In this subtitle the following words have the meanings indicated. “Aggregate consumer information” means information: That relates to a group or category of consumers; From which individual consumer identities have been removed; and That is not linked or reasonably linkable to any consumer or household, including by a device. “Aggregate consumer information” does not include individual consumer records that have been de–identified. “Best interests of children” means a covered entity’s use of the personal data of children or the design of an online product in a way that does not: Benefit the covered entity to the detriment of children; and Result in: Reasonably foreseeable and material physical or financial harm to children; Severe and reasonably foreseeable psychological or emotional harm to children; A highly offensive intrusion on children’s reasonable expectation of privacy; or Discrimination against children based on race, color, religion, national origin, disability, gender identity, sex, or sexual orientation. “Biometric data” means data generated by automatic measurements of an individual’s biological characteristics. “Biometric data” includes: A fingerprint; A voiceprint; An eye retina or iris pattern; or Any other unique biological pattern or characteristic that is used to identify a specific individual. “Biometric data” does not include: A digital or physical photograph; An audio or video recording; or Data generated from a digital or physical photograph, or an audio or video recording, unless the data is generated to identify a specific individual. “Child” means a consumer who is under the age of 18 years. “Collect” means to buy, rent, gather, obtain, receive, or access personal data relating to a consumer. “Collect” includes: Receiving data from the consumer; and Observing the consumer’s behavior. “Consumer” means an individual who is a resident of the State. “Consumer” does not include an individual acting in a commercial or employment context or as an employer, an owner, a director, an officer, or a contractor of a company, partnership, sole proprietorship, nonprofit organization, or governmental unit whose communications or transactions with the covered entity occur solely within the context of that individual’s role with the company, partnership, sole proprietorship, nonprofit organization, or governmental unit. “Covered entity” means a sole proprietorship, a limited liability company, a corporation, an association, or any other legal entity that: Is organized or operated for the profit or financial benefit of its shareholders or other owners; Collects consumers’ personal data or uses another entity to collect consumers’ personal data on its behalf; Alone, or jointly with its affiliates or subsidiaries, determines the purposes and means of the processing of consumers’ personal data; Does business in the State; and Has annual gross revenues in excess of $25,000,000, adjusted every odd–numbered year to reflect adjustments in the Consumer Price Index; Annually buys, receives, sells, or shares the personal data of 50,000 or more consumers, households, or devices, alone or in combination with its affiliates or subsidiaries, for the covered entity’s commercial purposes; or Derives at least 50% of its annual revenues from the sale of consumers’ personal data. “Covered entity” includes: An entity that controls or is controlled by a business and that shares a name, service mark, or trademark that would cause a reasonable consumer to understand that two or more entities are commonly owned; and A joint venture or partnership composed of businesses in which each has at least a 40% interest in the joint venture or partnership. “Dark pattern” means a user interface designed or manipulated with the purpose of subverting or impairing user autonomy, decision making, or choice. “Dark pattern” includes any practice identified by the Federal Trade Commission as a dark pattern. “Data protection impact assessment” or “assessment” means a systematic survey to assess compliance with the duty to act in the best interests of children. “Default” means a preselected option adopted by the covered entity for an online product. “Division” means the Division of Consumer Protection of the Office of the Attorney General. “Online product” means an online service, product, or feature. “Online product” does not include: A telecommunications service, as defined in 47 U.S.C. § 153; The sale, delivery, or use of a physical product sold by an online retailer; or A broadband Internet access service, as defined in 47 C.F.R. § 8.1(b). “Personal data” means information that is linked or reasonably able to be linked to an identified or identifiable individual. “Personal data” does not include: De–identified data; or Publicly available information. “Precise geolocation” means information derived from technology that can precisely and accurately identify the specific location of a consumer within a radius of 1,750 feet. “Precise geolocation” includes latitude and longitude coordinates of similar precision to those produced by a global positioning system or a similar mechanism. “Precise geolocation” does not include: The content of communications; Data generated by or connected with a utility company’s advanced metering infrastructure; or Data generated by equipment used by a utility company. “Process” means to perform an operation or set of operations by manual or automated means on personal data. “Process” includes collecting, using, storing, disclosing, analyzing, deleting, or modifying personal data. “Profiling” means any form of automated processing of personal data that uses personal data to evaluate, analyze, or predict certain aspects relating to an individual, including an individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. “Publicly available information” means information that: Is lawfully made available from federal, state, or local government records; or A covered entity has a reasonable basis to believe is lawfully made available to the general public by the consumer or by widely distributed media. “Publicly available information” does not include biometric data collected by a covered entity about a consumer without the consumer’s knowledge. “Reasonably likely to be accessed by children” means it is reasonable to expect that the online product would be accessed by children, based on satisfying any of the following criteria: The online product is directed to children as defined in the federal Children’s Online Privacy Protection Act; The online product is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children; The online product is substantially similar or the same as an online product that satisfies item (2) of this subsection; The online product features advertisements marketed to children; The covered entity’s internal research findings determine that a significant amount of the online product’s audience is composed of children; or The covered entity knows or should have known that a user is a child. “Sell” means to transfer, rent, release, disclose, disseminate, make available, or otherwise communicate, whether orally, in writing, or by electronic or other means, a consumer’s personal data, in a transaction for monetary or other valuable consideration between a covered entity and a third party. “Sell” does not include: The disclosure of personal data to the service provider that processes personal data on behalf of the covered entity; The disclosure of personal data to a third party for purposes of providing a product or service requested by the consumer; The disclosure or transfer of personal data to an affiliate or subsidiary of the covered entity; The disclosure of personal data where the consumer directs the covered entity to disclose the personal data or intentionally uses the covered entity to interact with a third party; or The disclosure or transfer of personal data to a third party as an asset that is part of an actual or proposed merger, acquisition, bankruptcy, or other transaction, in which the third party assumes control of all or part of the covered entity’s assets. “Service provider” means a person that processes personal data on behalf of a covered entity and that receives from or on behalf of the covered entity a consumer’s personal data for business purposes in accordance with a written contract, if the contract prohibits the person from: Selling or sharing the personal data; Retaining, using, or disclosing the personal data for any purpose other than for the business purposes specified in the contract for the covered entity, including retaining, using, or disclosing the personal data for a commercial purpose other than the business purposes specified in the contract with the covered entity, or as otherwise allowed under this subtitle; Retaining, using, or disclosing the personal data outside the direct business relationship between the service provider and the covered entity; and Combining the personal data that the service provider receives from, or on behalf of, the covered entity with personal data that it receives from, or on behalf of, another person or persons, or collects from its own interaction with the consumer. “Share” means to rent, release, disseminate, make available, transfer, or otherwise communicate, whether orally, in writing, or by electronic or other means, a consumer’s personal data to a third party for cross–context behavioral advertising whether or not for monetary or other valuable consideration, including in a transaction between a covered entity and a third party for targeted advertising for the benefit of a covered entity in which no money is exchanged. “Third party” means a person who is not: The covered entity with which the consumer intentionally interacts and that collects personal data from the consumer as part of the consumer’s interaction with the covered entity; or A service provider for the covered entity.

This subtitle does not apply to: Data subject to a statute or regulation identified under item (i) of this item that is controlled by a covered entity or service provider that is: Required to comply with: Title V of the federal Gramm–Leach–Bliley Act; The federal Health Information Technology for Economic and Clinical Health Act; or Regulations promulgated under § 264(c) of the Health Insurance Portability and Accountability Act of 1996; and In compliance with the information security requirements of applicable statutes or regulations identified in item (i) of this item; or Information collected as part of a clinical trial subject to the Federal Policy for the Protection of Human Subjects, in accordance with: Good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; or Human subject protection requirements of the U.S. Food and Drug Administration.

It is the intent of the General Assembly that: Children should be afforded protections not only by online products specifically directed at them, but by all online products they are reasonably likely to access; Covered entities that develop and provide online products that children are reasonably likely to access shall ensure the best interests of children when designing, developing, and providing those online products; All covered entities that operate in the State and process children’s data in any capacity shall do so in a manner consistent with the best interests of children; If a conflict arises between commercial interests and the best interests of children, covered entities that develop online products likely to be accessed by children shall prioritize the privacy, safety, and well–being of children; Nothing in this subtitle may be construed to require a covered entity to monitor or censor third–party content or otherwise impact the existing rights and freedoms of any person; and Nothing in this subtitle may be construed to discriminate against children on the basis of race, color, religion, national origin, disability, gender identity, sex, or sexual orientation.

Subject to paragraph (2) of this subsection, a covered entity that provides an online product reasonably likely to be accessed by children shall prepare a data protection impact assessment for the online product. On or before April 1, 2026, a covered entity shall prepare a data protection impact assessment for any online product that: Meets the criteria under paragraph (1) of this subsection; Is offered to the public on or before April 1, 2026; and Will continue to be offered to the public after July 1, 2026. For an online product that meets the criteria under paragraph (1) of this subsection and is initially offered to the public after April 1, 2026, a covered entity shall complete a data protection impact assessment. The data protection impact assessment shall: Identify the purpose of the online product; Identify how the online product uses children’s data; Determine whether the online product is designed in a manner consistent with the best interests of children reasonably likely to access the online product through consideration of: Whether the data management or processing practices of the online product could lead to children experiencing or being targeted by contacts that would result in: Reasonably foreseeable and material physical or financial harm to children; Reasonably foreseeable and extreme psychological or emotional harm to children; A highly offensive intrusion on children’s reasonable expectation of privacy; or Discrimination against children based on race, color, religion, national origin, disability, gender identity, sex, or sexual orientation; Whether the data management or processing practices of the online product could permit children to participate in or be subject to conduct that would result in: Reasonably foreseeable and material physical or financial harm to children; Reasonably foreseeable and extreme psychological or emotional harm to children; A highly offensive intrusion on children’s reasonable expectation of privacy; or Discrimination against children based on race, color, religion, national origin, disability, gender identity, sex, or sexual orientation; Whether the data management or processing practices of the online product are reasonably expected to allow children becoming party to or exploited by a contract through the online product that would result in: Reasonably foreseeable and material physical or financial harm to children; Reasonably foreseeable and extreme psychological or emotional harm to children; A highly offensive intrusion on children’s reasonable expectation of privacy; or Discrimination against children based on race, color, religion, national origin, disability, gender identity, sex, or sexual orientation; Whether the online product uses system design features to increase, sustain, or extend the use of the online product, including the automatic playing of media, rewards for time spent, and notifications that would result in: Reasonably foreseeable and material physical or financial harm to children; Reasonably foreseeable and extreme psychological or emotional harm to children; A highly offensive intrusion on children’s reasonable expectation of privacy; or Discrimination against children based on race, color, religion, national origin, disability, gender identity, sex, or sexual orientation; Whether, how, and for what purpose the online product collects or processes personal data of children and whether those practices would result in: Reasonably foreseeable and material physical or financial harm to children; Reasonably foreseeable and extreme psychological or emotional harm to children; A highly offensive intrusion on children’s reasonable expectation of privacy; or Discrimination against children based on race, color, religion, national origin, disability, gender identity, sex, or sexual orientation; Whether and how data collected to understand the experimental impact of the product reveals data management or design practices that would result in: Reasonably foreseeable and material physical or financial harm to children; Reasonably foreseeable and extreme psychological or emotional harm to children; A highly offensive intrusion on children’s reasonable expectation of privacy; or Discrimination against children based on race, color, religion, national origin, disability, gender identity, sex, or sexual orientation; Whether algorithms used by the online product would result in: Reasonably foreseeable and material physical or financial harm to children; Reasonably foreseeable and extreme psychological or emotional harm to children; A highly offensive intrusion on children’s reasonable expectation of privacy; or Discrimination against children based on race, color, religion, national origin, disability, gender identity, sex, or sexual orientation; and Any other factor that may indicate that the online product is designed in a manner that is inconsistent with the best interests of children; and Include a description of steps that the covered entity has taken and will take to comply with the duty to act in a manner consistent with the best interests of children. A data protection impact assessment prepared by a covered entity for the purpose of compliance with any other law complies with this section if the assessment meets the requirements of this section. A single data protection impact assessment may contain multiple similar processing operations that present similar risks only if each relevant online product is addressed.

A covered entity required to complete a data protection impact assessment under § 14–4804 of this subtitle shall: Maintain documentation of the assessment for as long as the online product is likely to be accessed by children; Review each data protection impact assessment as necessary to account for material changes to processing pertaining to the online product within 90 days of such material changes; Notwithstanding any other law, configure all default privacy settings provided to children by the online product to offer a high level of privacy, unless the covered entity can demonstrate a compelling reason that a different setting is in the best interests of children; Provide any privacy information, terms of service, policies, and community standards concisely, prominently, and using clear language suited to the age of children likely to access the online product; and Provide prominent, accessible, and responsive tools to help children or their parents or guardians, if applicable, exercise their privacy rights and report concerns.

A covered entity that provides an online product that is accessed or reasonably likely to be accessed by children may not: Process the personal data of a child in a way that is inconsistent with the best interests of children reasonably likely to access the online product; Profile a child by default, unless: The covered entity can demonstrate that the covered entity has appropriate safeguards in place to ensure that profiling is consistent with the best interests of children who access or are reasonably likely to access the online product; and Profiling is necessary to provide the requested online product, and is done only with respect to the aspects of the online product that the child is actively and knowingly engaged with; or The covered entity can demonstrate a compelling reason that profiling is in the best interests of children; Process personal data of a child that is not reasonably necessary to provide an online product that the child is actively and knowingly engaged with; Process the personal data of a child end user for any reason other than a reason for which that personal data was collected; Process any precise geolocation data of a child by default, unless: The collection of the precise geolocation data is strictly necessary for the covered entity to provide the online product; and The precise geolocation data is processed only for the limited time that is necessary to provide the online product; Process any precise geolocation data of a child without providing an obvious signal to the child for the duration that the precise geolocation data is being collected; Use dark patterns to: Cause a child to provide personal data beyond what is reasonably expected to provide the online product; Circumvent privacy protections; or Take any action that the covered entity knows, or has reason to know, is not in the best interests of children who access or are reasonably likely to access the online product; Process any personal data for the purpose of estimating the age of a child that is actively and knowingly engaged with an online product that is not reasonably necessary to provide the online product; or Allow a person other than a child’s parent or guardian to monitor the child’s online activity without first notifying the child and the child’s parent or guardian. A covered entity that provides an online product that is accessed or reasonably likely to be accessed by children may allow a child’s parent or guardian to monitor the child’s online activity or track the child’s location, without providing an obvious signal to the child when the child is being monitored or tracked. In making a determination as to whether an online product is reasonably likely to be accessed by children, a covered entity may not collect or process any personal data beyond what is reasonably necessary to make the determination.

Within 5 business days after receiving a written request from the Division, a covered entity that provides an online product reasonably likely to be accessed by children shall provide to the Division a list of all data protection impact assessments the covered entity has completed under § 14–4804 of this subtitle. Within 7 business days after receiving a written request from the Division, a covered entity shall provide to the Division any data protection impact assessment completed under § 14–4804 of this subtitle. The Division may extend beyond 7 days the amount of time allowed for a covered entity to produce a data protection impact assessment. To the extent that any disclosure required under subsection (b) of this section includes information subject to attorney–client privilege or work–product protection, the disclosure may not constitute a waiver of that privilege or protection.

A violation of this subtitle: Is an unfair, abusive, or deceptive trade practice; and Except for § 13–410 of this article, is subject to the enforcement provisions contained in Title 13 of this article. A covered entity that violates this subtitle is subject to a civil penalty not exceeding: $2,500 per affected child for each negligent violation; and $7,500 per affected child for each intentional violation. The Division shall pay all fines, penalties, and expenses collected by the Division under this subsection into the General Fund with the intent that fines, penalties, and expenses be used to fully offset any costs incurred by the Division in connection with this subtitle.

If a covered entity is in substantial compliance with the requirements of §§ 14–4804 through 14–4806 of this subtitle, the Division shall provide written notice to the covered entity before filing an action under § 14–4808 of this subtitle. Notice given under subsection (a) of this section shall identify the specific provisions of this subtitle that the Division alleges have been or are being violated. A covered entity may not be liable for a civil penalty for a violation for which notice is given under subsection (a) of this section if the covered entity: Has completed a data protection impact assessment under § 14–4804(a)(2) of this subtitle for existing online products that are reasonably likely to be accessed by children; Has completed a data protection impact assessment under § 14–4804(a)(3) of this subtitle prior to offering to the public a new online product that is reasonably likely to be accessed by children; Cures the violation specified in the Division’s notice within 90 days after issuance of the notice under subsection (a) of this section; Provides the Division with a written statement that the alleged violation has been cured; and Takes measures to prevent any future violation that the Division agreed to be sufficient.

Nothing in this subtitle may be interpreted or construed to: Provide a private right of action under this subtitle or any other law; Impose liability in a manner that is inconsistent with 47 U.S.C. § 230; Prevent or preclude a child from deliberately or independently searching for or specifically requesting content; or Require a covered entity to implement an age–gating requirement.

Notwithstanding any other law, a data protection impact assessment is protected as confidential and shall be exempt from public disclosure, including under the Maryland Public Information Act.

Wherever possible, law relating to consumers’ personal data should be construed to harmonize with the provisions of this subtitle. In the event of a conflict between other laws and this subtitle, the provisions of the law that afford the greatest protection for the right of privacy for consumers shall control.

This subtitle may be cited as the Maryland Age–Appropriate Design Code Act.