Vermont has joined the list of states attempting to regulate the use of children’s information collected online, passing an Age-Appropriate Design Code Act. This law mirrors ones we have seen in other US states as well as the UK, and applies to online services reasonably accessed by minors, that collect personal data. We expect it to be challenged, but if it is not, it would go into effect January 1. Among other things, the law provides the following:
- Prohibited practices: Covered businesses will only be able to collect, use, or keep minor’s personal data if it is needed for a service the minor is actively using. They will be prohibited from using this data for new or additional purposes, or from enabling third-party tracking without providing notice and consent. Additionally, they will be limited in the content recommendations they can make to minors based on minors’ data. Finally, covered businesses will not be able to send push notifications to minors between midnight and 6 a.m.
- Age verification: The attorney general will be tasked with developing a process and rules for determining if someone is a minor. Covered businesses that collect information as part of the process will need to keep it to the minimum necessary to confirm a user’s age and use it only for verification. They will also need to delete the data (except for the age range) after verification. Covered business will need to give minors an appeal process if their age has been determined incorrectly.
- Privacy settings: Covered businesses will need to set the highest privacy settings for minors by default. This includes not letting adults see a minor’s posts and locations unless the minor clearly allows it. It also means not letting adults comment on or message minors without permission and not sending push notices to minors. Under the law, search engines will also be prohibited from indexing minors’ profiles. Businesses will also need to give minors an easy way to delete their accounts and process the request within 15 days. They also need to ensure that their use of minors’ data and the design of their platforms do not cause minors emotional distress or result in compulsive use, among other things.
- Be transparent: Covered businesses will need to clearly display privacy policies and terms of service and make them easily accessible to users. Additionally, businesses will need to explain how any algorithmic recommendations work. This includes giving details about data collection, use, sharing, and data retention for features targeted at minors.
Putting it Into Practice: While we anticipate that this law will be challenged, it is a reminder that US states continue to attempt to regulate social media platforms’ interactions with children. Companies may want to keep the concepts of these laws, which include default privacy settings and data minimization, in mind when developing interactive platforms that might be accessed by minors.