Vermont § 2449f - Prohibited data and design practices [Effective January 1, 2027] [Subsection

§ 2449f. Prohibited data and design practices [Effective January 1, 2027] [Subsection

• (a) effective January 1, 2027.] (a) Data privacy. A covered business shall not: (1) collect, sell, share, or retain any personal data of a covered minor that is not necessary
  to provide an online service, product, or feature with which the covered minor is
  actively and knowingly engaged; (2) use previously collected personal data of a covered minor for any purpose other than
  a purpose for which the personal data was collected, unless necessary to comply with
  any obligation under this chapter; (3) permit any individual, including a parent or guardian of a covered minor, to monitor
  the online activity of a covered minor or to track the location of the covered minor
  without providing a conspicuous signal to the covered minor when the covered minor
  is being monitored or tracked; (4) use the personal data of a covered minor to select, recommend, or prioritize media
  for the covered minor, unless the personal data is: (A) the covered minor’s express and unambiguous request to receive: (i) media from a specific account, feed, or user, or to receive more or less media from
  that account, feed, or user; (ii) a specific category of media, such as “cat videos” or “breaking news,” or to see more
  or less of that category of media; or (iii) more or less media with similar characteristics as the media they are currently viewing; (B) user-selected privacy or accessibility settings; or (C) a search query, provided the search query is only used to select and prioritize media
  in response to the search; or (5) send push notifications to a covered minor between 12:00 midnight and 6:00 a.m. (b) Rulemaking. The Attorney General shall, on or before January 1, 2027, adopt rules pursuant to
  this subchapter that prohibit data processing or design practices of a covered business
  that, in the opinion of the Attorney General, lead to compulsive use or subvert or
  impair user autonomy, decision making, or choice during the use of an online service,
  product, or feature of the covered business. The Attorney General shall, at least
  once every two years, review and update these rules as necessary to keep pace with
  emerging technology. (Added 2025, No. 63, § 1, eff. January 1, 2027.)