FPF Urges Vermont to Clarify Age-Appropriate Design Code Rules

What the Vermont law requires

Vermont enacted its Age-Appropriate Design Code Act in June 2025. According to FPF, the framework sets a minimum duty of care for businesses whose digital products and services are reasonably likely to be used by minors. It also requires high default privacy settings and mandates disclosure of algorithmic recommendation systems.

The law includes a data minimization standard for minors who are "actively and knowingly engaged" with a service. Businesses also have the option to use age assurance to identify minor users. FPF notes that a handful of states have signed Age-Appropriate Design Codes into law, but Vermont is the first to move to draft rules.

The rulemaking process

The Vermont Attorney General's Office launched a formal rulemaking in July 2026. It covers two areas. The first is data processing and design practice prohibitions that lead to "compulsive use" or "impair user autonomy, decision making, or choice." The second is "commercially reasonable and technically feasible" age assurance methods, appropriate review processes for age appeals, and additional privacy protections for age assurance data.

The law and the adopted rules will take effect on January 1, 2027. FPF submitted its comments on October 2, saying it wants the regulations to clarify compliance ambiguities while supporting interoperability with existing privacy frameworks.

FPF's seven recommendations

FPF grouped its recommendations under prohibited data and design practices, personalization and compulsive use, and age assurance. It asked the Office to consider the following:

• Clarify that certain administrative and technical functions are "necessary to provide a service."
• Align secondary use requirements with existing privacy laws.
• Clarify rules and restrictions on online service personalization to preserve necessary or beneficial practices.
• Clarify rules on compulsive use by providing metrics for what constitutes unacceptable engagement.
• Clarify that graduated escalation is a factor for businesses to consider when selecting appropriate age assurance methods.
• Define clear technical thresholds or standards to assess what constitutes a "material risk of misclassification."
• Consult comparable state agency rulemaking processes for age assurance when considering adjustments or clarifications to the proposed rule.

What it means for businesses

With the rules due to take effect together with the law on January 1, 2027, the final text will shape how companies serving minors in Vermont interpret terms such as compulsive use and material risk of misclassification. FPF's recommendations point to areas where it sees unclear wording, including what counts as unacceptable engagement and how age assurance errors are judged. Because Vermont is the first state to propose draft rules under this framework, its approach may also be a reference point for other states, as FPF's suggestion to consult comparable rulemaking processes indicates.