Privacy Law Library

Maryland Age-Appropriate Design Code Act (Maryland Kids Code)

Maryland Kids Code

Children · Location

The Maryland Kids Code requires large online businesses whose products children under 18 are reasonably likely to use to design those products in children's best interests. Covered entities must complete data protection impact assessments, set high-privacy defaults for children, and avoid default profiling, default precise geolocation tracking, unnecessary data collection, and dark patterns. NetChoice's First Amendment challenge (NetChoice v. Brown, D. Md. No. 1:25-cv-00322) survived a motion to dismiss in November 2025 and is in discovery; the law has not been enjoined.

Where

Maryland

Citation

Md. Code, Com. Law §§ 14-4801 to 14-4813 (enacted by 2024 Md. Laws chs. 460 and 461 as §§ 14-4601 to 14-4612, since renumbered)

Status

In force

In force since

2024-10-01

Enforced by

Consumer Protection Division, Office of the Attorney General (14-4808)

People can sue

No

Penalties

Unfair, abusive, or deceptive trade practice enforced under Title 13 (except § 13-410); civil penalties up to $2,500 per affected child per negligent violation and $7,500 per affected child per intentional violation (14-4808). Entities in substantial compliance get written notice and a 90-day cure opportunity before penalties (14-4809). No private right of action (14-4810(1)).

Applies to

• For-profit entities doing business in Maryland that collect consumers' personal data and determine the purposes and means of processing, and that have over $25 million in annual gross revenue (CPI-adjusted), buy, receive, sell, or share personal data of 50,000+ consumers, households, or devices, or derive at least 50% of revenue from selling personal data (14-4801(h))
• Online services, products, or features reasonably likely to be accessed by children under 18, judged by COPPA child-directed status, audience evidence, child-targeted ads, internal research, or actual or constructive knowledge that a user is a child (14-4801(e), (s))
• Does not apply to GLBA-, HITECH-, or HIPAA-regulated data held by compliant entities, or clinical-trial information (14-4802)