Vermont Legislature SmartTranscripts:

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: Oh, how do you say

[Unidentified Committee Member (likely Joe Major or John Benson)]: your is it

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: s s s

[Wendy Harrison (Chair)]: Okay.

[Unidentified Committee Member (likely Joe Major or John Benson)]: We are live.

[Wendy Harrison (Chair)]: We are live. And I think the screen is different than it usually is but we will just proceed. So welcome. This is Senate Institutions. Today is Thursday, January 15 and we have just one item that we're going to learn about and discuss which is the implementation of Act 63 of last year which was Kids Code and we have Sarah Essex from the AG's office and we appreciate you being here and we'll just introduce ourselves.

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: So, Wendy Harrison, we've met. Sarah Esseves, I'm an Assistant Attorney General at the Attorney General's office. I'm in the Consumer Protection Division and work on matters like the appropriate tobacco. Great. And

[Russ Ingalls (Member)]: I'm Robert Plunkett, senator from Bennington. Joe Major, senator from Windsor. Russ Ingalls, senator from Essex Orleans. John Benson, senator from Orange.

[Wendy Harrison (Chair)]: Great. So if you could go over kids code and then, go to the implementation. Sure. That would be very helpful.

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: So, for the record, Sarah said this, and I believe most, if not all of you, maybe the exception of one, who were here last session, you all sponsored this bill, at least this committee heard this bill, passed it, introduced it, etcetera. So you should be fairly familiar with it. I'm going to give kind of a high level overview of the law, and then I'll give a quick update on our rule making that the law mandates. So, Age Appropriate Design Quote Act, affectionately known as Kids Code here in Vermont. Essentially what it does is it establishes baseline privacy, safety, and design protections for minors 18 when they use online services. So it focuses more on data collection, and it regulates how digital products are designed, configured, and operated. So, we are not regulating content here. We are focusing on product design and how product design can better protect children. As you know, children and minors, they spend significant amounts of time on social media platforms that are designed to maximize engagement and not safety. So that's where this bill really or this law comes in. Also, please jump in if you have any questions at any time. Our approach in Vermont, we, address foreseeable harms caused by product design. That includes things like excessive data use, addictive features, and exposure risks. This law really tries to minimize those things. As far as who the law covers, this applies to businesses that do business in Vermont. They generate most of their revenue from online services. They offer products or features that are reasonably likely to be accessed by minors. So maybe they have an idea that their their product reaches minors or it's made for minors. And they also have to control how personal data is collected or used. So they have to meet all those requirements in order to come in under this law. So again, this is all high level core requirements of the law. First is a duty of care for minors. So businesses have to design their products to avoid what we're calling reasonably foreseeable harms to children and teens. And this includes things like what I said earlier, compulsive use or addictive use, also emotional and psychological harm, and exploitation or discrimination driven by algorithms. Another requirement is high privacy defaults. So for minors specifically, not adults, the services, the online services must, one, limit data collection to what isn't necessary. So that's a form of data minimization. They have to restrict public visibility of personal information for minors. They have to also reduce unsolicited contact and profiling by default. So in other words, unless a minor has consented to having an adult contact them, any random adult cannot do that under this law. Third requirement, limits on data and design practices. So the law restricts one, minors data for secondary or unrelated purposes. So you can't sell data to a third party. It also restricts, certain manipulative design features, that that's where the addictive nature of the products come in. And they have to, retain excuse me, it restricts retention or sharing of minors' personal data beyond what is needed. Again, this is data minimization practices. Four, transparency for young users. Businesses must clearly explain to these users what data is collected from them, and this is minors, mind you. How recommendation or ranking systems affect what minors see, I think we'll probably flush out in rulemaking what exactly that means. They also have to, explain how minors or their parents can exercise their privacy rights. So, it's a right to delete or a limiting nature to what they want to share as far as their data goes, that has to be explained in plain language. There also has to be age assurance with safeguards. So companies must determine when users are minors and they have to apply protections for minors accordingly while ensuring, one, that they have age that, excuse me, their age verification data is not repurposed and that their additional privacy risks are minimized. This is all very conceptual, so if you have questions, please do chime in. So, those are kind of the five overarching requirements for H Corporary Design Code. As far as enforcement goes, this law will be enforced by the attorney general. Any violations of the law will be treated as unfair or deceptive acts under the Consumer Protection Act. And we have been our office has been tasked with issuing rules to clarify compliance and age assurance standards. It takes effect 01/01/2027. And I think that's that's really the high level overview. So unless there are questions, I can update you on our rule making. Thank

[Unidentified Committee Member (likely Joe Major or John Benson)]: you, madam chair. When we go age appropriate, I know we talked about this, during the session and trying to, if someone who isn't age appropriate opts in, you can't really see them. I mean, what's the mechanism for verifying that?

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: I think that's something that will be hashed out further in rule making, since we have been tasked to, or offset been tasked to implement rules for age verification. So limiting things like that might be something we we think about and entertain. I do know other states, I'm thinking of New York, they have implemented percentages, so they will have language they have language in their rules that says something like no more than 5% of users would be above the age of 18, because there will, unfortunately, always be those kind of one offs that get through. But the enforcement mechanism would be able to come in if that percentage is is greater than 5%, for example.

[Unidentified Committee Member (likely Joe Major or John Benson)]: So within the enforcement mechanism, How do they know who to go after? And and are you penalizing the business for not not knowing if it go and and Mhmm. You know, how are we finding out if they it's above that 5%? You know, I absolutely think this is what we should do, but I just wanna make sure that if we are going after or attacking not attack.

[Russ Ingalls (Member)]: That's the wrong word. I apologize.

[Unidentified Committee Member (likely Joe Major or John Benson)]: Holding to account any business who may be doing this. I wanna make sure that we separate who is and who isn't doing nefarious things. Right.

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: I my opinion is it will come down to enforcement. As I'm sure you know our office, we, if we have reason to believe that a company is engaging in unfair and deceptive practices, then we will investigate them. And so once these rules are adopted and the law both the rules and the law go into effect, our office will then have the authority to investigate various companies to figure out whether there's any there there. So we wouldn't necessarily right out the gate, say you are violating the CPA, but we would go through an investigative process

[Unidentified Committee Member (likely Joe Major or John Benson)]: to Yeah. Determine that's, know, you you calmed down because you said that you the there's an investigation process instead of just a blanket, you know, you have you're over this threshold, but there is and then I would hope if, there are, businesses who yes, you should do this, but unaware that there is a mechanism, okay, this this is what we say, how we fix it, instead of just Right. Immediately going to any kind of monetary fine or anything like that.

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: And that's the nice thing about the Consumer Protection Act is it's very broad. We have discretion to determine the approach we take when we are investigating, and I'll use data brokers as an example. We have the data broker registry, the data broker registration law, and so the presumption is that we have data brokers operating in the state that they are registering. If we find out they have not registered, that's

[Russ Ingalls (Member)]: kind

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: of a per se violation that we would just treat as, okay, this is very obvious that you violated this particular law, and so we're going to fine you however much money it would be. Whereas this is much more nuanced, and so I anticipate that unless it is kind of a per se violation that's very obvious, that we would engage in investigations.

[Unidentified Committee Member (likely Joe Major or John Benson)]: And and I apologize if if I No.

[Wendy Harrison (Chair)]: Go ahead. And then, Ingalls, after you. I

[Unidentified Committee Member (likely Joe Major or John Benson)]: the the other aspect of it is and and I don't know if this is in your purview in in the attorney general's office. You may, within investigations, see that this law has unintended consequences, whatever that may be. I I don't I don't know what that would be. Is there any way that that you can report that to us? Because I think for any law to be effective, we want to be able to make adjustments and amendments to them going forward. I I think though that that's important, as well because many times what we do is have law and it goes unless we hear from who is being violated or from who is doing the investigation, we oftentimes don't know.

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: Right. So we have a long history of communicating where a law might fall short or it needs to be improved with the legislature, and we have been able to change laws, or you have changed the laws once we have kind of advocated for whatever changes they may be. So I anticipate that if that happens with enforcement of this law, that we would absolutely communicate with the legislature.

[Unidentified Committee Member (likely Joe Major or John Benson)]: Wonderful. Thank you so much.

[Wendy Harrison (Chair)]: And let me just add that, and then Senator Ingalls, this is one of the reasons why I asked her to be here.

[Unidentified Committee Member (likely Joe Major or John Benson)]: Yeah, yeah.

[Wendy Harrison (Chair)]: And we'll get regular updates.

[Russ Ingalls (Member)]: Perfect. Bottom line, business is never gonna know the age of who they're communicating with. There's no way to know that, correct?

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: I cannot say yes or no to that. Okay.

[Russ Ingalls (Member)]: So that would be yes. But that there's there's there lies the problem of this whole thing is that unless you have a sign in of somebody putting their agent there, you're never gonna know. This business is never gonna know who they're communicating and what age that they are and the the savviness of these people who wanna communicate with these businesses because that's just what they do. They're born at with a computer in their hand, and they're able to communicate better than I could ever even at this advanced age. And that's the scary part of all of this stuff, of not protecting businesses in the state of Vermont because they really don't know who they are communicating with because there's no way to no way to verify the age. Very scary stuff.

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: Well, a couple comments. I believe the law had kind of has sort of qualifying language that says when a business has a reasonable belief that it is reaching minors that it Very has to apply to

[Russ Ingalls (Member)]: productive as far as what reasonable is.

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: But there are also types of companies that they absolute they collect so much data on their users that they absolutely know who is a minor and who is not. So, I think it's a little more nuanced than a yes or no question and it's very kind of company.

[Wendy Harrison (Chair)]: And so I want to add to that. We talked about age assurance multiple times, which was appropriate and we talked about what businesses in Vermont be impacted and we were not able to find any business located in Vermont that would be impacted.

[Russ Ingalls (Member)]: We did. I

[Wendy Harrison (Chair)]: think you're thinking about a different bill, but these are the companies that are engaging in these access issues and doing harm to our children. And I'd be happy to talk about the harm again if anyone wants to, it's significant. Women, girls have been raped, boys I'm sure, but we heard from girls. We had pediatricians testify, we had teachers testify, we had kids themselves testify. The harms are significant. And this bill was bipartisan, tripartisan support is what we received when it was considered. And we had, so we have this extra step which we're taking now, which you're taking now to double check that there will not be any businesses harmed. We do know that hundreds of kids have been harmed and are likely being harmed now. So this is just incredibly important to continue. And if you do have suggestions, don't wait for us to call you, you being the AG's office, let us know immediately if you have any suggestions on what we can do because we are in session now for a few months and we can make modifications if necessary. It's very important that we get this done.

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: Do you

[Wendy Harrison (Chair)]: have any questions? You weren't here last years.

[Russ Ingalls (Member)]: No, I'm just listening to conversation and I understand exactly what Senator Ingalls is saying is you can't look, or we hope they're not looking through the computer, the state to see who's on it to know who's on the other end.

[Wendy Harrison (Chair)]: Well, the state isn't, but the large Internet companies are.

[Russ Ingalls (Member)]: Correct. But in order to verify the company, to verify who's there, it's a tough situation. So it would be interesting to see as you start going through the implementation where the shorter falls are and how it can be improved. But I think you've got a difficult job trying to figure out who is really the users.

[Wendy Harrison (Chair)]: Well, so one example, I have named companies before but I won't know, but it's a nationwide company that is a place where pedophiles meet children and we've No, no, no, no, no, but I just wanna let you know that the, the, that mostly girls, are are being told you have a friend waiting So to talk to the company connects that person with the girl and young women told us that they had had a lot of those messages when they were middle school age and once they got to be 18, 19 which was not in the preferred demographic of the pedophiles, they didn't get those messages anymore. So it's pretty clear and we can talk about it more that the businesses, big corporations, you know, international corporations, they know what's happening and it's intentional and they're making money on it and it's very sad.

[Unidentified Committee Member (likely Joe Major or John Benson)]: I have no comment.

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: Does it make sense for me to update you on the rule making point?

[Wendy Harrison (Chair)]: Yes, please, please. And I'm interested to know what you've heard. If you've received comments, that would be great. Sure. So, just

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: kinda to why don't I lay out exactly what we're tasked with and then I will give you an so, sections twenty four forty nine f and 2449G of the age appropriate design code, those task our office with undertaking rulemaking for very specific parts of this law. So 2449F, we will be adopting rules that prohibit data processing or design practices that lead to compulsive use, subvert or impair user autonomy, decision making, or choice when they're using an online service. So the way I think of it is there's really the addictive component that we talked about earlier, and user autonomy decision making. Those are kind of the two buckets that twenty four forty nine f is asking us to to undergo rulemaking for. What do those things mean? What do they look like? What what comprises the violation of those things? The second portion, twenty four forty nine g, and this requires us to adopt rules that identifies commercially reasonable and technically feasible methods for businesses to determine age assurance. If a user is a covered minor, and there's a laundry list of things that we are to consider when we are adopting these age assurance rules, such as we have to prioritize user privacy. We must also consider the size of the companies, their financial resources, what they can do, technically speaking, cost, impact of age assurance methods on, safety, and it goes

[Unidentified Committee Member (likely Joe Major or John Benson)]: on. So,

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: this is this is quite a task to say the least, And we have been busy kind of in the research phase right now. New York has their I believe it's called the Safe Kids Act. I might be mixing up the order of the words there. But it is an age assurance law that I'm hopeful we will be able to borrow from. They went under one of the rule making process, and so we are working with them. We are working with other different stakeholders to ensure that we adopt kind of the best, most effective rules for Section G specifically. Section F, I think we can also borrow from what a few other states have done as far as their comprehensive data privacy laws go, identifying dark patterns and different types of company practices that they engage in to addict people, specifically minors to their products. So, that said, you may have seen, I did provide a link to our webpage, or we have a rule making webpage up on the AGO website. It explains exactly what we have to do as part of the rule making. If you don't have it in front of you, can just Google Vermont AGO. Incorporates black box. How am

[Wendy Harrison (Chair)]: right up? Did you want to see that?

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: So we explained what the rule making is. We are soliciting informal comments right now, so we have an email address set up. We also have a form that we have put in place acting a whole slew of questions of stakeholders. We are calling this kind of the informal portion of the rule making, and we anticipate that will go into mid spring where we are having lots and lots of conversations, doing lots and lots of research to ensure that we have the most effective tools in place. Now, once that happens Can I

[Wendy Harrison (Chair)]: ask you a question about that, Yeah? Are you sending information or notification to the chambers?

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: Yeah. We'll be I I believe we've already informed several stakeholders. I think the chamber are you talking about the Vermont Chamber

[Wendy Harrison (Chair)]: of Yes. And then the

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: other one of them. Okay. I would also like to contact various superintendents and school districts. I'm sure they have very valuable, comments to share. And I believe, of course, lots of different companies have have been informed, and their representatives, public advocates have also been informed. So, knows this is coming down the and what I envision happening, and I should say I am the one doing all this, so if you have any questions, I'm the one to ask, ask you. So I would say about a month before we plan to have the proposed rule sent to the Secretary of State, we will be working with we will have a draft rule ready to share with various stakeholders to make sure the the formal part of the rule making process is very fluid, and we don't lose a lot of time there. After which time, once the proposed rule is filed, then we'll engage in public hearings, public comment, and there's another big part I'm missing. But once all that happens, then it'll go to LCAR, ICAR, etcetera, etcetera, etcetera. And that's all laid out, I believe, in title three. There's very kind of regimented rule making process that we have to go through. So, right now, I would say data gathering, information gathering, speaking with stakeholders, and gathering as much information we can to ensure that these rules are going to be effective.

[Wendy Harrison (Chair)]: Terrific. Thank you. Any questions or so, what would be a good stage for in your process that is in the next four months so that we could have you back?

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: I'd say you can have me back in two or three months. Okay. And I can give you an update. Okay. I should have hopefully made a lot of progress by then. Good, good.

[Wendy Harrison (Chair)]: Well, you very much. Thank you. Believe this is very important. Thank you. So, let's, that is our only item for today,

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: tomorrow, when are we starting?

[Russ Ingalls (Member)]: We're starting at once, Mark. Okay. Yeah. So,

[Wendy Harrison (Chair)]: yeah. So tomorrow we'll have the Chattanooga Regional Corrections facility at this point. That's our only item. We might have a second phase, But we should be able to get you out of here by three. Okay, so anything else before we

[Sarah Essex, Assistant Attorney General (Vermont AG’s Office, Consumer Protection Division)]: adjourn? Okay,

[Wendy Harrison (Chair)]: we are adjourned.