Vermont's Draft Rules Would Ban Autoplay, Infinite Scroll and Streaks for Minors
The office announced this week that it will take public comment on those drafts at three hearings in September, with written comments due on or before October 2.
The Vermont Attorney General’s Office has published draft rules that would pull a long list of familiar features out of the apps Vermont teenagers use — automatic video playback, feeds that keep loading as you scroll, streaks, and the likes and badges that mark how a post is doing.
The office announced this week that it will take public comment on those drafts at three hearings in September, with written comments due on or before October 2.
The drafts implement Act 63 of 2025, the Vermont Age-Appropriate Design Code Act, which Gov. Phil Scott signed in June of that year. The law takes effect January 1, 2027. The Legislature gave the Attorney General until that same day to finish the rules.
These are drafts. The Attorney General has not filed them formally, and the hearings exist so the drafts can change. What follows is what they say now, and how that compares with the law the Legislature actually passed.
What the law regulates is the app or the website — not the device it runs on and not the connection it runs over. Act 63 specifically excludes telephone service, broadband service, and physical products. So this is not a phone rule and not a parental-controls rule. The obligations fall on the company operating the service, and they apply the same way whether a Vermont 15-year-old opens that service on a phone, a laptop, a tablet, or a game console.
What would turn off
The draft rule on prohibited data and design practices lists specific features a covered business could not use with a minor:
Autoplay. No media could start without an action by the minor — no automatic playback of videos, no auto-advancing to the next clip.
Infinite scroll. Additional media could not load without what the draft calls a “discrete and intentional action” beyond ordinary scrolling or swiping.
Recommendation feeds. “For You” feeds are named directly, along with any media ranked by what a minor watched before or how long they lingered on it.
Streaks. Also peer-activity alerts telling a minor that friends are online, and popularity counts presented as social comparison.
Likes, badges and points. The draft treats these as variable or intermittent rewards, along with gamified incentives generally.
Engagement notifications. Anything telling a minor that new activity is waiting, or timed around when they are most likely to come back.
Hard-to-find exits. Interfaces where logging out or turning a feature off takes more steps than continuing.
The draft also bars redesigning a banned feature into something that produces the same effect — swapping a streak for a functionally identical mechanic under another name.
What the Legislature already decided
Some of the strictest provisions do not come from the Attorney General at all. They are in Act 63 itself, and they take effect January 1, 2027 whether the rules are finished or not.
The statute already prohibits a covered business from using a minor’s personal data to select, recommend, or prioritize media for that minor. A minor can still ask for things — media from a specific account, a category like breaking news, more of what they are currently watching — and search results still work normally. What the statute forbids is the platform deciding, from the minor’s behavior, what to show next.
Act 63 also bans push notifications to minors between midnight and 6 a.m. And the law’s default settings go further: out of the box, a covered business is not supposed to send push notifications to a minor at all.
Those defaults cover a good deal else. On a social media platform, a minor’s account should not be visible to users the platform knows are adults, and those adults should not be able to message, like, or comment on it — unless the minor has specifically allowed a particular adult to do so. Separately, the minor’s location should not display to other users, and the account profile should not be indexed by search engines. A business cannot offer one switch that undoes all the protections at once, and cannot prompt a minor to weaken them unless it is strictly necessary for something the minor asked for. A minor who asks to have a social media account unpublished or deleted has to be honored within 15 days.
One provision has nothing to do with platforms marketing to kids. Act 63 says a covered business cannot let any individual — including a parent or guardian — monitor a minor’s online activity or track their location without showing the minor a conspicuous signal that it is happening. The draft rule spells out what conspicuous means: a continuous, real-time, on-screen indicator, not a line in a settings menu the minor would have to go find.
Where the draft reaches past the statute
Compass reviewed the two drafts against the enacted text. Most of what is in them is squarely within what the Legislature asked for. Three provisions are not so clearly within it.
The definition of compulsive use. The Legislature defined the term in the statute: repetitive use that materially disrupts one or more of a minor’s major life activities — sleeping, eating, learning, reading, concentrating, communicating, or working. The draft rule says a practice “shall be deemed to lead to compulsive use” where it relies on engagement optimization, or is designed or reasonably likely to increase, prolong, or intensify a minor’s interaction with the service. The material-disruption element is gone. That is the difference between prohibiting what harms a young person and prohibiting what holds their attention.
The Attorney General has a textual argument here. Act 63 authorizes rules against practices that, in the office’s own opinion, lead to compulsive use — language the Legislature chose, and language that grants real latitude. The open question is whether latitude over which practices qualify also permits changing what the term itself means.
Who counts as a minor. Act 63 defines a “covered minor” as a consumer the business actually knows is a minor, or labels as one under the Attorney General’s age assurance rules. The draft rule applies where a business “knows or has reason to know,” and then deems reason to know to exist whenever the service is reasonably likely to be accessed by a minor. In the statute, “reasonably likely to be accessed” is the test for which companies fall under the law — not which individual users are minors. The draft borrows a scope test and turns it into a knowledge test about people. The statute does hand the office the labeling standard, though — that second half of the definition is a real grant, and it is the ground the Attorney General would stand on.
Presumptions and burdens. The draft rules create rebuttable presumptions — a starting assumption a company has to argue its way out of. A practice is presumed to cause compulsive use if engagement rises without the minor asking for it, or if the company’s own A/B testing showed the feature increased time spent. To rebut, the company must produce clear and convincing evidence, a demanding standard. Missing documentation creates a presumption of non-compliance. Act 63 grants rulemaking authority over practices. It says nothing about evidentiary presumptions or burdens of proof.
None of this is hidden. The Attorney General published both drafts in full and is asking to be told where they are wrong. That is what the comment period is for.
The part that is not an ID check
The second draft rule governs age assurance — the umbrella term for any method used to determine, estimate, or communicate a user’s age or age range.
It opens by saying what it does not do. It does not mandate any specific technology, does not require identity-based age verification, and does not restrict access to any content. That is a deliberate departure from the age-verification laws several other states have passed, and it follows an instruction in Act 63 telling the Attorney General to prioritize privacy and accessibility over accuracy.
The draft sets up a ladder. A business starts at the bottom: self-declaration paired with safeguards, or age signals it already has. Only if that is not enough may it move to estimating age from device and account data. Identity documents or biometrics sit at the top, available only when nothing lower works and the service poses a real risk of harm — and using them without documenting why creates a presumption of violation.
Whatever method is used, the raw personal data has to be deleted the moment the age determination is made — with narrow carve-outs for fraud prevention, security, legal obligations, and the auditing the rule itself requires — and the answer cannot be reused for advertising, profiling, or tracking. A user who is misjudged gets an appeal with review by an actual person, not just a second run through the same automated system. And a user cannot be locked out simply because the age check failed or came back inconclusive.
Who it applies to
Act 63 does not reach every website. A covered business is one that does business in Vermont, generates most of its annual revenue from online services, collects personal data, and runs a product reasonably likely to be accessed by a minor.
That last phrase has a number attached: an audience composed of at least two percent minors aged 2 through 17, established through audience data, internal company research, or what the business knew or should have known. Two percent is a low bar. A general-audience service with a small share of teenagers clears it. A service directed to children under the federal Children’s Online Privacy Protection Act is covered outright, with no percentage required.
The law exempts government agencies, health information covered by HIPAA, human-subjects research, financial institutions under Gramm-Leach-Bliley, and organizations whose primary purpose is journalism and whose workforce is mostly journalists. Compass falls within that last exemption, and readers should weigh this coverage knowing the law we are examining does not reach us.
Enforcement runs through Vermont’s consumer protection law. A violation of Act 63 or its rules is an unfair and deceptive act in commerce, which gives the Attorney General the same investigative and civil authority the office has in any consumer protection matter. Act 63 does not create a separate right to sue on its own terms.
How to be heard
The Attorney General’s Office will hold three hearings, each available in person or by Zoom:
September 9, 9:30–11 a.m. — Montpelier, 109 State St., Conference Room 110 (Pavilion Auditorium)
September 21, 9:30–11 a.m. — White River Junction, 118 Prospect St., Suite 400, Conference Room 120
September 23, 5–6:30 p.m. — Shelburne, Pierson Library, 5376 Shelburne Road, Merrill Community Room
Written comments can be submitted through the office’s online form or by email to ago.rulemaking@vermont.gov, and are due on or before October 2. Both draft rules are posted on the Attorney General’s rulemaking page.
The drafts still have to clear the state’s formal rulemaking process — review by the Interagency Committee on Administrative Rules, a filed proposed rule with its own comment period, and review by the Legislative Committee on Administrative Rules, which has the power to object. All of it has to happen before January 1, when the law and the rules take effect together, and the Legislature returns to Montpelier that same month.