On May 9, 2024, Senate Bill 571 for the Consumer Protection - Online Products and Services - Data of Children (Maryland Kids Code) was signed by Governor Wes Moore and shall take effect on October 1, 2024. In particular, the Act affords children protection by imposing rules on covered entities that provide online products that children are reasonably likely to access.

Scope and definition

The Maryland Kids Code applies to covered entities, which are defined as a sole proprietorship, a limited liability company, a corporation, an association, or any other legal entity that:

• is organized or operated for the profit or financial benefit of its shareholders or other owners;

• collects consumers' personal data or uses another entity to collect consumers' personal data on its behalf;

• alone, or jointly with its affiliates or subsidiaries, determines the purposes and means of the processing of consumers' personal data; and

• does business in the State and:

  • has annual gross revenues in excess of $25 million, adjusted every odd-numbered year to reflect adjustments in the consumer price index;

  • annually buys, receives, sells, or shares the personal data of 50,000 or more consumers, households, or devices, alone or in combination with its affiliates or subsidiaries, for the covered entity's commercial purposes; or

  • derives at least 50% of its annual revenues from the sale of consumers' personal data.

Data Protection Impact Assessment

Under the Maryland Kids Code, covered entities that provide an online product reasonably likely to be accessed by children must prepare a Data Protection Impact Assessment (DPIA) on or before April 1, 2026, and should:

• identity the purpose of the online product;

• identify how the online product processes children's data; and

• determine whether the online product is designed in a manner consistent with the best interests of children, taking into consideration whether:

  • the children could be targeted by contacts resulting in physical, financial, emotional, or psychological harm;

  • the processing may permit the children to witness, participate in, or be subject to conduct resulting in physical, financial, emotional, or psychological harm;

  • the processing may permit the children to be party to or be exploited by a contact through the online product, resulting in physical, financial, emotional, or psychological harm;

  • the online product uses designs to increase, sustain, or extend the use of the online product, including automatic playing of media, and rewards for time spent; and

  • the online product collects or processes sensitive personal data of children.

Other obligations under the Maryland Kids Code  

The Maryland Kids Code also outlines that covered entities must ensure the best interests of children when designing, developing, and providing those online products.

As well as this, covered entities must process children's data in a manner consistent with the best interests of children. In cases where there is a conflict of interest between commercial interests and the best interests of children, covered entities must prioritize the privacy, safety, and well-being of children over such commercial interests.

Lastly, the bill also specifies that covered entities must not use dark patterns to:

• cause a child to provide personal data beyond what is reasonably expected;
• circumvent privacy protections; or
• take any action known to having reason to know is not in the best interests of children.

You can read the bill here and view its legislative history here.