language: en · status: in-force · last checked: 2026-10-08

Maryland Age-Appropriate Design Code Act (Maryland Kids Code)

Maryland's children's design code, Commercial Law Title 14, Subtitle 48, cited as the Maryland Age-Appropriate Design Code Act (§14-4813). It was enacted by Chapters 460 and 461 of 2024 (SB 571 and HB 603) and took effect October 1, 2024. It applies to a for-profit covered entity that provides an online product reasonably likely to be accessed by children (under 18). Such an entity must act in the best interests of children and complete a data protection impact assessment for each such product. It may not profile children by default, collect their precise geolocation by default, process their data beyond what is needed, or use dark patterns. Default privacy settings must be high-privacy. Like the California CAADCA, it follows the UK Children's Code.

Litigation status — read first

Not enjoined. NetChoice challenges the Act in NetChoice v. Brown, No. 1:25-cv-00322 (D. Md., filed 3 February 2025), on First Amendment, vagueness and federal-preemption grounds. On 24 November 2025 the court denied the State's motion to dismiss and ordered an answer (Memorandum Opinion and Order, Bennett, J.). The opinion describes the Act as Md. Code Ann., Com. Law §§14-4801–14-4813. No order enjoining enforcement was found. The latest docket entries seen, in September 2026, are discovery orders (CourtListener docket, checked 2026-10-08). The Act is therefore labelled in-force. This differs from California's code, whose duties are enjoined. Check the docket before treating any duty as settled.

Applicability to EdTech

• Who is covered. A "covered entity" is a for-profit legal entity that collects consumers' personal data, determines the purposes and means of processing, does business in Maryland, and meets one of three thresholds: more than $25,000,000 in annual gross revenue, personal data of 50,000 or more consumers, households or devices, or at least 50% of revenue from selling personal data (§14-4801(h)). A "child" is a consumer under 18 (§14-4801(e)). An online product is "reasonably likely to be accessed by children" if, among other criteria, it is directed to children under COPPA, is routinely accessed by a significant number of children, or the entity "knows or should have known that a user is a child" (§14-4801(s)). A K-12 product meets that test. The Act has no exemption for FERPA data or school contracts; its exemptions cover GLBA, HITECH and HIPAA-regulated data and clinical-trial data (§14-4802).
• A DPIA for each product. It must identify the product's purpose and how it uses children's data. It must assess whether the product is designed in children's best interests, including against harmful contacts, engagement-extending design ("automatic playing of media, rewards for time spent, and notifications") and algorithms (§14-4804(b)). Products already offered had to be assessed by April 1, 2026, and new products need a DPIA before they are offered (§14-4804(a)(2)–(3)). The DPIA must be reviewed within 90 days of a material change and produced to the Division within 7 business days of a request (§14-4805(2), §14-4807(b)). A DPIA is confidential and exempt from the Public Information Act (§14-4811).
• High-privacy defaults and child-readable terms. All default privacy settings for children must "offer a high level of privacy" unless there is a compelling best-interests reason otherwise. Privacy information and terms must use "clear language suited to the age of children" (§14-4805(3)–(4)).
• Prohibitions. It is prohibited to process a child's data against children's best interests, to profile a child by default (subject to narrow exceptions), or to process data not reasonably necessary for a product the child is "actively and knowingly engaged with". Precise geolocation may not be processed by default unless strictly necessary, or without an obvious signal to the child. Dark patterns are banned (§14-4806(a)). So is letting anyone other than a parent or guardian monitor a child's online activity without first notifying the child and the parent (§14-4806(a)(9)). That last ban bears on teacher-facing monitoring and classroom-management features.
• No age-gating required. The Act does not require age-gating (§14-4810(4)). Estimating a child's age is limited to what is reasonably necessary (§14-4806(a)(8)).

Contents

Key obligations at a glance

• DPIA for each online product reasonably likely to be accessed by children — §14-4804.
• Keep and review the DPIA; high-privacy defaults; age-appropriate terms; tools for children and parents — §14-4805.
• No processing against children's best interests, default profiling, default precise geolocation, or dark patterns — §14-4806(a).
• Produce DPIAs to the Division on request — §14-4807.

Enforcement

A violation is an unfair, abusive or deceptive trade practice enforced under Title 13 of the Commercial Law Article, except §13-410 (§14-4808(a)). Civil penalties are up to $2,500 per affected child for each negligent violation and $7,500 per affected child for each intentional violation (§14-4808(b)). A covered entity in substantial compliance gets written notice and a 90-day cure period. It avoids the penalty if it has completed the required DPIAs, cures, certifies the cure in writing, and takes preventive measures (§14-4809). There is no private right of action (§14-4810(1)).

Licence

The corpus reproduces Commercial Law §§14-4801 to 14-4813 verbatim from the Maryland General Assembly's Statutes Text pages (read 2026-10-08), which carry no copyright notice.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties."

Conditions: none attach to the statute text. The corpus still names the official source in its Sources section and in the fact document's {.meta} provenance lines. Its Meta section says what it changed: anchors added, whitespace collapsed, nothing reworded.

Related

• Maryland Online Data Privacy Act (Com. Law §§14-4701 to 14-4714) — the companion consumer privacy statute, which bars targeted advertising to, and sale of the data of, under-18s
• California CAADCA — the California design code on the same model, enjoined
• UK Children's Code — the code both state acts follow
• Maryland student data privacy (Educ. §4-131) — the operator statute for PreK-12 school purposes

Sources

• Maryland General Assembly — Statutes Text, Commercial Law §14-4801 (and the following sections to §14-4813), in the view of statutes in effect as of October 1, 2026
• Chapter 461 of 2024 (HB 603), Maryland Kids Code — enactment and effective date
• NetChoice v. Brown, No. RDB-25-0322 (D. Md. Nov. 24, 2025), Memorandum Opinion and Order