Maryland Children's Privacy Laws (2026)

Consumer Protection - Application Store Accountability Act · HB 1179 (2026)

Pending — A bill was introduced this cycle but is not yet law. · App store · effective 2026-10-01 · binds app stores, developers

Ages: under 18

Requires: Would require application store providers to verify the age category of account holders and, for minors (under 18), obtain verifiable parental consent before a minor downloads/purchases an app or makes in-app purchases; re-consent on significant app changes. Developers must use the store-provided age signals. Violations are unfair/abusive/deceptive trade practices under the Maryland Consumer Protection Act (civil penalty up to $7,500 per violation).

Maryland Age-Appropriate Design Code Act (Maryland Kids Code) · SB 571 / HB 603 (2024)

In force — Effective and enforceable today. · Age assurance · effective 2024-10-01 · binds operators, platforms

Ages: under 18

Requires: Covered for-profit online services reasonably likely to be accessed by children must complete data protection impact assessments (DPIAs), configure high-privacy default settings for minors, prohibit collection/use/sale of children's personal data beyond what is reasonably necessary, and avoid dark patterns / design features detrimental to children. Penalties up to $2,500 per child (negligent) and $7,500 per child (intentional).

Litigation: NetChoice v. Brown, No. 1:25-cv-00322 (D. Md.). Filed Feb 3, 2025. Court denied State's motion to dismiss Nov 24, 2025; NO injunction in effect; law remains enforceable; case proceeding to discovery as of 2026-06-27.

Maryland Age-Appropriate Design Code Act (Maryland Kids Code) · SB 571 (2024, Ch. 460; cross-filed HB 603)

In force — Effective and enforceable today. · Design code · effective 2024-10-01 · binds operators

Ages: Children under 18 (consumers under 18 reasonably likely to access the service)

Requires: Online product/service operators whose offerings are reasonably likely to be accessed by children (under 18) must complete a data protection impact assessment, configure default privacy settings to the highest level for children, and act in the best interests of children. They are barred from processing children's personal data in ways materially detrimental to children, from using dark patterns, and from profiling or using a child's data in harmful ways absent specified safeguards. The law relies on a 'likely to be accessed by children' audience standard rather than mandating age verification.

Litigation: NetChoice LLC v. Brown, No. 1:25-cv-00367 (D. Md.). On Nov. 24, 2025, the district court denied Maryland's motion to dismiss, allowing NetChoice's First Amendment, vagueness, and COPPA/Section 230 preemption claims to proceed to discovery. The court did NOT enjoin the statute, so the Kids Code remains in effect as of 2026-06-28; NetChoice filed an amended complaint in April 2026 and the case is ongoing.

Maryland Online Data Privacy Act of 2024 (MODPA) — minors' provisions · SB 541 (2024, Ch. 455; cross-filed HB 567)

In force — Effective and enforceable today. · Privacy law (minors) · effective 2025-10-01 · binds operators

Ages: Known children under 13; minors under 18

Requires: A controller may not process or sell the personal data of a consumer it knows or should know is under 18 for purposes of targeted advertising, and may not 'sell' such a minor's personal data — these are flat prohibitions with no consent override. Personal data of a consumer the controller knows or has reason to know is a child (under 13 per COPPA) is treated as sensitive data, which may not be processed without obtaining consent in accordance with COPPA and may not be sold.