Maryland Children’s Privacy Laws (2026)

SB 571 / HB 603 (2024, Ch. 460)

In force · Design code · effective 2024-10-01 · binds operators, platforms

Ages: Children under 18 (consumers under 18 reasonably likely to access the service)

Requires: Online product/service operators whose offerings are reasonably likely to be accessed by children (under 18) must complete data protection impact assessments (DPIAs), configure all default privacy settings provided to children to offer a high level of privacy, and act in the best interests of children. They are barred from processing children's personal data in ways materially detrimental to children or beyond what is reasonably necessary, from using dark patterns, and from profiling or using a child's data in harmful ways absent specified safeguards. The law relies on a 'likely to be accessed by children' audience standard rather than mandating age verification. Penalties up to $2,500 per child (negligent) and $7,500 per child (intentional).

Litigation: NetChoice v. Brown, No. 1:25-cv-00322 (D. Md.), Judge Richard D. Bennett. Filed Feb 3, 2025. The court denied the State's motion to dismiss Nov 24, 2025 (ECF 58-59); no injunction is in effect, so the Kids Code remains enforceable and in force. On July 7, 2026, the court granted NetChoice leave to file a Second Amended Complaint (ECF 80, docketed Apr 20, 2026) adding a dormant Commerce Clause claim (ECF 90-91), and the State answered it Aug 4, 2026 (ECF 98). Discovery is under way and has been referred to Magistrate Judge J. Mark Coulson (ECF 81), who on Sept 23, 2026 denied NetChoice's motion for a protective order and directed the State to resubmit its proposed protective order with the court's modifications (ECF 111).

Entry last reviewed 2026-10-01

SB 541 (2024, Ch. 455; cross-filed HB 567); amended by HB 711 (2026, Ch. 874)

In force · Privacy law (minors) · effective 2025-10-01 · binds operators

Ages: Known children under 13; minors under 18

Requires: A controller may not process a consumer's personal data for targeted advertising, or sell it, if the controller knew or should have known the consumer is under 18; these are flat prohibitions with no consent override. Personal data of a consumer the controller knows or has reason to know is a child (under 13, per COPPA) is sensitive data, which may not be collected, processed or shared unless strictly necessary to provide or maintain a specific product or service the consumer requested, and may not be sold. A 2026 amendment (HB 711, Ch. 874, effective 2026-07-01) did not change these prohibitions but widened sensitive data to include data a controller infers from personal data to indicate any sensitive category.

Entry last reviewed 2026-10-01