EXPLANATION: CAPITALS INDICATE MAT TER ADDED TO EXISTIN G LAW.
[Brackets] indicate matter deleted from existing law.
Underlining indicates amendments to bill.
Strike out indicates matter stricken from the bill by amendment or deleted from the law by
amendment.
*hb0901*
HOUSE BILL 901
I3, S1 3lr1083
CF SB 844
By: Delegates Solomon and Wilson
Introduced and read first time: February 9, 2023
Assigned to: Economic Matters
Committee Report: Favorable with amendments
House action: Adopted
Read second time: March 11, 2023
CHAPTER ______
AN ACT concerning 1
Consumer Protection – Online Products and Services – Children’s Data 2
FOR the purpose of requiring a business that offers an online product likely to be accessed 3
by children to complete a certain data protection impact assessment under certain 4
circumstances; prohibiting a business from offering a certain online product before 5
completing a data protection impact assessment; requiring businesses to document 6
certain risks associated with certain online products; requiring certain privacy 7
protections for certain online products; prohibiting certain data collection and 8
sharing practices; providing certain exemptions; and generally relating to the 9
protection of online privacy of children. 10
BY repealing and reenacting, with amendments, 11
Article – Commercial Law 12
Section 13–301(14)(xxxv) 13
Annotated Code of Maryland 14
(2013 Replacement Volume and 2022 Supplement) 15
BY repealing and reenacting, without amendments, 16
Article – Commercial Law 17
Section 13–301(14)(xxxvi) 18
Annotated Code of Maryland 19
(2013 Replacement Volume and 2022 Supplement) 20
BY adding to 21
Article – Commercial Law 22 2 HOUSE BILL 901
Section 13–301(14)(xxxvii); and 14–4501 through 14–4513 to be under the new 1
subtitle “Subtitle 45. Maryland Age–Appropriate Design Code Act” 2
Annotated Code of Maryland 3
(2013 Replacement Volume and 2022 Supplement) 4
Preamble 5
WHEREAS, The United Nations Convention on the Rights of the Child recognizes 6
that children need special safeguards and care in all aspects of their lives, specifying how 7
children’s rights apply in the digital environment in General Comment No. 25; and 8
WHEREAS, As children spend more of their time interacting with the online world, 9
the impact of the design of online products on their well–being has become a focus of 10
significant concern; and 11
WHEREAS, There is widespread agreement at the international level, and 12
bipartisan agreement in the United States, that more needs to be done to create a safer 13
online space for children to learn, explore, and play; and 14
WHEREAS, Lawmakers around the globe have taken steps to enhance privacy 15
protections for children based on the understanding that, in relation to data protection, 16
greater privacy necessarily means greater security and well–being; and 17
WHEREAS, Children should be afforded protections not only by online products and 18
services specifically directed at them, but by all online products they are likely to access, 19
and thus businesses should take into account the unique needs of different age ranges, 20
including the following developmental stages: 0 to 5 years of age, or “preliterate and early 21
literacy”; 6 to 9 years of age, or “core primary school years”; 10 to 12 years of age, or 22
“transition years”; 13 to 15 years of age, or “early teens”; and 16 to 17 years of age, or 23
“approaching adulthood”; and 24
WHEREAS, While it is clear that the same data protection regime may not be 25
appropriate for children of all ages, children of all ages should nonetheless be afforded 26
privacy and protection, and online products should adopt data protection regimes 27
appropriate for children of the ages likely to access those products; and 28
WHEREAS, According to the Pew Research Center, in 2022, 97% of American 29
teenagers aged 13–17 used the Internet every day, with 46% responding they used the 30
Internet almost constantly; and, additionally, 36% of teens reported being concerned about 31
their social media use, while an earlier Pew Research Center study found that 59% of teens 32
have been bullied or harassed online; and 33
WHEREAS, The findings of the Pew Research Center are not surprising, given what 34
is known about controllers’ use of personal data and how it is utilized to inform 35
manipulative practices, to which children are particularly vulnerable; and 36
HOUSE BILL 901 3
WHEREAS, Online products that are likely to be accessed by children should offer 1
strong privacy protections by design and by default, including by disabling features that 2
profile children using their previous behavior, browsing history, or assumptions of their 3
similarity to other children in order to offer them detrimental material; and 4
WHEREAS, Ensuring robust privacy, and thus safety, protections for children by 5
design is consistent with federal safety laws and policies applied to children’s products, 6
regulating everything from toys to clothing to furniture and games; and 7
WHEREAS, The consumer protections that federal safety laws apply to children’s 8
products require these products to comply with certain safety standards by their very 9
design, so that harms to children, and in some cases other consumers, are prevented; and 10
WHEREAS, It is the intent of the Maryland General Assembly that the Maryland 11
Age–Appropriate Design Code Act promote innovation by businesses whose online products 12
are likely to be accessed by children by ensuring that those online products are designed in 13
a manner that recognizes the distinct needs of children within different age ranges; and 14
WHEREAS, It is the intent of the Maryland General Assembly that businesses 15
covered by the Maryland Age–Appropriate Design Code Act may look to guidance and 16
innovation in response to the Age–Appropriate Design Code established in the United 17
Kingdom and California when developing online products that are likely to be accessed by 18
children; now, therefore, 19
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 20
That the Laws of Maryland read as follows: 21
Article – Commercial Law 22
13–301. 23
Unfair, abusive, or deceptive trade practices include any: 24
(14) Violation of a provision of: 25
(xxxv) Section 11–210 of the Education Article; [or] 26
(xxxvi) Title 14, Subtitle 44 of this article; or 27
(XXXVII) TITLE 14, SUBTITLE 45 OF THIS ARTICLE; OR 28
SUBTITLE 45. MARYLAND AGE–APPROPRIATE DESIGN CODE ACT. 29
14–4501. 30
4 HOUSE BILL 901
(A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS 1
INDICATED. 2
(B) (1) “AGGREGATE CONSUMER IN FORMATION” MEANS INFORMATION : 3
(I) THAT RELATES TO A GRO UP OR CATEGORY OF CO NSUMERS; 4
(II) FROM WHICH INDIVIDUAL CONSUMER IDENTITIES HAVE 5
BEEN REMOVED ; AND 6
(III) THAT IS NOT LINKED OR REASONABLY LINKABLE TO ANY 7
CONSUMER OR HOUSEHOL D, INCLUDING BY A DEVIC E. 8
(2) “AGGREGATE CONSUMER IN FORMATION” DOES NOT INCLUDE 9
INDIVIDUAL CONSUMER RECORDS THAT HAVE BE EN DEIDENTIFIED . 10
(C) (1) “BIOMETRIC INFORMATION ” MEANS INFORMATION GE NERATED 11
BY AUTOMATIC MEASURE MENTS OF AN INDIVIDU AL’S BIOLOGICAL 12
CHARACTERISTICS . 13
(2) “BIOMETRIC INFORMATION ” INCLUDES: 14
(I) A FINGERPRINT ; 15
(II) A VOICEPRINT; 16
(III) EYE RETINA OR IRIS PA TTERN; OR 17
(IV) ANY OTHER UNIQUE BIOL OGICAL PATTERNS OR 18
CHARACTERISTICS THAT ARE USED TO IDENTIFY A SPECIFIC INDIVIDUA L. 19
(3) “BIOMETRIC INFORMATION ” DOES NOT INCLUDE : 20
(I) A DIGITAL OR PHYSICAL PHOTOGRAPH ; 21
(II) AN AUDIO OR VIDEO RECORDING ; OR 22
(III) ANY DATA GENERATED FR OM A DIGITAL OR PHYS ICAL 23
PHOTOGRAPH , OR AN AUDIO OR VIDEO RECORDING, UNLESS THE DATA IS 24
GENERATED TO IDENTIF Y A SPECIFIC INDIVID UAL. 25
(C) (D) (1) “BUSINESS” MEANS A SOLE PROPRIE TORSHIP, LIMITED 26
LIABILITY COMPANY, CORPORATION , ASSOCIATION, OR OTHER LEGAL ENTIT Y THAT: 27
HOUSE BILL 901 5
(I) IS ORGANIZED OR OPERA TED FOR THE PROFIT O R 1
FINANCIAL BENEFIT OF ITS SHAREHOLDERS OR OTHER OWNERS ; 2
(II) COLLECTS CONSUMERS ’ PERSONAL INFORMATION , OR ON 3
THE BEHALF OF WHICH ANOTHER COLLECTS CON SUMERS’ PERSONAL 4
INFORMATION ; 5
(III) ALONE, OR JOINTLY WITH ITS AFFILIATES OR 6
SUBSIDIARIES, DETERMINES THE PURPO SES AND MEANS OF THE PROCESSING OF 7
CONSUMERS ’ PERSONAL INFORMATION ; 8
(IV) DOES BUSINESS IN THE STATE; AND 9
(V) SATISFIES AT LEAST ONE O F THE FOLLOWING CRIT ERIA: 10
1. THE BUSINESS HAS ANNU AL GROSS REVENUES IN 11
EXCESS OF $25,000,000, ADJUSTED EVERY ODD –NUMBERED YEAR TO REF LECT 12
ADJUSTMENTS IN THE CONSUMER PRICE INDEX; 13
2. THE BUSINESS ANNUALLY BUYS, RECEIVES, SELLS, 14
OR SHARES THE PERSON AL INFORMATION OF 50,000 OR MORE CONSUMERS , 15
HOUSEHOLDS , OR DEVICES, ALONE OR IN COMBINAT ION WITH ITS AFFILIA TES OR 16
SUBSIDIARIES, AND FOR THE BUSINESS ’S COMMERCIAL PURPOSE S; OR 17
3. THE BUSINESS DERIVES AT LEAST 50% OF ITS 18
ANNUAL REV ENUES FROM THE SALE OF CONSUMERS ’ PERSONAL INFORMATION . 19
(2) “BUSINESS” INCLUDES: 20
(I) AN ENTITY THAT CONTRO LS OR IS CONTROLLED BY A 21
BUSINESS AND THAT SH ARES COMMON BRANDING WITH THAT BUSINESS ; AND 22
(II) A JOINT VENTURE OR PAR TNERSHIP COMPOSED OF 23
BUSINESSES IN WHICH EACH HAS AT LEAST A 40% INTEREST IN THE JOIN T VENTURE 24
OR PARTNERSHIP . 25
(D) (E) “CHILD” MEANS A CONSUMER THA T IS UNDER THE AGE O F 18 26
YEARS. 27
(E) (F) “COLLECT” MEANS TO ACTIVELY OR PASSIVEL Y BUY, RENT, 28
GATHER, OBTAIN, RECEIVE, OR ACCESS ANY PERSONAL INFORMA TION PERTAINING 29
TO A CONSUMER OR OBSERVE A CONSUMER ’S BEHAVIOR, BY ANY MEANS BUY, RENT, 30
GATHER, OBTAIN, RECEIVE, OR ACCESS ANY PERSON AL INFORMATION RELAT ING TO 31
A CONSUMER . 32 6 HOUSE BILL 901
(F) (G) “COMMON BRANDING ” MEANS A SHARED NAME , SERVICE MARK , 1
OR TRADEMARK THAT WO ULD CAUSE A REASONAB LE CONSUMER TO UNDER STAND 2
THAT TWO OR MORE ENT ITIES ARE COMMONLY O WNED. 3
(G) (H) (1) “CONSUMER” MEANS AN INDIVIDUAL WHO IS A RESIDENT 4
OF THE STATE, HOWEVER IDENTIFIED , INCLUDING BY ANY UNI QUE IDENTIFIER. 5
(2) “CONSUMER” DOES NOT INCLUDE AN INDIVIDUAL ACTING IN A 6
COMMERCIAL OR EMPLOY MENT CONTEXT OR AS A N EMPLOYEE, OWNER, DIRECTOR, 7
OFFICER, OR CONTRACTOR OF A C OMPANY, PARTNERSHIP , SOLE PROPRIETORSHIP , 8
NONPROFIT ORGANIZATI ON, OR GOVERNMENT AGENCY WHOSE COMMUNICATIO NS 9
OR TRANSACTIONS WITH THE BUSINESS OCCUR S OLELY WITHIN THE CON TEXT OF 10
THAT INDIVIDUAL ’S ROLE WITH THE COMP ANY, PARTNERSHIP , SOLE 11
PROPRIETORSHIP , NONPROFIT, OR GOVERNMENT AGENCY . 12
(H) (I) “CONTROL” MEANS: 13
(1) OWNERSHIP OF OR THE P OWER TO VOTE MORE TH AN 50% OF THE 14
OUTSTANDING SHARES O F ANY CLASS OF VOTIN G SECURITY OF A BUSI NESS; 15
(2) ANY MANNER OF CONTROL OVER THE ELECTION OF A MAJORITY 16
OF THE DIRECTORS OF A BUSINESS, OR INDIVIDUALS EXERC ISING SIMILAR 17
FUNCTIONS; OR 18
(3) THE POWER TO EXERCISE A CONTROLLING INFLUENCE OV ER THE 19
MANAGEMENT OF A BUSI NESS. 20
(I) (J) “DARK PATTERN ” MEANS A USER INTERFA CE DESIGNED OR 21
MANIPULATED WITH THE SUBSTANTIAL EFFECT O F SUBVERTING OR IMPA IRING 22
USER AUTONOMY , DECISION MAKING , OR CHOICE. 23
(J) (K) “DATA PROTECTION IMPAC T ASSESSMENT ” OR “ASSESSMENT” 24
MEANS A SYSTEMATIC S URVEY TO ASSESS AND MITIGATE RISKS TO CH ILDREN WHO 25
ARE REASONABLY LIKEL Y TO ACCESS THE ONLI NE PRODUCT AT ISSUE THAT ARISE 26
FROM THE DATA MANAGE MENT PRACTICES OF TH E BUSINESS AND THE P ROVISION 27
OF THE ONLINE P RODUCT. 28
(K) (L) “DEFAULT” MEANS A PRESELECTED OPTION ADOPTED BY TH E 29
BUSINESS FOR AN ONLI NE PRODUCT. 30
(L) (M) “DEIDENTIFIED INFORMAT ION” MEANS INFORMATION TH AT 31
CANNOT REASONABLY BE USED TO REASONABLY INFER INFORMATION AB OUT, OR 32 HOUSE BILL 901 7
OTHERWISE BE LINKED TO, A PARTICULAR AN IDENTIFIED OR IDE NTIFIABLE 1
CONSUMER , IF THE BUSINESS THAT POSSESSES THE INFORM ATION: 2
(1) TAKES REASONABLE MEAS URES TO ENSURE THAT THE 3
INFORMATION CANNOT B E ASSOCIATED LINKED WITH A CONSUMER OR H OUSEHOLD; 4
(2) COMMITS IN PUBLICLY A VAILABLE TERMS AND CONDITIO NS OR IN 5
A PUBLICLY AVAILABLE PRIVACY POLICY TO : 6
(I) MAINTAIN AND USE THE INFORMATION IN DEIDE NTIFIED 7
FORM; AND 8
(II) NOT ATTEMPT TO REIDEN TIFY THE INFORMATION , EXCEPT 9
FOR THE SOLE PURPOSE OF DETERMINING WHETH ER THE BUSINESS ’S 10
DEIDENTIFICATION PROCE SS SATISFIES THE REQ UIREMENTS OF THIS SU BSECTION; 11
AND 12
(3) CONTRACTUALLY OBLIGAT ES ANY RECIPIENTS OF THE 13
INFORMATION TO COMPL Y WITH ALL PROVISION S OF THIS SUBSECTION . 14
(M) (N) “LIKELY TO BE ACCESSED BY CHILDREN ” MEANS REASONABLY 15
EXPECTED THAT THE ON LINE SERVICE , PRODUCT, OR FEATURE WOULD BE 16
ACCESSED BY CHILDREN , BASED ON SATISFYING ANY OF THE FOLLOWING CRITERIA: 17
(1) THE ONLINE PRODUCT IS DIRECTED TO CHILDREN AS DEFINED IN 18
THE FEDERAL CHILDREN’S ONLINE PRIVACY PROTECTION ACT; 19
(2) THE ONLINE PRODUCT IS DETERMINED , BASED ON COMPETENT 20
AND RELIABLE EVIDENC E REGARDING AUDIENCE COMPOSITION , TO BE ROUTINELY 21
ACCESSED BY A SIGNIF ICANT NUMBER OF CHIL DREN; 22
(3) THE ONLINE PRODUCT IS SUBSTANTIALLY SIMILA R OR THE SAME 23
AS AN ONLINE PRODUC T THAT SATISFIES ITE M (2) OF THIS SUBSECTION ; 24
(4) THE ONLINE PRODUCT FE ATURES ADVERTISEMENT S MARKETED 25
TO CHILDREN; 26
(5) THE ONLINE PRODUCT HA S DESIGN ELEMENTS TH AT ARE KNOWN 27
TO BE OF INTEREST TO CHILDREN, SUCH AS GAMES , CARTOONS, MUSIC, AND 28
CELEBRITIES WHO APPEAL TO CHIL DREN; OR 29
(6) THE BUSINESS KNOWS , BASED ON INTERNAL RE SEARCH, THAT A 30
SIGNIFICANT AMOUNT O F THE ONLINE PRODUCT ’S AUDIENCE IS CHILDR EN. 31
8 HOUSE BILL 901
(N) (O) (1) “ONLINE PRODUCT ” MEANS AN ONLINE SERV ICE, PRODUCT, 1
OR FEATURE. 2
(2) “ONLINE PRODUCT ” DOES NOT INCLUDE : 3
(I) A TELECOMMUNICATIONS S ERVICE, AS DEFINED IN 47 4
U.S.C. § 153; OR 5
(II) THE DELIVERY SALE, DELIVERY, OR USE OF A PHYSICAL 6
PRODUCT SOLD BY AN O NLINE RETAILER ; OR 7
(III) A BROADBAND INTERNET ACCESS SERVI CE, AS DEFINED IN 8
47 C.F.R. § 8.1(B). 9
(O) (P) (1) “PERSONAL INFORMATION ” MEANS INFORMATION TH AT 10
IDENTIFIES, RELATES TO , DESCRIBES, IS REASONABLY CAPABL E OF BEING 11
ASSOCIATED WITH , OR COULD REASONABLY BE LINKED, DIRECTLY OR INDIRECT LY, 12
WITH A PARTICULAR CO NSUMER OR HOUSEHOLD . 13
(2) “PERSONAL INFORMATION ” DOES NOT INCLUDE : 14
(I) PUBLICLY AVAILABLE IN FORMATION OR LAWFULL Y 15
OBTAINED, TRUTHFUL INFORMATION THAT IS OF PUBLIC CO NCERN; OR 16
(II) CONSUMER INFORMATION THAT IS DEIDENTIFIED OR 17
AGGREGATE CONSUMER I NFORMATION . 18
(P) (Q) “PRECISE GEOLOCATION ” MEANS ANY DATA THAT IS: 19
(1) DERIVED FROM A DEVICE ; AND 20
(2) USED OR INTENDED TO B E USED TO LOCATE A C ONSUMER WITHIN 21
A GEOGRAPHIC AREA TH AT IS LESS THAN OR E QUAL TO THE AREA OF A CIRCLE WITH 22
A RADIUS OF 1,850 FEET. 23
(Q) (R) (1) “PROFILING” MEANS ANY FORM OF AU TOMATED 24
PROCESSING OF PERSON AL INFORMATION THAT USES PERSONAL INFORM ATION TO 25
EVALUATE OR PREDICT CERTAIN ASPECTS RELA TING TO AN INDIVIDUA L. 26
(2) “PROFILING” INCLUDES ANALYZING O R PREDICTING ASPECTS 27
CONCERNING , INCLUDING AN INDIVIDUAL’S PERFORMANCE AT WOR K, ECONOMIC 28
SITUATION, HEALTH, PERSONAL PREFERENCES , INTERESTS, RELIABILITY, 29
BEHAVIOR, LOCATION, OR MOVEMENTS . 30
HOUSE BILL 901 9
(R) (S) (1) “PUBLICLY AVAILABLE IN FORMATION” MEANS 1
INFORMATION THAT : 2
(I) IS LAWFULLY MADE AVAI LABLE FROM FED ERAL, STATE, OR 3
LOCAL GOVERNMENT REC ORDS; OR 4
(II) A BUSINESS HAS A REASO NABLE BASIS TO BELIE VE IS 5
LAWFULLY MADE AVAILA BLE TO THE GENERAL P UBLIC BY THE CONSUME R OR BY 6
WIDELY DISTRIBUTED M EDIA. 7
(2) “PUBLICLY AVAILABLE IN FORMATION” DOES NOT INCLUDE 8
BIOMETRIC INFORMATIO N COLLECTED BY A BUS INESS ABOUT A CONSUM ER 9
WITHOUT THE CONSUMER ’S KNOWLEDGE . 10
(S) (T) (1) “SELL” MEANS TO TRANSFER , RENT, RELEASE, DISCLOSE, 11
DISSEMINATE, MAKE AVAILABLE , OR OTHERWISE COMMUNI CATE, WHETHER 12
ORALLY, IN WRITING, OR BY ELECT RONIC OR OTHER MEANS , A CONSUMER ’S 13
PERSONAL INFORMATION BY THE BUSINESS TO A THIRD PARTY FOR MONE TARY OR 14
OTHER VALUABLE CONSI DERATION. 15
(2) “SELL” DOES NOT INCLUDE : 16
(I) THE DISCLOSURE OF PER SONAL INFORMATION TO A 17
SERVICE PROVIDER THA T PROCESSES PERSO NAL INFORMATION ON B EHALF OF THE 18
BUSINESS; 19
(II) THE DISCLOSURE OF PER SONAL INFORMATION TO A THIRD 20
PARTY FOR PURPOSES O F PROVIDING A PRODUC T OR SERVICE REQUEST ED BY THE 21
CONSUMER ; 22
(III) THE DISCLOSURE OF PER SONAL INFORMATION WH ERE THE 23
CONSUMER DIRECT S THE BUSINESS TO DI SCLOSE THE PERSONAL INFORMATION OR 24
INTENTIONALLY USES T HE BUSINESS TO INTER ACT WITH A THIRD PAR TY; OR 25
(IV) THE DISCLOSURE OR TRA NSFER OF PERSONAL 26
INFORMATION TO A THI RD PARTY AS AN ASSET THAT IS PART OF AN A CTUAL OR 27
PROPOSED MERGER , ACQUISITION, BANKRUPTCY , OR OTHER TRANSACTION , IN 28
WHICH THE THIRD PART Y ASSUMES CONTROL OF ALL OR PART OF THE B USINESS’S 29
ASSETS. 30
(T) (U) (1) “SENSITIVE PERSONAL IN FORMATION” MEANS: 31
(I) PERSONAL INFORMATION THAT REVEALS A CONSU MER’S: 32
10 HOUSE BILL 901
1. SOCIAL SECURITY NUMBER , DRIVER’S LICENSE 1
NUMBER, STATE IDENTIFICATION CARD NUMBER , OR PASSPORT NUMBER ; 2
2. ACCOUNT LOGIN INFORMA TION, FINANCIAL 3
ACCOUNT NUMBER , DEBIT CARD NUMBER , OR CREDIT CARD NUMBE R, IN 4
COMBINATION WITH ANY REQUIRED SECURITY OR ACCESS CODE, PASSWORD, OR 5
CREDENTIALS THAT ALL OW ACCESS TO AN ACCO UNT; 6
3. PRECISE GEOLOCATION ; 7
4. RACIAL OR ETHNIC ORIG IN OR RELIGIOUS OR 8
PHILOSOPHICAL BELIEF S; 9
5. UNION MEMBERSHIP STAT US; 10
6. 5. MAIL, E–MAIL, TEXT, OR MESSAGE CONTENTS , 11
UNLESS THE BUSINESS IS THE INTENDED RECIPIENT ; OR 12
7. 6. GENETIC DATA; 13
(II) BIOMETRIC INFORMATION THAT IS OR MAY BE PR OCESSED 14
FOR THE PURPOSE OF U NIQUELY IDENTIFYING A CONSUMER ; 15
(III) PERSONAL INFORMATION COLLECTED AND ANALYZ ED 16
CONCERNING A CONSUME R’S HEALTH; OR 17
(IV) PERSONAL INFORMATION COLLECTED AND ANALYZ ED 18
CONCERNING A CONSUME R’S SEX LIFE OR SEXUAL ORIENTATION . 19
(2) “SENSITIVE PERSONAL IN FORMATION” DOES NOT INCLUDE 20
PUBLICLY AVAILABLE I NFORMATION . 21
(V) “SERVICE PROVIDER ” MEANS A PERSON THAT PROCESSES PERSONAL 22
INFORMATION ON BEHAL F OF A BUSINESS AND THAT RECEIVES FROM O R ON BEHALF 23
OF THE BUSINESS , A CONSUMER ’S PERSONAL INFORMATI ON FOR A BUSINESS 24
PURPOSE IN ACCORDANC E WITH A WRITTEN CON TRACT, IF THE CONTRACT 25
PROHIBITS THE PERSON FROM: 26
(1) SELLING OR SHARING TH E PERSONAL INFORMATI ON; 27
(2) RETAINING, USING, OR DISCLOSING THE PE RSONAL 28
INFORMATION FOR ANY PURPOSE OTHER THAN F OR THE BUSINESS PURP OSES 29
SPECIFIED IN THE CON TRACT FOR THE BUSINE SS, INCLUDING RETAINING , USING, 30
OR DISCLOSING THE PE RSONAL INFORMATION FOR A COMMERCIAL PURPOSE 31 HOUSE BILL 901 11
OTHER THAN THE BUSIN ESS PURPOSES SPECIFI ED IN THE CONTRACT W ITH THE 1
BUSINESS, OR AS OTHERWISE ALLO WED UNDER THIS SUBTI TLE; 2
(3) RETAINING, USING, OR DISCLOSING THE PE RSONAL 3
INFORMATION OUTSIDE OF THE DIRECT BUSINESS RELATIONSHI P BETWEEN THE 4
SERVICE PROVIDER AND THE BUSINESS; AND 5
(4) COMBINING THE PERSONA L INFORMATION THAT T HE SERVICE 6
PROVIDER RECEIVES FR OM, OR ON BEHALF OF , THE BUSINESS WITH PE RSONAL 7
INFORMATION THAT IT RECEIVES FROM , OR ON BEHALF OF , ANOTHER PERSON OR 8
PERSONS, OR COLLECTS FROM ITS OWN INTERACTION WITH THE CONSUMER . 9
(U) (W) “SHARE” MEANS TO RENT , RELEASE, DISCLOSE, DISSEMINATE, 10
MAKE AVAILABLE , TRANSFER, OR OTHERWISE COMMUNI CATE, WHETHER ORALLY , 11
IN WRITING, OR BY ELECTRONIC OR OTHER MEANS , A CONSUMER ’S PERSONAL 12
INFORMATION TO A THI RD PARTY FOR CROSS –CONTEXT BEHAVIORAL A DVERTISING 13
WHETHER OR NOT FOR M ONETARY OR OTHER VAL UABLE CONSIDERATION , 14
INCLUDING IN A TRANS ACTION BETWEEN A BUS INESS AND A THIRD PA RTY FOR 15
CROSS–CONTEXT BEHAVIORAL TARGETED ADVERTISING FOR THE BENEFIT OF A 16
BUSINESS IN WHICH NO MONEY IS EXCHANGED . 17
(X) (1) “TARGETED ADVERTISING ” MEANS DISPLAYING 18
ADVERTISEMENTS TO A CONSUMER WHERE THE A DVERTISEMENT IS SELE CTED 19
BASED ON PERSONAL IN FORMATION OBTAINED O R INFERRED FROM THAT 20
CONSUMER ’S ACTIVITIES OVER TI ME AND ACROSS NONAFF ILIATED INTERNET 21
WEBSITES OR ONLINE A PPLICATIONS TO PREDI CT THE CONSUMER ’S PREFERENCES 22
OR INTERESTS. 23
(2) “TARGETED ADVERTISING ” DOES NOT INCLUDE : 24
(I) ADVERTISEMENTS BASED ON ACTIVITIES WITHIN A 25
BUSINESS’S OWN INTERNET WEBSITES OR ONLINE APPLICATIONS ; 26
(II) ADVERTISEMENTS BASED ON THE CONTEXT OF A 27
CONSUMER ’S CURRENT SEARCH QUERY , VISIT TO AN INTERNET WEBSITE OR O NLINE 28
APPLICATION; 29
(III) ADVERTISEMENTS DIRECT ED TO A CONSUMER IN 30
RESPONSE TO THE CONS UMER’S REQUEST FOR INFORM ATION OR FEEDBACK ; OR 31
(IV) PROCESSING PERSONAL I NFORMATION SOLELY TO 32
MEASURE OR RE PORT ADVERTISING FRE QUENCY, PERFORMANCE , OR REACH. 33
(V) (Y) “THIRD PARTY” MEANS A PERSON WHO I S NOT: 34 12 HOUSE BILL 901
(1) THE BUSINESS WITH WHI CH THE CONSUMER INTE NTIONALLY 1
INTERACTS AND THAT C OLLECTS PERSONAL INF ORMATION FROM THE CO NSUMER 2
AS PART OF THE CONSU MER’S INTERACTION WITH THE B USINESS; OR 3
(2) A SERVICE PROVIDER FOR THE BUSINESS. 4
14–4502. 5
THIS SUBTITLE DOES NO T APPLY TO: 6
(1) PROTECTED HEALTH INFO RMATION THAT IS COLL ECTED BY A 7
COVERED ENTITY OR BU SINESS ASSOCIATION G OVERNED BY THE PRIVA CY 8
SECURITY AND BREACH NOTIFICATION RULES IN 45 C.F.R. PARTS 160 AND 164, 9
ESTABLISHED UNDER TH E FEDERAL HEALTH INSURANCE PORTABILITY AND 10
ACCOUNTABILITY ACT OF 1996 AND THE FEDERAL HEALTH INFORMATION 11
TECHNOLOGY FOR ECONOMIC AND CLINICAL HEALTH ACT; 12
(2) A HEALTH PROVIDER OR COVERED ENTITY GO VERNED BY THE 13
PRIVACY SECURITY AND BREACH NOTIFICATION RULES IN 45 C.F.R. PARTS 160 AND 14
164, ESTABLISHED UNDER TH E FEDERAL HEALTH INSURANCE PORTABILITY AND 15
ACCOUNTABILITY ACT OF 1996 AND THE FEDERAL HEALTH INFORMATION 16
TECHNOLOGY FOR ECONOMIC AND CLINICAL HEALTH ACT, TO THE EXTENT THAT 17
THE PROVIDER OR COVE RED ENTITY MAINTAINS PATIENT INFORMATION IN THE 18
SAME MANNER AS MEDIC AL INFORMATION OR PR OTECTED HEALTH INFOR MATION 19
AS DESCRIBED IN ITEM (1) OF THIS SECTION; OR 20
(3) INFORMATION COLLEC TED AS PART OF A CLI NICAL TRIAL 21
SUBJECT TO THE FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS, 22
IN ACCORDANCE WITH : 23
(I) GOOD CLINICAL PRACTIC E GUIDELINES ISSUED BY THE 24
INTERNATIONAL COUNCIL FOR HARMONISATION OF TECHNICAL REQUIREMENTS 25
FOR PHARMACEUT ICALS FOR HUMAN USE; OR 26
(II) HUMAN SUBJECT PROTECT ION REQUIREMENTS OF THE 27
U.S. FOOD AND DRUG ADMINISTRATION . 28
14–4503. 29
IT IS THE INTENT OF T HE GENERAL ASSEMBLY THAT : 30
HOUSE BILL 901 13
(1) CHILDREN SHOULD BE AF FORDED PROTECTIONS N OT ONLY BY 1
ONLINE PRODUCTS SPEC IFICALLY DIRECTED AT THE M, BUT BY ALL ONLINE 2
PRODUCTS THEY ARE LI KELY TO ACCESS ; 3
(2) BUSINESSES THAT DEVEL OP AND PROVIDE ONLIN E SERVICES 4
THAT CHILDREN ARE LI KELY TO ACCESS SHOUL D CONSIDER THE BEST INTERESTS 5
OF CHILDREN WHEN DES IGNING, DEVELOPING , AND PROVID ING THOSE ONLINE 6
PRODUCTS; AND 7
(3) IF A CONFLICT ARISES BETWEEN COMMERCIAL I NTERESTS AND 8
THE BEST INTERESTS O F CHILDREN, COMPANIES THAT DEVEL OP ONLINE PRODUCTS 9
LIKELY TO BE ACCESSE D BY CHILDREN SHALL GIVE PRIORITY TO THE PRIVACY, 10
SAFETY, AND WELL–BEING OF CHILDREN OVER THO SE COMMERCIAL INTERE STS. 11
14–4504. 12
WHEN DETERMINING WHET HER AN ACTION IS IN THE BEST INTERESTS O F 13
CHILDREN, A BUSINESS SHALL CON SIDER CHILDREN ’S: 14
(1) PRIVACY; 15
(2) SAFETY; 16
(3) PHYSICAL HEALTH ; AND 17
(4) MENTAL HEALTH . 18
14–4504. 14–4505. 19
(A) THIS SECTION APPLIES ONLY TO AN ONLINE PR ODUCT THAT IS 20
OFFERED TO THE PUBLI C ON OR AFTER JULY 1, 2024 APRIL 1, 2025. 21
(B) A BUSINESS THAT PROVID ES AN ONLINE PRODUCT LIKELY TO BE 22
ACCESSED BY CHILDREN SHALL PREPARE A DATA PROTECTION IMPACT 23
ASSESSMENT FOR THE O NLINE PRODUCT . 24
(C) THE DATA PROTECTION I MPACT ASSESSMENT SHA LL: 25
(1) IDENTIFY THE PURPOSE OF THE ONLINE PRODUC T; 26
(2) IDENTIFY HOW THE ONLI NE PRODUCT USES CHIL DREN’S 27
PERSONAL INFORMATION ; 28
14 HOUSE BILL 901
(3) IDENTIFY THE RISKS OF MATERIAL DETRIMENT TO CHIL DREN 1
THAT ARISE FROM THE DATA MANAGEMENT PRAC TICES OF THE BUSINES S; AND 2
(4) ADDRESS, TO THE EXTENT APPLIC ABLE: 3
(I) WHETHER THE DESIGN OF THE ONLINE PRODUCT C OULD 4
HARM CHILDREN , INCLUDING BY EXPOSIN G THEM TO HARMFUL OR POTENTIALLY 5
HARMFUL CONTENT ON T HE ONLINE PRODUCT ; 6
(I) WHETHER ALGORITHMS US ED BY THE ONLINE PRO DUCT 7
COULD RESULT IN HARM TO CHILDREN; 8
(II) WHETHER THE DESIGN DATA MANAGEMENT PRAC TICES OF 9
THE ONLINE PRODUCT C OULD LEAD TO CHILDRE N EXPERIENCING OR BE ING 10
TARGETED BY HARMFUL , OR POTENTIALLY HARMF UL, CONTACTS ON THE ONLI NE 11
PRODUCT; 12
(III) WHETHER THE DESIGN DATA MANAGEMENT PRAC TICES OF 13
THE ONLINE PRODUCT C OULD ALLOW CHILDREN TO WITNESS, PARTICIPATE IN, OR 14
BE SUBJECT TO HARMFU L OR POTENTIALLY HAR MFUL CONDUCT ON THE ONLINE 15
PRODUCT; 16
(IV) WHETHER THE DESIGN DATA MANAGEMENT PRAC TICES OF 17
THE ONLINE PRODUCT C OULD ALLOW CHILDREN TO BE PARTY TO OR BE EXPLOITED 18
BY A HARMFUL, OR POTENTIALLY HARMF UL, CONTACT CONTACTS ON THE ONLINE 19
PRODUCT; 20
(V) WHETHER ALGORITHMS US ED BY THE ONLINE PROD UCT 21
COULD HARM CHILDREN ; 22
(VI) (V) WHETHER TARGETED ADVE RTISING SYSTEMS USED 23
BY THE ONLINE PRODUC T COULD HARM CHILDRE N; 24
(VII) (VI) WHETHER AND HOW THE O NLINE PRODUCT USES 25
SYSTEM DESIGN FEATUR ES TO INCREASE, SUSTAIN, OR EXTEND USE BY CHILDREN, 26
INCLUDING: 27
1. THE AUTOMATIC PLAYING OF MEDIA; 28
2. REWARDS FOR TIME SPEN T; AND 29
3. NOTIFICATIONS; AND 30
HOUSE BILL 901 15
(VIII) (VII) WHETHER, HOW, AND FOR WHAT PURPOSE THE 1
ONLINE PRODUCT COLLE CTS OR PROCESSES SEN SITIVE PERSONAL INFO RMATION 2
OF CHILDREN. 3
(D) (1) A DATA PROTECTION IMPA CT ASSESSMENT PREPAR ED BY A 4
BUSINESS FOR THE PUR POSE OF COMPLIANCE W ITH ANY OTHER LAW CO MPLIES 5
WITH THIS SECTION IF THE ASSESSMENT MEETS THE REQUIREMENTS OF THIS 6
SECTION. 7
(2) A SINGLE DATA PROTECTI ON IMPACT ASSE SSMENT MAY CONTAIN 8
MULTIPLE SIMILAR PRO CESSING OPERATIONS T HAT PRESENT SIMILAR RISKS, ONLY 9
IF EACH RELEVANT ONL INE PRODUCT IS ADDRE SSED ADDRESS A SET OF SIM ILAR 10
PROCESSING OPERATION S THAT PRESENT SIMIL AR RISKS PROVIDED NO 11
INDIVIDUAL RISKS ARE MINIMIZED. 12
(E) A BUSINESS SHALL COMPL ETE A DATA PROTECTIO N IMPACT 13
ASSESSMENT ON OR BEF ORE JUNE 30, 2024 APRIL 1, 2025, FOR ANY ONLINE 14
PRODUCT OFFERED TO T HE PUBLIC THAT IS LI KELY TO BE ACCESSED BY CHILDREN 15
BEFORE THAT DATE . 16
14–4505. 14–4506. 17
(A) A BUSINESS THAT PROVIDES AN ONLINE P RODUCT LIKELY TO BE 18
ACCESSED BY CHILDREN MAY NOT OFFER THE PR ODUCT TO THE PUBLIC BEFORE 19
COMPLETING A DATA PR OTECTION IMPACT ASSE SSMENT. 20
(B) A BUSINESS THAT COMPLE TES A DATA PROTECTIO N IMPACT 21
ASSESSMENT REQUIRED BY THIS SECTION SHAL L: 22
(1) MAINTAIN DOCUMENTATIO N OF THE ASSESSMENT FOR AS LONG 23
AS THE ONLINE PRODUC T IS LIKELY TO BE AC CESSED BY CHILDREN ; 24
(2) REVIEW EACH DATA PROT ECTION IMPACT ASSESS MENT EVERY 2 25
YEARS; 26
(3) DOCUMENT ANY RISK OF MATERIAL DETRIMENT T O CHILDREN 27
THAT ARIS ES FROM THE DATA MAN AGEMENT PRACTICE OF THE BUSINESS 28
IDENTIFIED IN THE AS SESSMENT; 29
(4) CREATE A PLAN TO MITI GATE OR ELIMINATE TH E RISK BEFORE 30
THE ONLINE PRODUCT I S MADE AVAILABLE TO CHILDREN; 31
16 HOUSE BILL 901
(5) (I) ESTIMATE THE AGE OF C HILD USERS WITH A RE ASONABLE 1
LEVEL OF CERTAINTY A PPROPRIATE TO THE RI SKS THAT ARISE FROM THE DATA 2
MANAGEMENT PRACTICES OF THE BUSINESS ; OR 3
(II) APPLY TO ALL CONSUMER S THE PRIVACY AND DA TA 4
PROTECTIONS AFFORDED TO CHILDREN; 5
(6) CONFIGURE ALL DEFAULT PRIVACY SETTINGS PRO VIDED TO 6
CHILDREN BY THE ONLIN E PRODUCT TO OFFER A HIGH LEVEL OF PRIVAC Y, UNLESS 7
THE BUSINESS CAN DEM ONSTRATE A COMPELLIN G REASON THAT A DIFF ERENT 8
SETTING IS IN THE BE ST INTEREST OF CHILD REN; 9
(7) PROVIDE ANY PRIVACY I NFORMATION , TERMS OF SERVICE , 10
POLICIES, AND COMMUNITY STANDARDS CO NCISELY, PROMINENTLY , AND USING 11
CLEAR LANGUAGE SUITE D TO THE AGE OF CHIL DREN LIKELY TO ACCES S THE 12
ONLINE PRODUCT ; 13
(8) PROVIDE AN OBVIOUS SI GNAL TO THE CHILD WH EN THE CHILD’S 14
LOCATION IS BEING MO NITORED OR TRACKED , IF THE ONLINE PRODU CT ALLOWS 15
THE CHILD’S PARENT, GUARDIAN, OR ANY OTHER CONSUME R TO TRACK THE CHILD ’S 16
LOCATION; 17
(9) ENFORCE PUBLISHED TER MS, POLICIES, AND COMMUNITY 18
STANDARDS ESTABLISHE D BY THE BUSINESS , INCLUDING PRIVACY PO LICIES, AND 19
THOSE REGARDING CHIL DREN; AND 20
(10) PROVIDE PROMINENT , ACCESSIBLE, AND RESPONSIVE TOOLS TO 21
HELP CHILDREN OR THE IR PARENTS OR GUARDI ANS, IF APPLICABLE, EXERCISE 22
THEIR PRIVACY RIGHTS AND REPORT CONCERNS . 23
14–4506. 14–4507. 24
A BUSINESS THAT PROVID ES AN ONLINE PRODUCT LIKELY TO BE ACCESSE D 25
BY CHILDREN MAY NOT : 26
(1) USE THE PERSONAL INFO RMATION OF A CHILD I N A WAY THAT 27
THE BUSINESS KNOWS , OR HAS REASON TO KNO W, IS MATERIALLY DETRIM ENTAL TO 28
THE PHYSICAL HEALTH , MENTAL HEALTH , OR WELL–BEING OF A CHILD; 29
(2) PROFILE A CHILD BY DE FAULT, UNLESS: 30
(I) THE BUSINESS CAN DEMO NSTRATE, TO THE ATTORNEY 31
GENERAL’S SATISFACTION, THAT THE BUSINESS HA S APPROPRIATE SAFEGU ARDS IN 32
PLACE TO PROTECT CHI LDREN; AND 33 HOUSE BILL 901 17
(II) 1. PROFILING IS NECESSAR Y TO PROVIDE THE ONL INE 1
PRODUCT REQUEST , AND IS DONE ONLY WIT H RESPECT TO THE ASPECTS OF THE 2
ONLINE PRODUCT WITH WHICH THE CHILD IS A CTIVELY AND KNOWINGL Y ENGAGED; 3
OR 4
2. THE BUSINESS CAN DEMO NSTRATE A COMPELLING 5
REASON THAT PROFILIN G IS IN THE BEST INTERESTS OF CHILDREN ; 6
(3) COLLECT, SELL, SHARE, OR RETAIN ANY P ERSONAL 7
INFORMATION THAT IS UNNECESSARY TO PROVI DE AN ONLINE PRODUCT THAT A 8
CHILD IS ACTIVELY AN D KNOWINGLY ENGAGED WITH, UNLESS THE BUSINESS CAN 9
DEMONSTRATE A COMPEL LING REASON THAT THE COLLECTION, SALE, SHARING, OR 10
RETENTION OF THE PER SONAL INFORMATION I S IN THE BEST INTERE STS OF 11
CHILDREN LIKELY TO A CCESS THE ONLINE PRO DUCT; 12
(4) USE THE PERSONAL INFO RMATION OF A CHILD E ND–USER FOR 13
ANY REASON OTHER THA N THAT FOR WHICH THE PERSONAL INFORMATION WAS 14
COLLECTED, UNLESS THE BUSINESS CAN DEMONSTRATE A CO MPELLING REASON 15
THAT THE USE OF THE PERSONAL INFORMATION IS IN THE BEST INTER ESTS OF 16
CHILDREN LIKELY TO A CCESS THE ONLINE PRO DUCT; 17
(5) COLLECT, SELL, OR SHARE ANY PRECISE GEOLOCATION 18
INFORMATION OF CHILD REN BY DEFAULT , UNLESS THE COLLECTIO N OF THAT 19
INFORMATIO N IS STRICTLY NECESS ARY IN ORDER FOR THE BUSINESS TO PROVIDE 20
THE ONLINE PRODUCT R EQUESTED, AND THEN MAY ONLY DO SO FOR THE LIMITED 21
TIME THAT THE COLLEC TION OF PRECISE GEOL OCATION INFORMATION IS 22
NECESSARY TO PROVIDE THE ONLINE PRODUCT ; 23
(6) COLLECT ANY PR ECISE GEOLOCATION IN FORMATION OF A CHILD 24
WITHOUT PROVIDING AN OBVIOUS SIGN TO THE CHILD FOR THE DURATI ON THAT 25
THE PRECISE GEOLOCAT ION INFORMATION IS B EING COLLECTED ; 26
(7) USE DARK PATTERNS TO : 27
(I) LEAD OR ENCOURAGE CHI LDREN TO PROVIDE PER SONAL 28
INFORMATION BEYOND WHAT IS REASONABLY EXPECTED TO PROVIDE THE ONLIN E 29
PRODUCT; 30
(II) CIRCUMVENT PRIVACY PR OTECTIONS; OR 31
(III) TAKE ANY ACTION THAT THE BUSINESS KNOWS , OR HAS 32
REASON TO KNOW , IS MATERIALLY DETRIM ENTAL TO THE CHILD ’S PHYSICAL 33
HEALTH, MENTAL HEALTH, OR WELL–BEING; OR 34 18 HOUSE BILL 901
(8) USE ANY PERSONAL INFO RMATION COLLECTED TO ESTIMATE AGE 1
OR AGE RANGE FOR ANY OTHER PURPOSE , RETAIN THE PERSONAL INFORMATION 2
LONGER THAN NECESSAR Y TO ESTIMATE AGE , OR ATTEMPT AGE ASSUR ANCE IN A 3
WAY THAT IS DISPROPO RTIONATE TO THE RISKS AND DATA P RACTICE OF AN ONLINE 4
PRODUCT. 5
14–4507. 14–4508. 6
(A) WITHIN 3 BUSINESS DAYS AFTER RECEIVING A WRITTEN REQUEST FROM 7
THE ATTORNEY GENERAL DIVISION, A BUSINESS THAT PROV IDES AN ONLINE 8
PRODUCT LIKELY TO BE ACCESSED BY CHILDREN SHALL PROV IDE TO THE 9
ATTORNEY GENERAL DIVISION A LIST OF ALL DATA P ROTECTION IMPACT 10
ASSESSMENTS THE BUSI NESS HAS COMPLETED U NDER § 14–4504 14–4505 OF THIS 11
SUBTITLE. 12
(B) WITHIN 5 BUSINESS DAYS AFTER RECEIVING A WRITTEN REQUEST FROM 13
THE ATTORNEY GENERAL DIVISION, THE BUSINESS SHALL P ROVIDE TO THE 14
ATTORNEY GENERAL DIVISION ANY DATA PROTECTION IMPACT ASSESSMENT 15
COMPLETED UNDER § 14–4504 OF THIS SUBTITLE. 16
(C) TO THE EXTENT THAT AN Y DISCLOSURE REQUIRE D UNDER SUBSECTION 17
(B) OF THIS SECTION INCL UDES INFORMATION SUB JECT TO ATTORNEY –CLIENT 18
PRIVILEGE OR WORK PR ODUCT PROTECTION , THE DISCLOSURE MAY N OT 19
CONSTITUTE A WAIVER OF THAT PRIVILEGE OR PROTECTION. 20
14–4508. 14–4509. 21
(A) THE ATTORNEY GENERAL MAY FILE A CI VIL ACTION IN A COUR T OF 22
COMPETENT JURISDICTI ON AGAINST A BUSINESS THAT VIOLAT ES THIS SUBTITLE 23
FOR RECOVERY OF A CI VIL PENALTY OR INJUN CTION OR BOTH A VIOLATION OF THIS 24
SUBTITLE: 25
(1) IS AN UNFAIR, ABUSIVE, OR DECEPTIVE TRADE P RACTICE; AND 26
(2) EXCEPT FOR § 13–410 OF THIS ARTICLE , IS SUBJECT TO THE 27
ENFORCEMENT PROVISIO NS CONTAINED IN TITLE 13 OF THIS ARTICLE. 28
(B) A BUSINESS THAT VIOLAT ES THIS SUBTITLE SHALL BE LIABLE FOR A 29
CIVIL PENALTY OF NOT MORE THAN IS SUBJECT TO A CIVI L PENALTY NOT 30
EXCEEDING: 31
(1) $2,500 PER AFFECTED CHILD F OR EACH NEGLIGENT VIOLATION; 32
OR 33 HOUSE BILL 901 19
(2) $7,500 PER AFFECTED CHILD F OR EACH INTENTIONAL 1
VIOLATION. 2
(C) IN ADDITION TO A CIVI L PENALTY UNDER SUBS ECTION (B) OF THIS 3
SECTION, A BUSINESS THAT VIOL ATES THIS SUBTITLE I S SUBJECT TO INJUNCT ION 4
AND OTHER APPROPRIAT E RELIEF. 5
(D) (C) CIVIL PENALTIES, FEES, AND EXPENSES RECOVER ED UNDER THIS 6
SECTION SHALL BE DEP OSITED IN THE COMMISSIONER SHALL PA Y ALL FINES, 7
PENALTIES, AND EXPENSES COLLECT ED BY THE COMMISSIONER UNDER TH IS 8
SUBSECTION INTO THE GENERAL FUND WITH THE INTENT THAT THEY FINES, 9
PENALTIES, AND EXPENSES BE USED TO FULLY OFF SET ANY COSTS INCURRED BY 10
THE ATTORNEY GENERAL IN CONNECTION WITH THIS SUBTITLE . 11
14–4509. 14–4510. 12
(A) IF A BUSINESS IS IN S UBSTANTIAL COMPLIANC E WITH THE 13
REQUIREMENTS OF §§ 14–4504 14–4505 THROUGH 14–4506 14–4507 OF THIS 14
SUBTITLE, THE ATTORNEY GENERAL DIVISION SHALL PROVIDE WRITTE N NOTICE 15
TO THE BUSINESS BEFO RE FILING AN ACTION UNDER § 14–4508 14–4509 OF THIS 16
SUBTITLE. 17
(B) NOTICE GIVEN UNDER SU BSECTION (A) OF THIS SECTION SHAL L 18
IDENTIFY THE SPECIFI C PROVISIONS OF THIS SUBTITLE THAT THE ATTORNEY 19
GENERAL DIVISION ALLEGES HAVE BEEN OR ARE BEING VIOLATED . 20
(C) A BUSINESS MAY NOT BE LIABLE FOR A CIVIL P ENALTY FOR ANY 21
VIOLATION FOR WHICH NOTICE IS G IVEN UNDER SUBSECTIO N (A) OF THIS SECTION 22
IF THE BUSINESS: 23
(1) CURES ANY VIOLATION S PECIFIED IN THE ATTORNEY GENERAL’S 24
DIVISION’S NOTICE WITHIN 90 DAYS AFTER RECEIVING NOTICE UNDER SUBSECT ION 25
(A) OF THIS SECTION; 26
(2) PROVIDES THE ATTORNEY GENERAL DIVISION WITH A WRITTEN 27
STATEMENT THAT THE A LLEGED VIOLATIONS HA VE BEEN CURED ; AND 28
(3) TAKES MEASURES TO PRE VENT FUTURE VIOLATIO NS THAT THE 29
ATTORNEY GENERAL DIVISION AGREES TO BE SUFFICI ENT. 30
14–4510. 14–4511. 31
20 HOUSE BILL 901
NOTHING IN THIS SUBTI TLE MAY BE INTERPRETED T O PROVIDE A PRIVATE 1
RIGHT OF ACTION UNDE R THIS SUBTITLE OR A NY OTHER LAW . 2
14–4511. 3
THE SHARING OF PERSON AL INFORMATION WITHI N A JOINT VENTURE OR 4
PARTNERSHIP IS SUBJE CT TO THE REQUIREMEN TS OF THIS SUBTITLE AS THOUGH 5
THE JOINT VENTURE OR PARTNERSHIP DOES NOT EXIST. 6
14–4512. 7
NOTWITHSTANDING ANY O THER LAW , A DATA PROTECTION IM PACT 8
ASSESSMENT IS PROTEC TED AS CONFIDENTIAL AND SHALL BE EXEMPT FROM 9
PUBLIC DISCLOSURE , INCLUDING UNDER THE MARYLAND PUBLIC INFORMATION 10
ACT. 11
14–4513. 12
THIS SUBTITLE MAY BE CITE D AS THE MARYLAND AGE–APPROPRIATE 13
DESIGN CODE ACT. 14
SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect 15
October 1, 2023. 16
Approved:
________________________________________________________________________________
Governor.
________________________________________________________________________________
Speaker of the House of Delegates.
________________________________________________________________________________
President of the Senate.