VT H0210

Covered businesses with online services reasonably likely to be accessed by minors (under 18) must configure default privacy settings to the highest level, including hiding minor accounts from adult users, disabling direct messaging with adults, disabling location sharing, and turning off push notifications unless the minor expressly opts in

Businesses are prohibited from collecting, selling, or retaining personal data of minors beyond what is necessary for the service, using personal data for algorithmic recommendations (with limited exceptions for explicit user requests), or sending push notifications to minors between 12:00 a.m. and 6:00 a.m.

Covered businesses owe a "minimum duty of care" to minors, meaning their data use and service design must not result in reasonably foreseeable emotional distress, compulsive use, or discrimination based on protected characteristics

The Attorney General must adopt rules by July 1, 2027 establishing commercially reasonable age assurance methods, and has authority to prohibit design practices that lead to compulsive use or impair user autonomy, with rules reviewed at least every two years

Violations constitute unfair and deceptive acts in commerce enforceable by the Attorney General; the act takes effect July 1, 2026