MD SB571: Consumer Protection – Online Products and Services – Data of Children (Maryland Kids Code)

In one paragraph

Maryland's SB 571 (Kids Code) covers for-profit firms doing business in Maryland that have over $25M revenue, buy, receive, sell or share data of 50,000+ consumers, households or devices yearly, or get at least half their revenue from data sales. For online products reasonably likely to be accessed by under-18s they must do impact assessments (existing ones by April 1, 2026) and set high-privacy defaults. AI-related: no default profiling of children without safeguards and need or a compelling reason; assessments weigh algorithm harms. Fines up to $7,500 per child per violation. Signed May 9, 2024 (Chapter 460; same as HB 603); effective October 1, 2024. Not enjoined; NetChoice suit pending.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

For-profit firms doing business in Maryland that meet a revenue or data threshold must assess online products likely accessed by children, set high-privacy defaults and not profile children by default without safeguards and need or a compelling reason. Fines up to $7,500 per child per violation.

Key provisions

1. 1New Commercial Law §§ 14-4601 to 14-4613 (Maryland Age-Appropriate Design Code Act). Covered entity: a for-profit business that collects consumers' (Maryland residents') personal data, determines the purposes and means of processing it, does business in Maryland and has annual gross revenue over $25,000,000 (CPI-adjusted), buys, receives, sells or shares personal data of 50,000+ consumers, households or devices a year, or gets at least 50% of revenue from selling personal data
2. 2Covers online products (services, products or features; not telecom, broadband or physical goods sold online) reasonably likely to be accessed by children under 18: directed to children under COPPA, routinely accessed by a significant number of children, substantially similar to such a product, with ads marketed to children, a significant child audience per internal research, or where the entity knows or should have known a user is a child
3. 3Data protection impact assessment of each such product by April 1, 2026 if offered by then and still offered after July 1, 2026; products first offered later also need one (no deadline is stated; completing it before launch is a condition of the cure protection). It weighs harmful contacts and conduct, exploitative contracts, engagement features (autoplay, rewards for time spent, notifications), collection of children's data, experiments and whether algorithms used by the product would cause foreseeable harm or discrimination, and lists compliance steps
4. 4Covered entities keep assessments while the product is likely accessed by children, review them within 90 days of material processing changes, set children's default privacy settings to a high level of privacy (unless the entity can show a compelling reason a different setting is in children's best interests), give privacy information and terms in clear age-appropriate language, and offer tools to exercise privacy rights and report concerns; on written request the Attorney General's Consumer Protection Division gets a list of assessments within 5 business days and any assessment within 7 business days (the Division may extend); assessments are confidential
5. 5Prohibited: processing a child's data against children's best interests; profiling a child by default (any automated processing of personal data to evaluate, analyze or predict personal aspects) unless the entity shows appropriate safeguards and either the profiling is necessary for the requested product (only for aspects the child is actively and knowingly engaged with) or there is a compelling best-interest reason; processing data not reasonably necessary for a product the child is actively and knowingly using, or for purposes other than those it was collected for; processing precise geolocation by default unless strictly necessary and only for the time needed; processing precise geolocation without an obvious signal to the child while it is collected; dark patterns used to get more data than reasonably expected, circumvent privacy protections or take actions the entity knows or has reason to know are not in children's best interests; processing data to estimate a child's age when not reasonably necessary; letting anyone other than a parent or guardian monitor a child's online activity without first notifying the child and the parent or guardian
6. 6Parents or guardians may be allowed to monitor a child's activity or location without an obvious signal. No private right of action, no age-gating requirement, no duty to monitor or censor third-party content and no liability inconsistent with 47 U.S.C. § 230; exempts data held under GLBA, HITECH or HIPAA rules by entities meeting their security requirements, and clinical-trial data
7. 7Violations are unfair, abusive or deceptive trade practices under the Consumer Protection Act, with civil penalties up to $2,500 per affected child for each negligent violation and $7,500 per affected child for each intentional violation; an entity in substantial compliance gets written notice first and avoids penalties if it has completed the required assessments, cures within 90 days, confirms the cure in writing and takes preventive measures the Division agreed are sufficient
8. 8Approved by the Governor May 9, 2024 (Chapter 460; identical to HB 603, Chapter 461); effective October 1, 2024. NetChoice v. Brown (D. Md., No. 1:25-cv-00322), filed February 2025, challenges the law; the court denied the defendants' motion to dismiss on November 24, 2025; as of the docket checked October 1, 2026 the case is pending and no injunction has been entered

Latest legislative action

May 9, 2024. Approved by the Governor - Chapter 460

Sponsors (showing 5 of 53)

Roll call votes

Amendments (3)

• Favorable with Amendments 443727/1 Not adopted 2024-03-08
• Favorable with Amendments 913221/1 Adopted Adopted 2024-04-03
• Floor Amendment 583624/1 (Delegate Solomon) Adopted Adopted 2024-04-04

Related and companion bills

• Maryland HB603Consumer Protection - Online Products and Services - Data of Children (Maryland Kids Code)