASSED BY SENATE S.69 Page 4 of 23 (10) “Controller” means a person who, alone or jointly with others, determines the purpose and means of processing personal data.

(11) “Covered business” means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof, that conducts business in this State and whose online products, services, or features are reasonably likely to be accessed by a minor and that:

(A) collects consumers’ personal data or has consumers’ personal data collected on its behalf by a processor;

and BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 5 of 25 (B) alone or jointly with others determines the purposes and means of the processing of consumers personal data.

VT LEG #381718 v.1 AS PASSED BY SENATE S.69 Page 5 of 23 (15) “De-identified data” means data that does not identify and cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to the individual, if the covered business that possesses the data:

(A)(i) takes reasonable measures to ensure that the data cannot be used to reidentify an identified or identifiable individual or be associated with BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 6 of 25 an individual or device that identifies or is linked or reasonably linkable to an individual or household;

§§ 164.514 164.514 (other requirements relating to uses and disclosures of protected health information);

VT LEG #381718 v.1 AS PASSED BY SENATE S.69 Page 6 of 23 (17) “Genetic data” means any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material, including deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), epigenetic markers, BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 7 of 25 uninterpreted data that results from analysis of the biological sample or other source, and any information extrapolated, derived, or inferred therefrom.

VT LEG #381718 v.1 AS PASSED BY SENATE S.69 Page 7 of 23 (22) “Online service, product, or feature” means a digital product that is accessible to the public via the internet, including a website or application, and does not mean any of the following:

§§ 153; 153;

§§ 54.400; 54.400;

BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 8 of 25 (23)(A) “Personal data” means any information, including derived data and unique identifiers, that is linked or reasonably linkable to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household.

VT LEG #381718 v.1 AS PASSED BY SENATE S.69 Page 8 of 23 (ii) data generated by or connected to an advanced utility metering infrastructure system;

(25) “Process” or “processing” means any operation or set of operations performed, whether by manual or automated means, on personal data or on BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 9 of 25 sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, modification, or otherwise handling of personal data.

VT LEG #381718 v.1 AS PASSED BY SENATE S.69 Page 9 of 23 (i) biometric data collected by a business about a consumer without the consumer’s knowledge;

BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 10 of 25 (iv) an inference that is generated from the information described in subdivision (ii) or (iii) of this subdivision (28)(B);

§§ 1460; 1460;

or VT LEG #381718 v.1 AS PASSED BY SENATE S.69 Page 10 of 23 (x) intimate images, authentic or computer-generated, known to be nonconsensual.

BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 11 of 25 (A) the online service, product, or feature is directed to children, as defined by the Children’s Online Privacy Protection Act, 15 U.S.C.

§§§§ 6501– 6501– 6506 and the Federal Trade Commission rules implementing that Act;

or (E) the covered business knew or should have known that at least two percent of the audience of the online service, product, or feature includes minors two through 17 years of age, provided that, in making this assessment, the business shall not collect or process any personal data that is not reasonably VT LEG #381718 v.1 AS PASSED BY SENATE S.69 Page 11 of 23 necessary to provide an online service, product, or feature with which a minor is actively and knowingly engaged.

BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 12 of 25 (A) reveals a consumer’s government-issued identifier, such as a Social Security number, passport number, state identification card, or driver’s license number, that is not required by law to be publicly displayed;

(G) is collected and analyzed concerning consumer health data that describes or reveals a past, present, or future mental or physical health condition, treatment, disability, or diagnosis, including pregnancy, to the extent VT LEG #381718 v.1 AS PASSED BY SENATE S.69 Page 12 of 23 the personal data is used by the controller for a purpose other than to identify a specific consumer’s physical or mental health condition or diagnosis;

BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 13 of 25 (I) is collected from a covered minor;

VT LEG #381718 v.1 AS PASSED BY SENATE S.69 Page 13 of 23 (i) exclusively provides email or direct messaging services;

(ii) primarily consists of news, sports, entertainment, interactive video games, electronic commerce, or content that is preselected by the BILL AS INTRODUCED AND PASSED BY SENATE S.69 Page 14 of 25 provider for which any interactive functionality is incidental to, directly related to, or dependent on the provision of such content;