Vermont S 69: An act relating to regulating the use of wake boats on State waters

Bill Text

No. 63 Page 1 of 20
2025

VT LEG #384287 v.1
No. 63. An act relating to an age-appropriate design code.
(S.69)
It is hereby enacted by the General Assembly of the State of Vermont:
Sec. 1. 9 V.S.A. chapter 62, subchapter 6 is added to read:
Subchapter 6. Vermont Age-Appropriate Design Code Act
§ 2449a. DEFINITIONS
As used in this subchapter:
(1)(A) “Affiliate” means a legal entity that shares common branding
with another legal entity or controls, is controlled by, or is under common
control with another legal entity.
(B) As used in subdivision (A) of this subdivision (1), “control” or
“controlled” means:
(i) ownership of, or the power to vote, more than 50 percent of the
outstanding shares of any class of voting security of a company;
(ii) control in any manner over the election of a majority of the
directors or of individuals exercising similar functions; or
(iii) the power to exercise controlling influence over the
management of a company.
(2) “Age assurance” encompasses a range of methods used to determine,
estimate, or communicate the age or an age range of an online user.
(3) “Age range” means either an interval with an upper and lower age
limit or a label indicating age above or below a specific age.

No. 63 Page 2 of 20
2025

VT LEG #384287 v.1
(4) “Algorithmic recommendation system” means a system that uses an
algorithm to select, filter, and arrange media on a covered business’s website
for the purpose of selecting, recommending, or prioritizing media for a user.
(5)(A) “Biometric data” means data generated from the technological
processing of an individual’s unique biological, physical, or physiological
characteristics that allow or confirm the unique identification of the consumer,
including:
(i) iris or retina scans;
(ii) fingerprints;
(iii) facial or hand mapping, geometry, or templates;
(iv) vein patterns;
(v) voice prints or vocal biomarkers; and
(vi) gait or personally identifying physical movement or patterns.
(B) “Biometric data” does not include:
(i) a digital or physical photograph;
(ii) an audio or video recording; or
(iii) any data generated from a digital or physical photograph, or
an audio or video recording, unless such data is generated to identify a specific
individual.
(6) “Business associate” has the same meaning as in the Health
Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191
(HIPAA).

No. 63 Page 3 of 20
2025

VT LEG #384287 v.1
(7) “Collect” means buying, renting, gathering, obtaining, receiving, or
accessing any personal data by any means. This includes receiving data from
the consumer, either actively or passively, or by observing the consumer’s
behavior.
(8) “Compulsive use” means the repetitive use of a covered business’s
service that materially disrupts one or more major life activities of a minor,
including sleeping, eating, learning, reading, concentrating, communicating, or
working.
(9)(A) “Consumer” means an individual who is a resident of the State.
(B) “Consumer” does not include an individual acting in a
commercial or employment context or as an employee, owner, director, officer,
or contractor of a company, partnership, sole proprietorship, nonprofit, or
government agency whose communications or transactions with the covered
business occur solely within the context of that individual’s role with the
company, partnership, sole proprietorship, nonprofit, or government agency.
(10) “Covered business” means a sole proprietorship, partnership,
limited liability company, corporation, association, other legal entity, or an
affiliate thereof:
(A) that conducts business in this State;
(B) that generates a majority of its annual revenue from online
services;

No. 63 Page 4 of 20
2025

VT LEG #384287 v.1
(C) whose online products, services, or features are reasonably likely
to be accessed by a minor;
(D) that collects consumers’ personal data or has consumers’
personal data collected on its behalf by a processor; and
(E) that alone or jointly with others determines the purposes and
means of the processing of consumers personal data.
(11) “Covered entity” has the same meaning as in HIPAA.
(12) “Covered minor” is a consumer who a covered business actually
knows is a minor or labels as a minor pursuant to age assurance methods in
rules adopted by the Attorney General.
(13) “Default” means a preselected option adopted by the covered
business for the online service, product, or feature.
(14) “De-identified data” means data that does not identify and cannot
reasonably be used to infer information about, or otherwise be linked to, an
identified or identifiable individual, or a device linked to the individual, if the
covered business that possesses the data:
(A)(i) takes reasonable measures to ensure that the data cannot be
used to reidentify an identified or identifiable individual or be associated with
an individual or device that identifies or is linked or reasonably linkable to an
individual or household; and
(ii) for purposes of this subdivision (A),