BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page1of25
S.69
IntroducedbySenatorsHarrison,Bongartz,Brennan,Clarkson,Collamore,
Cummings,Hashim,Lyons,Major,Perchlik,Plunkett,Watson,
Weeks,WestmanandWhite
ReferredtoCommitteeonInstitutions
Date:February13,2025
Subject:Commerceandtrade;protectionofpersonalinformation;privacyof
minors
Statementofpurposeofbillasintroduced:Thisbillproposestorequirethat
anycoveredbusinessthatdevelopsandprovidesonlineservices,products,or
featuresthatchildrenarereasonablylikelytoaccessmustnotuseabusiveor
privacy-invasivedesignfeaturesonchildren.
Anactrelatingtoanage-appropriatedesigncode
ItisherebyenactedbytheGeneralAssemblyoftheStateofVermont:
Sec.1.9V.S.A.chapter62,subchapter6isaddedtoread:
Subchapter6.VermontAge-AppropriateDesignCodeAct
§ 2449a.DEFINITIONS
Asusedinthissubchapter:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page2of25
(1)(A)“Affiliate”meansalegalentitythatsharescommonbranding
withanotherlegalentityorcontrols,iscontrolledby,orisundercommon
controlwithanotherlegalentity.
(B)Asusedinsubdivision(A)ofthissubdivision(1),“control”or
“controlled”means:
(i)ownershipof,orthepowertovote,morethan50percentofthe
outstandingsharesofanyclassofvotingsecurityofacompany;
(ii)controlinanymannerovertheelectionofamajorityofthe
directorsorofindividualsexercisingsimilarfunctions;or
(iii)thepowertoexercisecontrollinginfluenceoverthe
managementofacompany.
(2)“Ageassurance”encompassesarangeofmethodsusedtodetermine,
estimate,orcommunicatetheageoranagerangeofanonlineuser.
(3)“Algorithmicrecommendationsystem”meansasystemthatusesan
algorithmtoselect,filter,andarrangemediaonacoveredbusiness’swebsite
forthepurposeofselecting,recommending,orprioritizingmediaforauser.
(4)(A)“Biometricdata”meansdatageneratedfromthetechnological
processingofanindividual’suniquebiological,physical,orphysiological
characteristicsthatalloworconfirmtheuniqueidentificationoftheconsumer,
including:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page3of25
(i)irisorretinascans;
(ii)fingerprints;
(iii)facialorhandmapping,geometry,ortemplates;
(iv)veinpatterns;
(v)voiceprintsorvocalbiomarkers;and
(vi)gaitorpersonallyidentifyingphysicalmovementorpatterns.
(B)“Biometricdata”doesnotinclude:
(i)adigitalorphysicalphotograph;
(ii)anaudioorvideorecording;or
(iii)anydatageneratedfromadigitalorphysicalphotograph,or
anaudioorvideorecording,unlesssuchdataisgeneratedtoidentifyaspecific
individual.
(5)“Businessassociate”hasthesamemeaningasinHIPAA.
(5)“Businessassociate”hasthesamemeaningasintheHealth
InsurancePortabilityandAccountabilityActof1996,Pub.L.No.104-191
(HIPAA).
(6)“Collect”meansbuying,renting,gathering,obtaining,receiving,or
accessinganypersonaldatabyanymeans.Thisincludesreceivingdatafrom
theconsumer,eitheractivelyorpassively,orbyobservingtheconsumer’s
behavior.
(7)“Compulsiveuse”meanstherepetitiveuseofacoveredbusiness’s
servicethatmateriallydisruptsoneormoremajorlifeactivitiesofaminor,
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page4of25
includingsleeping,eating,learning,reading,concentrating,communicating,or
working.
(8)(A)“Consumer”meansanindividualwhoisaresidentoftheState.
(B)“Consumer”doesnotincludeanindividualactingina
commercialoremploymentcontextorasanemployee,owner,director,officer,
orcontractorofacompany,partnership,soleproprietorship,nonprofit,or
governmentagencywhosecommunicationsortransactionswiththecovered
businessoccursolelywithinthecontextofthatindividual’srolewiththe
company,partnership,soleproprietorship,nonprofit,orgovernmentagency.
(9)“Consumerhealthdata”meansanypersonaldatathatacontroller
usestoidentifyaconsumer’sphysicalormentalhealthconditionordiagnosis,
includinggender-affirminghealthdataandreproductiveorsexualhealthdata.
(10)“Controller”meansapersonwho,aloneorjointlywithothers,
determinesthepurposeandmeansofprocessingpersonaldata.
(11)“Coveredbusiness”meansasoleproprietorship,partnership,
limitedliabilitycompany,corporation,association,otherlegalentity,oran
affiliatethereof,thatconductsbusinessinthisStateandwhoseonline
products,services,orfeaturesarereasonablylikelytobeaccessedbyaminor
andthat:
(A)collectsconsumers’personaldataorhasconsumers’personal
datacollectedonitsbehalfbyaprocessor;and
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page5of25
(B)aloneorjointlywithothersdeterminesthepurposesandmeans
oftheprocessingofconsumerspersonaldata.
(11)“Coveredbusiness”meansasoleproprietorship,partnership,
limitedliabilitycompany,corporation,association,otherlegalentity,oran
affiliatethereof:
(A)thatconductsbusinessinthisState;
(B)thatgeneratesamajorityofitsannualrevenuefromonline
services;
(C)whoseonlineproducts,services,orfeaturesarereasonablylikely
tobeaccessedbyaminor;
(D)thatcollectsconsumers’personaldataorhasconsumers’
personaldatacollectedonitsbehalfbyaprocessor;and
(E)thataloneorjointlywithothersdeterminesthepurposesand
meansoftheprocessingofconsumerspersonaldata.
(12)“Coveredentity”hasthesamemeaningasinHIPAA.
(13)“Coveredminor”isaconsumerwhoacoveredbusinessactually
knowsisaminororlabelsasaminorpursuanttoageassurancemethodsin
rulesadoptedbytheAttorneyGeneral.
(14)“Default”meansapreselectedoptionadoptedbythecovered
businessfortheonlineservice,product,orfeature.
(15)“De-identifieddata”meansdatathatdoesnotidentifyandcannot
reasonablybeusedtoinferinformationabout,orotherwisebelinkedto,an
identifiedoridentifiableindividual,oradevicelinkedtotheindividual,ifthe
coveredbusinessthatpossessesthedata:
(A)(i)takesreasonablemeasurestoensurethatthedatacannotbe
usedtoreidentifyanidentifiedoridentifiableindividualorbeassociatedwith
1
2
3
4
5
6
7
8
9
10
11
12
13
14 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page6of25
anindividualordevicethatidentifiesorislinkedorreasonablylinkabletoan
individualorhousehold;and
(ii)forpurposesofthissubdivision(A),“reasonablemeasures”
includesthede-identificationrequirementssetforthunder45C.F.R.§ 164.514
(otherrequirementsrelatingtousesanddisclosuresofprotectedhealth
information);
(B)publiclycommitstoprocessthedataonlyinade-identified
fashionandnotattempttoreidentifythedata;and
(C)contractuallyobligatesanyrecipientsofthedatatocomplywith
allprovisionsofthissubchapter.
(16)“Deriveddata”meansdatathatiscreatedbythederivationof
information,data,assumptions,correlations,inferences,predictions,or
conclusionsfromfacts,evidence,oranothersourceofinformationordata
aboutaminororaminor’sdevice.
(17)“Geneticdata”meansanydata,regardlessofitsformat,thatresults
fromtheanalysisofabiologicalsampleofanindividual,orfromanother
sourceenablingequivalentinformationtobeobtained,andconcernsgenetic
material,includingdeoxyribonucleicacids(DNA),ribonucleicacids(RNA),
genes,chromosomes,alleles,genomes,alterationsormodificationstoDNAor
RNA,singlenucleotidepolymorphisms(SNPs),epigeneticmarkers,
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page7of25
uninterpreteddatathatresultsfromanalysisofthebiologicalsampleorother
source,andanyinformationextrapolated,derived,orinferredtherefrom.
(18)“Identifiedoridentifiableindividual”meansanindividualwhocan
bereadilyidentified,directlyorindirectly,includingbyreferencetoan
identifiersuchasaname,anidentificationnumber,specificgeolocationdata,
oranonlineidentifier.
(19)“Knownadult”isaconsumerwhoacoveredbusinessactually
knowsisanadultorlabelsasanadultpursuanttoageassurancemethodsin
rulesadoptedbytheAttorneyGeneral.
(20)“Minor”meansanindividualunder18yearsofagewhoisa
residentoftheState.
(21)“Neuraldata”meansinformationthatiscollectedthrough
biosensorsandthatcouldbeprocessedtoinferorpredictmentalstates.
(22)“Onlineservice,product,orfeature”meansadigitalproductthatis
accessibletothepublicviatheinternet,includingawebsiteorapplication,and
doesnotmeananyofthefollowing:
(A)telecommunicationsservice,asdefinedin47U.S.C.§ 153;
(B)abroadbandinternetaccessserviceasdefinedin47C.F.R.
§ 54.400;or
(C)thesale,delivery,oruseofaphysicalproduct.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page8of25
(23)(A)“Personaldata”meansanyinformation,includingderiveddata
anduniqueidentifiers,thatislinkedorreasonablylinkabletoanidentifiedor
identifiableindividualortoadevicethatidentifies,islinkedto,oris
reasonablylinkabletooneormoreidentifiedoridentifiableindividualsina
household.
(B)Personaldatadoesnotincludede-identifieddataorpublicly
availableinformation.
(24)(A)“Precisegeolocationdata”meansinformationderivedfrom
technologythatrevealsthepastorpresentphysicallocationofaconsumeror
devicethatidentifiesorislinkedorreasonablylinkabletooneormore
consumerswithprecisionandaccuracywithinaradiusof1,850feet.
(B)“Precisegeolocationdata”doesnotinclude:
(i)thecontentofcommunications;
(ii)datageneratedbyorconnectedtoanadvancedutilitymetering
infrastructuresystem;
(iii)aphotograph,ormetadataassociatedwithaphotographor
video,thatcannotbelinkedtoanindividual;or
(iv)datageneratedbyequipmentusedbyautilitycompany.
(25)“Process”or“processing”meansanyoperationorsetofoperations
performed,whetherbymanualorautomatedmeans,onpersonaldataoron
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page9of25
setsofpersonaldata,suchasthecollection,use,storage,disclosure,analysis,
deletion,modification,orotherwisehandlingofpersonaldata.
(26)“Processor”meansapersonwhoprocessespersonaldataonbehalf
ofacoveredbusiness.
(27)“Profiling”meansanyformofautomatedprocessingperformedon
personaldatatoevaluate,analyze,orpredictpersonalaspectsrelatedtoan
identifiedoridentifiableindividual’seconomicsituation,health,personal
preferences,interests,reliability,behavior,location,ormovements.
(28)(A)“Publiclyavailableinformation”meansinformationthat:
(i)ismadeavailablethroughfederal,state,orlocalgovernment
records;or
(ii)acontrollerhasareasonablebasistobelievethattheconsumer
haslawfullymadeavailabletothegeneralpublic.
(B)“Publiclyavailableinformation”doesnotinclude:
(i)biometricdatacollectedbyabusinessaboutaconsumer
withouttheconsumer’sknowledge;
(ii)informationthatiscollatedandcombinedtocreatea
consumerprofilethatismadeavailabletoauserofapubliclyavailable
websiteeitherinexchangeforpaymentorfreeofcharge;
(iii)informationthatismadeavailableforsale;
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page10of25
(iv)aninferencethatisgeneratedfromtheinformationdescribed
insubdivision(ii)or(iii)ofthissubdivision(28)(B);
(v)anyobscenevisualdepiction,asdefinedin18U.S.C.§ 1460;
(vi)anyinferencemadeexclusivelyfrommultipleindependent
sourcesofpubliclyavailableinformationthatrevealssensitivedatawith
respecttoaconsumer;
(vii)personaldatathatiscreatedthroughthecombinationof
personaldatawithpubliclyavailableinformation;
(viii)geneticdata,unlessotherwisemadepubliclyavailableby
theconsumertowhomtheinformationpertains;
(ix)informationprovidedbyaconsumeronawebsiteoronline
servicemadeavailabletoallmembersofthepublic,forfreeorforafee,
wheretheconsumerhasmaintainedareasonableexpectationofprivacyinthe
information,suchasbyrestrictingtheinformationtoaspecificaudience;or
(x)intimateimages,authenticorcomputer-generated,knownto
benonconsensual.
(29)“Reasonablylikelytobeaccessed”meansanonlineservice,
product,orfeaturethatisreasonablylikelytobeaccessedbyacoveredminor
basedonanyofthefollowingindicators:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page11of25
(A)theonlineservice,product,orfeatureisdirectedtochildren,as
definedbytheChildren’sOnlinePrivacyProtectionAct,15U.S.C.§§ 6501–
6506andtheFederalTradeCommissionrulesimplementingthatAct;
(B)theonlineservice,product,orfeatureisdetermined,basedon
competentandreliableevidenceregardingaudiencecomposition,tobe
routinelyaccessedbyanaudiencethatiscomposedofatleasttwopercent
minorstwothrough17yearsofage;
(C)theonlineservice,product,orfeaturecontainsadvertisements
marketedtominors;
(D)theaudienceoftheonlineservice,product,orfeatureis
determined,basedoninternalcompanyresearch,tobecomposedofatleast
twopercentminorstwothrough17yearsofage;or
(E)thecoveredbusinesskneworshouldhaveknownthatatleast
twopercentoftheaudienceoftheonlineservice,product,orfeatureincludes
minorstwothrough17yearsofage,providedthat,inmakingthisassessment,
thebusinessshallnotcollectorprocessanypersonaldatathatisnot
reasonablynecessarytoprovideanonlineservice,product,orfeaturewith
whichaminorisactivelyandknowinglyengaged.
(30)“Sensitivedata”meanspersonaldatathat:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page12of25
(A)revealsaconsumer’sgovernment-issuedidentifier,suchasa
SocialSecuritynumber,passportnumber,stateidentificationcard,ordriver’s
licensenumber,thatisnotrequiredbylawtobepubliclydisplayed;
(B)revealsaconsumer’sracialorethnicorigin;nationalorigin;
citizenshiporimmigrationstatus;religiousorphilosophicalbeliefs;amental
orphysicalhealthcondition,diagnosis,disability,ortreatment;statusas
pregnant;incomelevelorindebtedness;orunionmembership;
(C)revealsaconsumer’ssexualorientation,sexlife,sexuality,or
statusastransgenderornon-binary;
(D)revealsaconsumer’sstatusasavictimofacrime;
(E)isaconsumer’staxreturnandaccountnumber,financialaccount
log-in,financialaccount,debitcardnumber,orcreditcardnumberin
combinationwithanyrequiredsecurityoraccesscode,password,or
credentialsallowingaccesstoanaccount;
(F)isconsumerhealthdata;
(G)iscollectedandanalyzedconcerningconsumerhealthdatathat
describesorrevealsapast,present,orfuturementalorphysicalhealth
condition,treatment,disability,ordiagnosis,includingpregnancy,totheextent
thepersonaldataisusedbythecontrollerforapurposeotherthantoidentifya
specificconsumer’sphysicalormentalhealthconditionordiagnosis;
(H)isbiometricorgeneticdata;
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page13of25
(I)iscollectedfromacoveredminor;
(J)isprecisegeolocationdata;
(K)arekeystrokes;
(L)isdrivingbehavior;or
(M)isneuraldata.
(31)(A)“Socialmediaplatform”meansapublicorsemipublicinternet-
basedserviceorapplicationthatisprimarilyintendedtoconnectandallowa
usertosociallyinteractwithinsuchserviceorapplicationandenablesauser
to:
(i)constructapublicorsemipublicprofileforthepurposesof
signingintoandusingsuchserviceorapplication;
(ii)populateapubliclistofotheruserswithwhomtheusershares
asocialconnectionwithinsuchserviceorapplication;or
(iii)createorpostcontentthatisviewablebyotherusers,
includingcontentonmessageboardsandinchatrooms,andthatpresentsthe
userwithcontentgeneratedbyotherusers.
(B)“Socialmediaplatform”doesnotmeanapublicorsemipublic
internet-basedserviceorapplicationthat:
(i)exclusivelyprovidesemailordirectmessagingservices;
(ii)primarilyconsistsofnews,sports,entertainment,interactive
videogames,electroniccommerce,orcontentthatispreselectedbythe
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page14of25
providerforwhichanyinteractivefunctionalityisincidentalto,directly
relatedto,ordependentontheprovisionofsuchcontent;or
(iii)isusedbyandunderthedirectionofaneducationalentity,
includingalearningmanagementsystemorastudentengagementprogram.
(32)“Thirdparty”meansanaturalorlegalperson,publicauthority,
agency,orbodyotherthanthecoveredminororthecoveredbusiness.
§ 2449b.EXCLUSIONS
Thissubchapterdoesnotapplyto:
(1)afederal,state,tribal,orlocalgovernmententityintheordinary
courseofitsoperation;
(2)protectedhealthinformationthatacoveredentityorbusiness
associateprocessesinaccordancewith,ordocumentsthatacoveredentityor
businessassociatecreatesforthepurposeofcomplyingwith,HIPAA;
(3)informationusedonlyforpublichealthactivitiesandpurposes
describedin45C.F.R.§164.512;
(4)informationthatidentifiesaconsumerinconnectionwith:
(A)activitiesthataresubjecttotheFederalPolicyfortheProtection
ofHumanSubjectsassetforthin45C.F.R.Part46;
(B)researchonhumansubjectsundertakeninaccordancewithgood
clinicalpracticeguidelinesissuedbytheInternationalCouncilfor
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page15of25
HarmonisationofTechnicalRequirementsforPharmaceuticalsforHuman
Use;
(C)activitiesthataresubjecttotheprotectionsprovidedin21C.F.R.
Part50and21C.F.R.Part56;or
(D)researchconductedinaccordancewiththerequirementssetforth
insubdivisions(A)–(C)ofthissubdivision(4)orotherwiseinaccordancewith
Stateorfederallaw;and
(5)anentitywhoseprimarypurposeisjournalismasdefinedin
12 V.S.A.§ 1615(a)(2)andthathasamajorityofitsworkforceconsistingof
individualsengaginginjournalism.
§ 2449b.EXCLUSIONS
Thissubchapterdoesnotapplyto:
(1)afederal,state,tribal,orlocalgovernmententityintheordinary
courseofitsoperation;
(2)protectedhealthinformationthatacoveredentityorbusiness
associateprocessesinaccordancewith,ordocumentsthatacoveredentityor
businessassociatecreatesforthepurposeofcomplyingwith,HIPAA;
(3)informationusedonlyforpublichealthactivitiesandpurposes
describedin45C.F.R.§164.512;
(4)informationthatidentifiesaconsumerinconnectionwith:
(A)activitiesthataresubjecttotheFederalPolicyfortheProtection
ofHumanSubjectsassetforthin45C.F.R.Part46;
(B)researchonhumansubjectsundertakeninaccordancewithgood
clinicalpracticeguidelinesissuedbytheInternationalCouncilfor
HarmonisationofTechnicalRequirementsforPharmaceuticalsforHuman
Use;
(C)activitiesthataresubjecttotheprotectionsprovidedin21C.F.R.
Part50and21C.F.R.Part56;or
1
2
3
4
5
6
7
8
9
10 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page16of25
(D)researchconductedinaccordancewiththerequirementssetforth
insubdivisions(A)–(C)ofthissubdivision(4)orotherwiseinaccordancewith
Stateorfederallaw;
(5)anentitywhoseprimarypurposeisjournalismasdefinedin
12 V.S.A.§ 1615(a)(2)andthathasamajorityofitsworkforceconsistingof
individualsengaginginjournalism;
(6)apersonwhocontrolledorprocessedthepersonaldataofnotmore
than:
(A)25,000consumersinthepreviouscalendaryear,excluding
personaldatacontrolledorprocessedsolelyforthepurposeofcompletinga
paymenttransaction;or
(B)50,000consumersinthepreviouscalendaryear,excluding
personaldatacontrolledorprocessedsolelyforthepurposeofcompletinga
paymenttransactionandhadanannualgrossrevenueofnotmorethan
$1,000,000.00inthepreviouscalendaryear;and
(7)afinancialinstitutionordatasubjecttoTitleVoftheGramm-
Leach-BlileyAct,Pub.L.No.106-102,andregulationsadoptedtoimplement
thatact.
§ 2449c.MINIMUMDUTYOFCARE
(a)Acoveredbusinessthatprocessesacoveredminor’sdatainany
capacityowesaminimumdutyofcaretothecoveredminor.
(b)Asusedinthissubchapter,“aminimumdutyofcare”meanstheuseof
thepersonaldataofacoveredminorandthedesignofanonlineservice,
product,orfeaturewillnotresultin:
(1)reasonablyforeseeableemotionaldistressasdefinedin13V.S.A.
§ 1061(2)toacoveredminor;
(2)reasonablyforeseeablecompulsiveuseoftheonlineservice,
product,orfeaturebyacoveredminor; or
1
2
3
4
5
6
7
8
9
10 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page17of25
(3)discriminationagainstacoveredminorbaseduponrace,ethnicity,
sex,disability,sexualorientation,genderidentity,genderexpression,or
nationalorigin.
(c)Thecontentofthemediaviewedbyacoveredminorshallnotestablish
emotionaldistressorcompulsiveuseasthosetermsareusedinsubsection(b)
ofthissection.
(d)Nothinginthissectionshallbeconstruedtorequireacoveredbusiness
topreventorprecludeacoveredminorfromaccessingorviewinganypieceof
mediaorcategoryofmedia.
§ 2449d.REQUIREDDEFAULTPRIVACYSETTINGSANDTOOLS
(a)Defaultprivacysettings.
(1)Acoveredbusinessshallconfigurealldefaultprivacysettings
providedtoacoveredminorthroughtheonlineservice,product,orfeatureto
thehighestlevelofprivacy,includingthefollowingdefaultsettings:
(A)notdisplayingtheexistenceofthecoveredminor’ssocialmedia
accounttoanyknownadultuserunlessthecoveredminorhasexpresslyand
unambiguouslyallowedaspecificknownadultusertoviewtheiraccountor
hasexpresslyandunambiguouslychosentomaketheiraccount’sexistence
public;
(B)notdisplayingmediacreatedorpostedbythecoveredminoron
asocialmediaplatformtoanyknownadultuserunlessthecoveredminorhas
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page18of25
expresslyandunambiguouslyallowedaspecificknownadultusertoview
theirmediaorhasexpresslyandunambiguouslychosentomaketheirmedia
publiclyavailable;
(C)notpermittinganyknownadultuserstolike,commenton,or
otherwiseprovidefeedbackonthecoveredminor’smediaonasocialmedia
platformunlessthecoveredminorhasexpresslyandunambiguouslyalloweda
specificknownadultusertodoso;
(D)notpermittingdirectmessagingonasocialmediaplatform
betweenthecoveredminorandanyknownadultuserunlessthecoveredminor
hasexpresslyandunambiguouslydecidedtoallowdirectmessagingwitha
specificknownadultuser;
(E)notdisplayingthecoveredminor’slocationtootherusers,unless
thecoveredminorexpresslyandunambiguouslysharestheirlocationwitha
specificuser;
(F)notdisplayingtheusersconnectedtothecoveredminorona
socialmediaplatformunlessthecoveredminorexpresslyandunambiguously
choosestosharetheinformationwithaspecificuser;
(G)disablingsearchengineindexingofthecoveredminor’saccount
profile;and
(H)notsendingpushnotificationstothecoveredminors.
(2)Acoveredbusinessshallnot:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page19of25
(A)provideacoveredminorwithasinglesettingthatmakesallof
thedefaultprivacysettingslessprotectiveatonce;or
(B)requestorpromptacoveredminortomaketheirprivacysettings
lessprotective,unlessthechangeisstrictlynecessaryforthecoveredminorto
accessaserviceorfeaturetheyhaveexpresslyandunambiguouslyrequested.
(b)Timelydeletionofaccount.Acoveredbusinessshall:
(1)provideaprominent,accessible,andresponsivetooltoallowa
coveredminortorequestthecoveredminor’ssocialmediaaccountbe
unpublishedordeleted;and
(2)honorthatrequestnotlaterthan15daysafteracoveredbusiness
receivestherequest.
§ 2449e.TRANSPARENCY
(a)Acoveredbusinessshallprominentlyandclearlyprovideontheir
websiteormobileapplication:
(1)thecoveredbusiness’privacyinformation,termsofservice,policies,
andcommunitystandards;
(2)detaileddescriptionsofeachalgorithmicrecommendationsystemin
usebythecoveredbusiness,includingthefactorsusedbythealgorithmic
recommendationsystemandhoweachfactor:
(A)ismeasuredordetermined;
(B)usesthepersonaldataofcoveredminors;
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page20of25
(C)influencestherecommendationissuedbythesystem;and
(D)isweighedrelativetotheotherfactorslistedinthissubdivision
(2);and
(3)descriptions,foreveryfeatureoftheservicethatusesthepersonal
dataofcoveredminors,of:
(A)thepurposeoftheservicefeature;
(B)thepersonaldatacollectedbytheservicefeature;
(C)thepersonaldatausedbytheservicefeature;
(D)howthepersonaldataisusedbytheservicefeature;
(E)anypersonaldatatransferredtoorsharedwithaprocessoror
thirdpartybytheservicefeature,theidentityoftheprocessororthirdparty,
andthepurposeofthetransferorsharing;and
(F)howlongthepersonaldataisretained.
§ 2449f.PROHIBITEDDATAANDDESIGNPRACTICES
(a)Dataprivacy.Acoveredbusinessshallnot:
(1)collect,sell,share,orretainanypersonaldataofacoveredminor
thatisnotnecessarytoprovideanonlineservice,product,orfeaturewith
whichthecoveredminorisactivelyandknowinglyengaged;
(2)usepreviouslycollectedpersonaldataofacoveredminorforany
purposeotherthanapurposeforwhichthepersonaldatawascollected,unless
necessarytocomplywithanyobligationunderthischapter;
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page21of25
(3)permitanyconsumer,includingaparentorguardianofacovered
minor,tomonitortheonlineactivityofacoveredminorortotrackthe
locationofthecoveredminorwithoutprovidingaconspicuoussignaltothe
coveredminorwhenthecoveredminorisbeingmonitoredortracked;
(4)usethepersonaldataofacoveredminortoselect,recommend,or
prioritizemediaforthecoveredminor,unlessthepersonaldatais:
(A)thecoveredminor’sexpressandunambiguousrequesttoreceive:
(i)mediafromaspecificaccount,feed,oruser,ortoreceivemore
orlessmediafromthataccount,feed,oruser;
(ii)aspecificcategoryofmedia,suchas“catvideos”or“breaking
news,”ortoseemoreorlessofthatcategoryofmedia;or
(iii)moreorlessmediawithsimilarcharacteristicsasthemedia
theyarecurrentlyviewing;
(B)user-selectedprivacyoraccessibilitysettings;or
(C)asearchquery,providedthesearchqueryisonlyusedtoselect
andprioritizemediainresponsetothesearch;or
(5)sendpushnotificationstoacoveredminorbetween12:00midnight
and6:00a.m.
(b)Rulemaking.TheAttorneyGeneralshallhavetheauthoritytoadopt
rulespursuanttothissubchapterthatprohibitsdataprocessingordesign
practicesofacoveredbusinessthat,intheopinionoftheAttorneyGeneral,
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page22of25
leadtocompulsiveuseorsubvertorimpairuserautonomy,decisionmaking,
orchoiceduringtheuseofanonlineservice,product,orfeatureofthecovered
business.TheAttorneyGeneralshall,atleastonceeverytwoyears,review
andupdatetheserulesasnecessarytokeeppacewithemergingtechnology.
§ 2449g.AGEASSURANCEPRIVACY
(a)Privacyprotectionsforageassurancedata.Coveredbusinessesand
processorsshall:
(1)onlycollectpersonaldataofauserthatisstrictlynecessaryforage
assurance;
(2)immediatelyupondeterminingwhetherauserisacoveredminor,
deleteanypersonaldatacollectedofthatuserforageassurance,except
whethertheuserisorisnotdeterminedtobeacoveredminor;
(3)notuseanypersonaldataofausercollectedforageassurancefor
anyotherpurpose;
(4)notcombinepersonaldataofausercollectedforageassurancewith
anyotherpersonaldataoftheuser,exceptwhethertheuserisorisnot
determinedtobeacoveredminor;and
(5)implementareviewprocesstoallowuserstoappealtheirage
designation.
(b)Rulemaking.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page23of25
(1)Subjecttosubdivision(2)ofthissubsection,theAttorneyGeneral
shall,onorbeforeJuly1,2027,adoptrulesidentifyingcommercially
reasonableandtechnicallyfeasiblemethodsforcoveredbusinessesand
processorstodetermineifauserisacoveredminor,describingappropriate
reviewprocessesforusersappealingtheiragedesignations,andprovidingany
additionalprivacyprotectionsforageassurancedata.TheAttorneyGeneral
shallperiodicallyreviewandupdatetheserulesasnecessarytokeeppacewith
emergingtechnology.
(2)Inadoptingtheserules,theAttorneyGeneralshall:
(A)prioritizeuserprivacyandaccessibilityovertheaccuracyofage
assurancemethods;and
(B)consider:
(i)thesize,financialresources,andtechnicalcapabilitiesof
coveredbusinessesandprocessors;
(ii)thecostsandeffectivenessofavailableageassurancemethods;
(iii)theimpactofageassurancemethodsonusers’safety,utility,
andexperience;
(iv)whetherandtowhatextenttransparencymeasureswould
increaseconsumertrustinanageassurancemethod;and
(v)theefficacyofrequiringcoveredbusinessesandprocessorsto:
(I)usepreviouslycollecteddatatodetermineuserage;
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page24of25
(II)adoptinteroperableageassurancemethods;and
(III)provideuserswithmultipleoptionsforageassurance.
§ 2449h.ENFORCEMENT
(a)Acoveredbusinessorprocessorthatviolatesthissubchapterorrules
adoptedpursuanttothissubchaptercommitsanunfairanddeceptiveactin
commerceinviolationofsection2453ofthistitle.
(b)TheAttorneyGeneralshallhavethesameauthorityunderthis
subchaptertomakerules,conductcivilinvestigations,bringcivilactions,
andenterintoassurancesofdiscontinuanceasprovidedunderchapter63of
thistitle.
§ 2449i.LIMITATIONS
Nothinginthissubchaptershallbeinterpretedorconstruedto:
(1)imposeliabilityinamannerthatisinconsistentwith47U.S.C.
§ 230;or
(2)preventorprecludeanycoveredminorfromdeliberatelyor
independentlysearchingfor,orspecificallyrequesting,anymedia.
§ 2449j.RIGHTSANDFREEDOMSOFCOVEREDMINORS
ItistheintentoftheGeneralAssemblythatnothinginthissubchaptermay
beconstruedtoinfringeontheexistingrightsandfreedomsofcoveredminors
orbeconstruedtodiscriminateagainstthecoveredminorsbasedonrace,
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20 BILLASINTRODUCEDANDPASSEDBYSENATE S.69
2025 Page25of25
ethnicity,sex,disability,sexualorientation,genderidentity,genderexpression,
ornationalorigin.
Sec.2.EFFECTIVEDATE
ThisactshalltakeeffectonJuly1,2026.
1
2
3
4