Maryland 2024 Regular Session

Maryland House Bill HB603 Compare Versions

Version 1 (Old)

Version 2 (New)

Old	New		Differences
1		-	WES MOORE, Governor Ch. 461
2	1
3		-	– 1 –
4		-	Chapter 461
5		-	(House Bill 603)
6	2
7		-	AN ACT concerning
	3	+	EXPLANATION: CAPITALS INDICATE MAT TER ADDED TO EXISTIN G LAW.
	4	+	[Brackets] indicate matter deleted from existing law.
	5	+	Underlining indicates amendments to bill.
	6	+	Strike out indicates matter stricken from the bill by amendment or deleted from the law by
	7	+	amendment.
	8	+	hb0603
8	9
9		-	Consumer Protection – Online Products and Services – Data of Children
10		-	(Maryland Kids Code)
	10	+	HOUSE BILL 603
	11	+	I3, S1 4lr1482
	12	+	HB 901/23 – ECM CF SB 571
	13	+	By: Delegates Solomon, Wilson, and Love
	14	+	Introduced and read first time: January 24, 2024
	15	+	Assigned to: Economic Matters
	16	+	Committee Report: Favorable with amendments
	17	+	House action: Adopted
	18	+	Read second time: March 2, 2024
11	19
12		-	FOR the purpose of requiring a covered entity that offers an online product reasonably
13		-	likely to be accessed by children to complete a certain data protection impact
14		-	assessment under certain circumstances; requiring certain privacy protections for
15		-	certain online products; prohibiting certain data collection and sharing practices;
16		-	authorizing certain monitoring practices; and generally relating to the protection of
17		-	online privacy of children.
	20	+	CHAPTER ______
18	21
19		-	BY repealing and reenacting, with amendments,
20		-	Article – Commercial Law
21		-	Section 13–301(14)(xl)
22		-	Annotated Code of Maryland
23		-	(2013 Replacement Volume and 2023 Supplement)
	22	+	AN ACT concerning 1
24	23
25		-	BY repealing and reenacting, without amendments,
26		-	Article – Commercial Law
27		-	Section 13–301(14)(xli)
28		-	Annotated Code of Maryland
29		-	(2013 Replacement Volume and 2023 Supplement)
	24	+	Consumer Protection – Online Products and Services – Data of Children 2
	25	+	(Maryland Kids Code) 3
30	26
31		-	~~BY adding to~~
32		-	~~Article – Commercial Law~~
33		-	~~Section 13–301(14)(xlii); and 14–4601 through 14–4612 14–4613 to be~~ under ~~the new~~
34		-	~~subtitle “Subtitle~~ ~~46. Maryland Age–Appropriate Design Code Act”~~
35		-	~~Annotated Code~~ of ~~Maryland~~
36		-	~~(2013~~ ~~Replacement Volume and 2023 Supplement)~~
	27	+	FOR the purpose of requiring a covered entity that offers an online product reasonably 4
	28	+	likely to be accessed by children to complete a certain data protection impact 5
	29	+	assessment under certain circumstances; requiring certain privacy protections for 6
	30	+	certain online products; prohibiting certain data collection and sharing practices; 7
	31	+	authorizing certain monitoring practices; and generally relating to the protection of 8
	32	+	online privacy of children. 9
37	33
38		-	Preamble
	34	+	BY repealing and reenacting, with amendments, 10
	35	+	Article – Commercial Law 11
	36	+	Section 13–301(14)(xl) 12
	37	+	Annotated Code of Maryland 13
	38	+	(2013 Replacement Volume and 2023 Supplement) 14
39	39
40		-	WHEREAS, The United Nations Convention on the Rights of the Child recognizes
41		-	that children need special safeguards and care in all aspects of their lives, specifying how
42		-	children’s rights apply in the digital environment in General Comment No. 25; and
	40	+	BY repealing and reenacting, without amendments, 15
	41	+	Article – Commercial Law 16
	42	+	Section 13–301(14)(xli) 17
	43	+	Annotated Code of Maryland 18
	44	+	(2013 Replacement Volume and 2023 Supplement) 19
43	45
44		-	WHEREAS, As children spend more of their time interacting with the online world,
45		-	the impact of the design of online products on their well–being has become a focus of
46		-	significant concern; and
47		-	Ch. 461 2024 LAWS OF MARYLAND
	46	+	BY adding to 20
	47	+	Article – Commercial Law 21 2 HOUSE BILL 603
48	48
49		-	– 2 –
50		-	WHEREAS, There is widespread agreement at the international level, and
51		-	bipartisan agreement in the United States, that more needs to be done to create a safer
52		-	online space for children to learn, explore, and play; and
53	49
54		-	WHEREAS, Lawmakers around the globe have taken steps to enhance privacy
55		-	protections for children based on the understanding that, in relation to data protection,
56		-	greater privacy necessarily means greater security and well–being; and
	50	+	Section 13–301(14)(xlii); and 14–4601 through 14–4612 14–4613 to be under the new 1
	51	+	subtitle “Subtitle 46. Maryland Age–Appropriate Design Code Act” 2
	52	+	Annotated Code of Maryland 3
	53	+	(2013 Replacement Volume and 2023 Supplement) 4
57	54
58		-	WHEREAS, Children should be afforded protections not only by online products and
59		-	services specifically directed at them, but by all online products they are likely to access,
60		-	and thus covered entities should take into account the unique needs of different age ranges,
61		-	including the following developmental stages: 0 to 5 years of age, or “preliterate and early
62		-	literacy”; 6 to 9 years of age, or “core primary school years”; 10 to 12 years of age, or
63		-	“transition years”; 13 to 15 years of age, or “early teens”; and 16 to 17 years of age, or
64		-	“approaching adulthood”; and
	55	+	Preamble 5
65	56
66		-	WHEREAS, While it is clear that the same data protection regime may not be
67		-	appropriate for children of all ages, children of all ages should nonetheless be afforded
68		-	privacy and protection, and online products should adopt data protection regimes
69		-	appropriate for children of the ages likely to access those products; and
	57	+	WHEREAS, The United Nations Convention on the Rights of the Child recognizes 6
	58	+	that children need special safeguards and care in all aspects of their lives, specifying how 7
	59	+	children’s rights apply in the digital environment in General Comment No. 25; and 8
70	60
71		-	WHEREAS, According to the Pew Research Center, in 2022, 97% of American
72		-	teenagers aged 13–17 used the Internet every day, with 46% responding they used the
73		-	Internet almost constantly; and, additionally, 36% of teens reported being concerned about
74		-	their social media use, while an earlier Pew Research Center study found that 59% of teens
75		-	have been bullied or harassed online; and
	61	+	WHEREAS, As children spend more of their time interacting with the online world, 9
	62	+	the impact of the design of online products on their well–being has become a focus of 10
	63	+	significant concern; and 11
76	64
77		-	WHEREAS, ~~The findings of~~ the ~~Pew Research Center are not surprising~~, ~~given what~~
78		-	~~is known about controllers’~~ ~~use of personal data and how it is utilized~~ to ~~inform~~
79		-	~~manipulative practices,~~ to ~~which children are particularly vulnerable~~; and
	65	+	WHEREAS, There is widespread agreement at the international level, and 12
	66	+	bipartisan agreement in the United States, that more needs to be done to create a safer 13
	67	+	online space for children to learn, explore, and play; and 14
80	68
81		-	WHEREAS, Online products that are likely to be accessed by children should offer
82		-	strong privacy protections that, by design, prevent the use of children’s personal data to
83		-	offer elements that the covered entity offering the online product knows, or has reason to
84		-	know, are likely to be materially detrimental to the physical health, mental health, or
85		-	well–being of children; and
	69	+	WHEREAS, Lawmakers around the globe have t aken steps to enhance privacy 15
	70	+	protections for children based on the understanding that, in relation to data protection, 16
	71	+	greater privacy necessarily means greater security and well–being; and 17
86	72
87		-	WHEREAS, Ensuring robust privacy, and thus safety, protections for children by
88		-	design is consistent with federal safety laws and policies applied to children’s products,
89		-	regulating everything from toys to clothing to furniture and games; and
	73	+	WHEREAS, Children should be afforded protections not only by online products and 18
	74	+	services specifically directed at them, but by all online products they are likely to access, 19
	75	+	and thus covered entities should take into account the unique needs of different age ranges, 20
	76	+	including the following developmental stages: 0 to 5 years of age, or “preliterate and early 21
	77	+	literacy”; 6 to 9 years of age, or “core primary school years”; 10 to 12 years of age, or 22
	78	+	“transition years”; 13 to 15 years of age, or “early teens”; and 16 to 17 years of age, or 23
	79	+	“approaching adulthood”; and 24
90	80
91		-	WHEREAS, ~~The consumer protections~~ that ~~federal safety laws apply to children’s~~
92		-	~~products require these products to comply with certain safety standards by their very~~
93		-	~~design, so that harms to children~~, and ~~in some cases other consumers,~~ ~~are prevented;~~ ~~and~~
94		-	~~WES MOORE,~~ ~~Governor~~ ~~Ch. 461~~
	81	+	WHEREAS, While it is clear that the same data protection regime may not be 25
	82	+	appropriate for children of all ages, children of all ages should nonetheless be afforded 26
	83	+	privacy and protection, and online products should adopt data protection regimes 27
	84	+	appropriate for children of the ages likely to access those products; and 28
95	85
96		-	– 3 –
97		-	WHEREAS, It is the intent of the Maryland General Assembly that the Maryland
98		-	Age–Appropriate Design Code Act promote innovation by covered entities whose online
99		-	products are likely to be accessed by children by ensuring that those online products are
100		-	designed in a manner that recognizes the distinct needs of children within different age
101		-	ranges; and now, therefore,
	86	+	WHEREAS, According to the Pew Research Center, in 2022, 97% of American 29
	87	+	teenagers aged 13–17 used the Internet every day, with 46% responding they used the 30
	88	+	Internet almost constantly; and, additionally, 36% of teens reported being concerned about 31
	89	+	their social media use, while an earlier Pew Research Center study found that 59% of teens 32
	90	+	have been bullied or harassed online; and 33
102	91
103		-	WHEREAS, It is the intent of the Maryland General Assembly that covered entities
104		-	covered by the Maryland Age–Appropriate Design Code Act may look to guidance and
105		-	innovation in response to the Age–Appropriate Design Code established in the United
106		-	Kingdom and California when developing online products that are likely to be accessed by
107		-	children; now, therefore,
	92	+	WHEREAS, The findings of the Pew Research Center are not surprising, given what 34
	93	+	is known about controllers’ use of personal data and how it is utilized to inform 35
	94	+	manipulative practices, to which children are particularly vulnerable; and 36
	95	+	HOUSE BILL 603 3
108	96
109		-	SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND,
110		-	That the Laws of Maryland read as follows:
111	97
112		-	Article – Commercial Law
	98	+	WHEREAS, Online products that are likely to be accessed by children should offer 1
	99	+	strong privacy protections that, by design, prevent the use of children’s personal data to 2
	100	+	offer elements that the covered entity offering the online product knows, or has reason to 3
	101	+	know, are likely to be materially detrimental to the physical health, mental health, or 4
	102	+	well–being of children; and 5
113	103
114		-	13–301.
	104	+	WHEREAS, Ensuring robust privacy, and thus safety, protections for children by 6
	105	+	design is consistent with federal safety laws and policies applied to children’s products, 7
	106	+	regulating everything from toys to clothing to furniture and games; and 8
115	107
116		-	Unfair, abusive, or deceptive trade practices include any:
	108	+	WHEREAS, The consumer protections that federal safety laws apply to children’s 9
	109	+	products require these products to comply with certain safety standards by their very 10
	110	+	design, so that harms to children, and in some cases other consumers, are prevented; and 11
117	111
118		-	(14) Violation of a provision of:
	112	+	WHEREAS, It is the intent of the Maryland General Assembly that the Maryland 12
	113	+	Age–Appropriate Design Code Act promote innovation by covered entities whose online 13
	114	+	products are likely to be accessed by children by ensuring that those online products are 14
	115	+	designed in a manner that recognizes the distinct needs of children within different age 15
	116	+	ranges; and now, therefore, 16
119	117
120		-	(xl) Title 14, Subtitle 13 of the Public Safety Article; [or]
	118	+	WHEREAS, It is the intent of the Maryland General Assembly that covered entities 17
	119	+	covered by the Maryland Age–Appropriate Design Code Act may look to guidance and 18
	120	+	innovation in response to the Age–Appropriate Design Code established in the United 19
	121	+	Kingdom and California when developing online products that are likely to be accessed by 20
	122	+	children; now, therefore, 21
121	123
122		-	(xli) Title 14, Subtitle 45 of this article; or
	124	+	SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 22
	125	+	That the Laws of Maryland read as follows: 23
123	126
124		-	~~(XLII) TITLE 14,~~ ~~SUBTITLE 46 OF THIS ARTICLE; OR~~
	127	+	Article – Commercial Law 24
125	128
126		-	~~SUBTITLE 46~~. ~~MARYLAND AGE–APPROPRIATE DESIGN CODE ACT.~~
	129	+	13–301. 25
127	130
128		-	~~14–4601.~~
	131	+	Unfair, abusive, or deceptive trade practices include any: 26
129	132
130		-	(A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS
131		-	INDICATED.
	133	+	(14) Violation of a provision of: 27
132	134
133		-	(B) ~~(1) “AGGREGATE~~ ~~CONSUMER IN FORMATION”~~ ~~MEANS INFORMATION :~~
	135	+	(xl) Title 14, Subtitle 13 of the Public Safety Article; [or] 28
134	136
135		-	(I) ~~THAT RELATES TO A GRO UP~~ OR ~~CATEGORY OF CO NSUMERS;~~
	137	+	(xli) Title 14, Subtitle 45 of this article; or 29
136	138
137		-	(II) FROM WHICH INDIVIDUAL CONSUMER IDENTITIES HAVE
138		-	BEEN REMOVED ; AND
	139	+	(XLII) TITLE 14, SUBTITLE 46 OF THIS ARTICLE; OR 30
139	140
140		-	(III) THAT IS NOT LINKED OR REASON ABLY LINKABLE TO ANY
141		-	CONSUMER OR HOUSEHOL D, INCLUDING BY A DEVIC E. Ch. 461 2024 LAWS OF MARYLAND
	141	+	SUBTITLE 46. MARYLAND AGE–APPROPRIATE DESIGN CODE ACT. 31
142	142
143		-	– 4 –
	143	+	14–4601. 32
	144	+	4 HOUSE BILL 603
144	145
145		-	(2) “AGGREGATE CONSUMER IN FORMATION” DOES NOT INCLUDE
146		-	INDIVIDUAL CONSUMER RECORDS THAT HAVE BE EN DE–IDENTIFIED.
147	146
148		-	(C) “BEST INTERESTS OF CHI LDREN” MEANS A COVERED ENTI TY’S USE OF
149		-	THE PERSONAL DATA OF A CHILD CHILDREN OR THE DESIGN OF AN ONLINE
150		-	PRODUCT IN A WAY THA T DOES NOT:
	147	+	(A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS 1
	148	+	INDICATED. 2
151	149
152		-	(1) BENEFIT THE COVERED E NTITY TO THE DETRIME NT OF A CHILD
153		-	CHILDREN; AND
	150	+	(B) (1) “AGGREGATE CONSUMER IN FORMATION” MEANS INFORMATION : 3
154	151
155		-	(2) ~~RESULT IN:~~
	152	+	(I) THAT RELATES TO A GRO UP OR CATEGORY OF CO NSUMERS; 4
156	153
157		-	(I) ~~REASONABLY FORESEEABL E AND MATERIAL PHYSI CAL OR~~
158		-	~~FINANCIAL HARM TO A CHILD CHILDREN~~;
	154	+	(II) FROM WHICH INDIVIDUAL CONSUMER IDENTITIES HAVE 5
	155	+	BEEN REMOVED ; AND 6
159	156
160		-	(II) ~~SEVERE AND REASONABLY FORESEEABLE PSYCHOLO GICAL~~
161		-	OR ~~EMOTIONAL HARM TO~~ A ~~CHILD CHILDREN;~~
	157	+	(III) THAT IS NOT LINKED OR REASON ABLY LINKABLE TO ANY 7
	158	+	CONSUMER OR HOUSEHOL D, INCLUDING BY A DEVIC E. 8
162	159
163		-	(~~III~~) ~~A HIGHLY OFFENSIVE INT RUSION ON A CHILD’S CHILDREN’S~~
164		-	~~REASONABLE EXPECTATI ON OF PRIVACY;~~ OR
	160	+	(2) “AGGREGATE CONSUMER IN FORMATION” DOES NOT INCLUDE 9
	161	+	INDIVIDUAL CONSUMER RECORDS THAT HAVE BE EN DE–IDENTIFIED. 10
165	162
166		-	(IV) ~~DISCRIMINATION AGAINS T~~ A ~~CHILD CHILDREN BASED ON~~
167		-	~~RACE, COLOR,~~ ~~RELIGION, NATIONAL ORIGIN , DISABILITY,~~ ~~GENDER IDENTITY , SEX,~~
168		-	~~OR SEXUAL ORIENTATIO N.~~
	163	+	(C) “BEST INTERESTS OF CHI LDREN” MEANS A COVERED EN TITY’S USE OF 11
	164	+	THE PERSONAL DATA OF A CHILD CHILDREN OR THE DESIGN OF AN ONLINE 12
	165	+	PRODUCT IN A WAY THA T DOES NOT: 13
169	166
170		-	(D) (1) “BIOMETRIC INFORMATION DATA” MEANS INFORMATION DATA
171		-	GENERATED BY AUTOMATI C MEASUREMENTS OF AN INDIVIDUAL’S BIOLOGICAL
172		-	CHARACTERISTICS .
	167	+	(1) BENEFIT THE COVERED E NTITY TO THE DETRIME NT OF A CHILD 14
	168	+	CHILDREN; AND 15
173	169
174		-	(2) ~~“BIOMETRIC INFORMATION DATA” INCLUDES~~:
	170	+	(2) RESULT IN: 16
175	171
176		-	(I) A FINGERPRINT ;
	172	+	(I) REASONABLY FORESEEABL E AND MATERIAL PHYSI CAL OR 17
	173	+	FINANCIAL HARM TO A CHILD CHILDREN; 18
177	174
178		-	(II) A VOICEPRINT;
	175	+	(II) SEVERE AND REASONABLY FORESEEABLE PSYCHOLO GICAL 19
	176	+	OR EMOTIONAL HARM TO A CHILD CHILDREN; 20
179	177
180		-	(III) AN EYE RETINA OR IRIS PATTERN; OR
	178	+	(III) A HIGHLY OFFENSIVE INT RUSION ON A CHILD’S CHILDREN’S 21
	179	+	REASONABLE EXPECTATION OF PRIVA CY; OR 22
181	180
182		-	(IV) ANY OTHER UNIQUE BIOL OGICAL P ATTERN OR
183		-	CHARACTERISTIC THAT IS USED TO IDENTIFY A SPECIFIC INDIVIDUA L.
	181	+	(IV) DISCRIMINATION AGAINS T A CHILD CHILDREN BASED ON 23
	182	+	RACE, COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER IDENTITY , SEX, 24
	183	+	OR SEXUAL ORIENTATIO N. 25
184	184
185		-	(3) “BIOMETRIC INFORMATION DATA” DOES NOT INCLUDE :
	185	+	(D) (1) “BIOMETRIC INFORMATION DATA” MEANS INFORMATION DATA 26
	186	+	GENERATED BY AUTOMATIC MEASUREMEN TS OF AN INDIVIDUAL ’S BIOLOGICAL 27
	187	+	CHARACTERISTICS . 28
186	188
187		-	(I) A DIGITAL OR PHYSICAL PHOTOGRAPH ; WES MOORE, Governor Ch. 461
	189	+	(2) “BIOMETRIC INFORMATION DATA” INCLUDES: 29
	190	+	HOUSE BILL 603 5
188	191
189		-	– 5 –
190	192
191		-	(II) ~~AN AUDIO OR VIDEO REC ORDING~~; OR
	193	+	(I) A FINGERPRINT ; 1
192	194
193		-	(III) DATA GENERATED FROM A DIGITAL OR PHYSICAL
194		-	PHOTOGRAPH , OR AN AUDIO OR VIDEO RECORDING, UNLESS THE DATA IS
195		-	GENERATED TO IDENTIF Y A SPECIFIC INDIVID UAL.
	195	+	(II) A VOICEPRINT; 2
196	196
197		-	(E) ~~“CHILD” MEANS A CONSUMER WHO IS UNDER THE AGE OF 18 YEARS.~~
	197	+	(III) AN EYE RETINA OR IRIS PATTERN; OR 3
198	198
199		-	(F) ~~(1) “COLLECT” MEANS TO BUY,~~ ~~RENT, GATHER, OBTAIN, RECEIVE,~~ OR
200		-	~~ACCESS PERSONAL DATA RELATI NG~~ TO A ~~CONSUMER~~ .
	199	+	(IV) ANY OTHER UNIQUE BIOL OGICAL PATTERN OR 4
	200	+	CHARACTERISTIC THAT I S USED TO IDENTIFY A SPECIFIC INDIVIDUAL . 5
201	201
202		-	(2) “~~COLLECT~~” ~~INCLUDES~~:
	202	+	(3) “BIOMETRIC INFORMATION DATA” DOES NOT INCLUDE : 6
203	203
204		-	(I) ACTIVELY OR PASSIVELY RECEIVING RECEIVING DATA
205		-	FROM THE CONSUMER ; AND
	204	+	(I) A DIGITAL OR PHYSICAL PHOTOGRAPH ; 7
206	205
207		-	(II) ~~OBSERVING THE CONSUME R’S BEHAVIOR.~~
	206	+	(II) AN AUDIO OR VIDEO REC ORDING; OR 8
208	207
209		-	(G) (1) “CONSUMER” MEANS AN INDIVIDUAL WHO IS A RESIDENT OF THE
210		-	STATE, HOWEVER IDENTIFIED , INCLUDING BY A UNIQU E IDENTIFIER.
	208	+	(III) DATA GENERATED FROM A DIGITAL OR PHYSICAL 9
	209	+	PHOTOGRAPH , OR AN AUDIO OR VIDEO RECORDING, UNLESS THE DATA IS 10
	210	+	GENERATED TO IDENTIF Y A SPECIFIC INDIVID UAL. 11
211	211
212		-	(2) “CONSUMER” DOES NOT INCLUDE AN INDIVIDUAL ACTING IN A
213		-	COMMERCIAL OR EMPLOY MENT CONTEXT OR AS A N EMPLOYER , AN OWNER, A
214		-	DIRECTOR, AN OFFICER, OR A CONTRACTOR OF A COMPANY, PARTNERSHIP , SOLE
215		-	PROPRIETORSHIP , NONPROFIT ORGANIZATI ON, OR GOVERNMENT AGENCY
216		-	GOVERNM ENTAL UNIT WHOSE COMMUNICATIONS OR TRANSACTIONS WITH THE
217		-	COVERED ENTITY OCCUR SOLELY WITHIN THE CO NTEXT OF THAT INDIVI DUAL’S
218		-	ROLE WITH THE COMPAN Y, PARTNERSHIP , SOLE PROPRIETORSHIP , NONPROFIT
219		-	ORGANIZATION , OR GOVERNMENT AGENCY GOVERNMENTAL UNIT .
	212	+	(E) “CHILD” MEANS A CONSUMER WHO IS UNDER THE AGE OF 18 YEARS. 12
220	213
221		-	(H) (1) “COVERED ENTITY ” MEANS A SOLE PROPRIE TORSHIP, A LIMITED
222		-	LIABILITY COMPANY , A CORPORATION , AN ASSOCIATION , OR ANY OTHER LEGAL
223		-	ENTITY THAT:
	214	+	(F) (1) “COLLECT” MEANS TO BUY, RENT, GATHER, OBTAIN, RECEIVE, OR 13
	215	+	ACCESS PERSONAL DATA RELATING TO A C ONSUMER. 14
224	216
225		-	(I) IS ORGANIZED OR OPERA TED FOR THE PROFIT O R
226		-	FINANCIAL BENEFIT OF ITS SHAREHOLDERS OR OTHER OWNERS ;
	217	+	(2) “COLLECT” INCLUDES: 15
227	218
228		-	(II) COLLECTS CONSUMERS ’ PERSONAL INFORMATION DATA OR
229		-	USES ANOTHER ENTITY TO CO LLECT CONSUMERS ’ PERSONAL INFORMATION DATA
230		-	ON ITS BEHALF;
231		-	Ch. 461 2024 LAWS OF MARYLAND
	219	+	(I) ACTIVELY OR PASSIVELY RECEIVING RECEIVING DATA 16
	220	+	FROM THE CONSUMER ; AND 17
232	221
233		-	– 6 –
234		-	(III) ALONE, OR JOINTLY WITH ITS AFFILIATES OR
235		-	SUBSIDIARIES, DETERMINES THE PURPO SES AND MEANS OF THE PROCESSING OF
236		-	CONSUMERS ’ PERSONAL DATA ;
	222	+	(II) OBSERVING THE CONSUME R’S BEHAVIOR. 18
237	223
238		-	(IV) DOES BUSINESS IN THE STATE; AND
	224	+	(G) (1) “CONSUMER” MEANS AN INDIVIDUAL WHO IS A RESIDENT OF THE 19
	225	+	STATE, HOWEVER IDENTIFIED, INCLUDING BY A UNIQU E IDENTIFIER. 20
239	226
240		-	(V) 1. HAS ANNUAL GROSS REVE NUES IN EXCESS OF
241		-	$25,000,000, ADJUSTED EVERY ODD –NUMBERED YEAR TO REF LECT ADJUSTMENTS
242		-	IN THE CONSUMER PRICE INDEX;
	227	+	(2) “CONSUMER” DOES NOT INCLUDE AN INDIVIDUAL ACTING IN A 21
	228	+	COMMERCIAL OR EMPLOY MENT CONTEXT OR AS A N EMPLOYER , AN OWNER, A 22
	229	+	DIRECTOR, AN OFFICER, OR A CONTRACTOR OF A COMPANY, PARTNERSHIP , SOLE 23
	230	+	PROPRIETORS HIP, NONPROFIT ORGANIZATI ON, OR GOVERNMENT AGENCY 24
	231	+	GOVERNMENTAL UNIT WHOSE COMMUNICATIONS OR TRANSACTIONS WITH THE 25
	232	+	COVERED ENTITY OCCUR SOLELY WITHIN THE CO NTEXT OF THAT INDIVI DUAL’S 26
	233	+	ROLE WITH THE COMPAN Y, PARTNERSHIP , SOLE PROPRIETORSHIP , NONPROFIT 27
	234	+	ORGANIZATION, OR GOVERNMENT AGENCY GOVERNMENTAL UNIT . 28
	235	+	6 HOUSE BILL 603
243	236
244		-	2. ANNUALLY BUYS , RECEIVES, SELLS, OR SHARES THE
245		-	PERSONAL DATA OF 50,000 OR MORE CONSUMERS , HOUSEHOLDS , OR DEVICES,
246		-	ALONE OR IN COMBINAT ION WITH ITS AFFILIA TES OR SUBSIDIARIES , FOR THE
247		-	COVERED ENTITY ’S COMMERCIAL PURPOSE S; OR
248	237
249		-	3. DERIVES AT LEAST 50% OF ITS ANNUAL REVENU ES
250		-	FROM THE SALE OF CONSUMERS ’ PERSONAL DATA .
	238	+	(H) (1) “COVERED ENTITY ” MEANS A SOLE PROPRIE TORSHIP, A LIMITED 1
	239	+	LIABILITY COMPANY , A CORPORATION , AN ASSOCIATION , OR ANY OTHER LEGAL 2
	240	+	ENTITY THAT: 3
251	241
252		-	(2) “COVERED ENTITY ” INCLUDES:
	242	+	(I) IS ORGANIZED OR OPERA TED FOR THE PROFIT O R 4
	243	+	FINANCIAL BENEFIT OF ITS SHARE HOLDERS OR OTHER OWN ERS; 5
253	244
254		-	(I) AN ENTITY THAT CONTRO LS OR IS CONTROLLED BY A
255		-	BUSINESS AND THAT SH ARES A NAME, SERVICE MARK , OR TRADEMARK THAT WO ULD
256		-	CAUSE A REASONABLE C ONSUMER TO UNDERSTAN D THAT TWO OR MORE E NTITIES
257		-	ARE COMMONLY OWNED ; AND
	245	+	(II) COLLECTS CONSUMERS ’ PERSONAL INFORMATION DATA OR 6
	246	+	USES ANOTHER ENTITY TO CO LLECT CONSUMERS ’ PERSONAL INFORMATION DATA 7
	247	+	ON ITS BEHALF; 8
258	248
259		-	(II) ~~A JOINT VENTURE~~ OR ~~PAR TNERSHIP COMPOSED OF~~
260		-	~~BUSINESSES IN WHICH EACH HAS AT LEAST~~ A ~~40% INTEREST IN~~ THE ~~JOIN T VENTURE~~
261		-	~~OR PARTNERSHIP .~~
	249	+	(III) ALONE, OR JOINTLY WITH ITS AFFILIATES OR 9
	250	+	SUBSIDIARIES, DETERMINES THE PURPOSES A ND MEANS OF THE PROC ESSING OF 10
	251	+	CONSUMERS ’ PERSONAL DATA ; 11
262	252
263		-	(I) (1) “DARK PATTERN ” MEANS A USER INTERFA CE DESIGNED OR
264		-	MANIPULATED WITH THE PURPOSE OF SUBVERTING OR IMP AIRING USER
265		-	AUTONOMY , DECISION MAKING , OR CHOICE.
	253	+	(IV) DOES BUSINESS IN THE STATE; AND 12
266	254
267		-	(2) “DARK PATTERN ” INCLUDES ANY PRACTIC E IDENTIFIED BY THE
268		-	FEDERAL TRADE COMMISSION AS A DARK PATTERN.
	255	+	(V) 1. HAS ANNUAL GROSS REVE NUES IN EXCESS OF 13
	256	+	$25,000,000, ADJUSTED EVERY ODD –NUMBERED YEAR TO REF LECT ADJUSTMENTS 14
	257	+	IN THE CONSUMER PRICE INDEX; 15
269	258
270		-	(J) “DATA PROTECTION IMPAC T ASSESSMENT” OR “ASSESSMENT” MEANS A
271		-	SYSTEMATIC SURVEY TO ASSESS COM PLIANCE WITH THE DUT Y TO ACT IN THE BEST
272		-	INTERESTS OF CHILDRE N.
	259	+	2. ANNUALLY BUYS , RECEIVES, SELLS, OR SHARES THE 16
	260	+	PERSONAL DATA OF 50,000 OR MORE CONSUMERS , HOUSEHOLDS , OR DEVICES, 17
	261	+	ALONE OR IN COMBINAT ION WITH ITS AFFILIA TES OR SUBSIDIARIES , FOR THE 18
	262	+	COVERED ENTITY ’S COMMERCIAL PURPOSE S; OR 19
273	263
274		-	(K) “DEFAULT” MEANS A PRESELECTED OPTION ADOPTED BY TH E
275		-	COVERED ENTITY FOR A N ONLINE PRODUCT .
276		-	WES MOORE, Governor Ch. 461
	264	+	3. DERIVES AT LEAST 50% OF ITS ANNUAL REVENU ES 20
	265	+	FROM THE SALE OF CON SUMERS’ PERSONAL DATA . 21
277	266
278		-	– 7 –
279		-	(L) “DE–IDENTIFIED INFORMATI ON” MEANS DATA THAT CANN OT
280		-	REASONABLY BE USED TO INFER INFORMATION ABOUT, OR OTHERWISE BE LINK ED
281		-	TO, AN IDENTIFIED OR IDE NTIFIABLE INDIVIDUAL , IF THE COVERED ENTIT Y THAT
282		-	POSSESSES THE DATA :
	267	+	(2) “COVERED ENTITY ” INCLUDES: 22
283	268
284		-	(1) TAKES REASONABLE MEAS URES TO ENSURE THAT THE DATA
285		-	CANNOT BE LINKED WIT H AN INDIVIDUAL;
	269	+	(I) AN ENTITY THAT CONTRO LS OR IS CONTROLLED BY A 23
	270	+	BUSINESS AND THAT SH ARES A NAME, SERVICE MARK , OR TRADEMARK THAT WO ULD 24
	271	+	CAUSE A REASONABLE CONSUMER TO UNDERSTA ND THAT TWO OR MORE ENTITIES 25
	272	+	ARE COMMONLY OWNED ; AND 26
286	273
287		-	(2) PUBLICLY COMMITS TO:
	274	+	(II) A JOINT VENTURE OR PAR TNERSHIP COMPOSED OF 27
	275	+	BUSINESSES IN WHICH EACH HAS AT LEAST A 40% INTEREST IN THE JOIN T VENTURE 28
	276	+	OR PARTNERSHIP . 29
288	277
289		-	(I) MAINTAIN AND USE THE DATA IN DE–IDENTIFIED FORM ;
290		-	AND
	278	+	(I) (1) “DARK PATTERN ” MEANS A USER INTERFACE DESIGNED O R 30
	279	+	MANIPULATED WITH THE PURPOSE OF SUBVERTIN G OR IMPAIRING USER 31
	280	+	AUTONOMY , DECISION MAKING , OR CHOICE. 32
	281	+	HOUSE BILL 603 7
291	282
292		-	(II) NOT ATTEMPT TO RE –IDENTIFY THE INFORMA TION; AND
293	283
294		-	(3) ~~CONTRACTUALLY OBLIGAT ES~~ ANY ~~RECIPIENTS OF~~ THE
295		-	~~INFORMATION TO COMPL Y WITH ALL PROVISION S OF THIS SUBSECTION~~ .
	284	+	(2) “DARK PATTERN ” INCLUDES ANY PRACTIC E IDENTIFIED BY THE 1
	285	+	FEDERAL TRADE COMMISSION AS A DARK PATTERN. 2
296	286
297		-	(M) “DERIVED DATA” MEANS DATA THAT ARE DERIVED FROM OTHER D ATA
298		-	OR INFORMATION , OR OTHERWISE OBTAINE D THROUGH CORRELATIO NS,
299		-	PREDICTIONS, ASSUMPTIONS , INFERENCES, OR CONCLUSIONS DRAWN FROM FACTS
300		-	OR EVIDENCE OR ANOTH ER SOURCE OF INFORMA TION OR DATA ABOUT A CHILD OR
301		-	A CHILD’S DEVICE.
	287	+	(J) “DATA PROTECTION IMPACT ASSESSMENT ” OR “ASSESSMENT” MEANS A 3
	288	+	SYSTEMATIC SURVEY TO ASSESS COMPLIANCE WI TH THE DUTY TO ACT I N THE BEST 4
	289	+	INTERESTS OF CHILDRE N. 5
302	290
303		-	(~~N) (L~~) “~~DIVISION~~” MEANS ~~THE DIVISION OF CONSUMER PROTECTION~~
304		-	~~OF THE OFFICE OF THE ATTORNEY GENERAL~~.
	291	+	(K) “DEFAULT” MEANS A PRESELECTED OPTION ADOPTED BY TH E 6
	292	+	COVERED ENTITY FOR A N ONLINE PRODUCT . 7
305	293
306		-	(O) (M) (1) “ONLINE PRODUCT ” MEANS AN ONLINE SERV ICE, PRODUCT,
307		-	OR FEATURE.
	294	+	(L) “DE–IDENTIFIED I NFORMATION ” MEANS DATA THAT CANN OT 8
	295	+	REASONABLY BE USED T O INFER INFORMATION ABOUT, OR OTHERWISE BE LINK ED 9
	296	+	TO, AN IDENTIFIED OR IDE NTIFIABLE INDIVIDUAL , IF THE COVERED ENTIT Y THAT 10
	297	+	POSSESSES THE DATA : 11
308	298
309		-	(2) “ONLINE PRODUCT ” DOES NOT INCLUDE :
	299	+	(1) TAKES REASONABLE MEAS URES TO ENSURE THAT THE DATA 12
	300	+	CANNOT BE LINKED WITH AN INDIVIDUAL; 13
310	301
311		-	(I) A TELECOMMUNICATIONS S ERVICE, AS DEFINED IN 47
312		-	U.S.C. § 153;
	302	+	(2) PUBLICLY COMMITS TO : 14
313	303
314		-	(II) THE ~~SALE, DELIVERY,~~ ~~OR USE OF A PHYSICAL PRODUCT~~
315		-	~~SOLD BY AN ONLINE RE TAILER; OR~~
	304	+	(I) MAINTAIN AND USE THE DATA IN DE–IDENTIFIED FORM ; 15
	305	+	AND 16
316	306
317		-	(III) A BROADBAND INTERNET ACCESS SERVI CE, AS DEFINED IN
318		-	47 C.F.R. § 8.1(B).
	307	+	(II) NOT ATTEMPT TO RE –IDENTIFY THE INFORMA TION; AND 17
319	308
320		-	(P) (N) (1) “PERSONAL DAT A” MEANS INFORMATION TH AT IS LINKED
321		-	OR REASONABLY ABLE T O BE LINKED, ALONE OR IN COMBINAT ION WITH OTHER
322		-	INFORMATION , TO AN IDENTIFIED OR IDENTIFIABLE INDIVID UAL. Ch. 461 2024 LAWS OF MARYLAND
	309	+	(3) CONTRACTUALLY OBLIGAT ES ANY RECIPIENTS OF THE 18
	310	+	INFORMATION TO COMPL Y WITH ALL PROVISIONS OF THIS SUBSECTION . 19
323	311
324		-	– 8 –
	312	+	(M) “DERIVED DATA” MEANS DATA THAT ARE DERIVED FROM OTHER D ATA 20
	313	+	OR INFORMATION , OR OTHERWISE OBTAINE D THROUGH CORRELATIO NS, 21
	314	+	PREDICTIONS, ASSUMPTIONS , INFERENCES, OR CONCLUSIONS DRAWN FROM FACTS 22
	315	+	OR EVIDENCE OR ANOTHER SOURCE OF IN FORMATION OR DATA AB OUT A CHILD OR 23
	316	+	A CHILD’S DEVICE. 24
325	317
326		-	(2) “PERSONAL DATA ” INCLUDES DERIVED DAT A THAT OTHERWISE
327		-	MEETS THE DEFINITION IN PARAGRAPH (1) OF THIS SUBSECTION DOES NOT
328		-	INCLUDE:
	318	+	(N) (L) “DIVISION” MEANS THE DIVISION OF CONSUMER PROTECTION 25
	319	+	OF THE OFFICE OF THE ATTORNEY GENERAL. 26
329	320
330		-	(I) DE–IDENTIFIED DATA ; OR
	321	+	(O) (M) (1) “ONLINE PRODUCT ” MEANS AN ONLINE SERV ICE, PRODUCT, 27
	322	+	OR FEATURE. 28
331	323
332		-	(II) ~~PUBLICLY AVAILABLE IN FORMATION.~~
	324	+	(2) “ONLINE PRODUCT ” DOES NOT INCLUDE : 29
333	325
334		-	(Q) (O) (1) “PRECISE GEOLOCATION ” MEANS ANY DATA THAT IS:
	326	+	(I) A TELECOMMUNICATIONS S ERVICE, AS DEFINED IN 47 30
	327	+	U.S.C. § 153; 31 8 HOUSE BILL 603
335	328
336		-	(1) DERIVED FROM A DEVICE ; AND
337	329
338		-	(2) USED OR INTENDED TO B E USED TO LOCATE A CONSUMER
339		-	GEOGRAPHICALLY WITHI N A RADIUS OF UP TO 1,850 FEET INFORMATION DERIVED
340		-	FROM TECHNOLOGY THAT CAN PRECISELY AND AC CURATELY IDENTIFY TH E
341		-	SPECIFIC LOCATION OF A CONSUMER WITHIN A RADIUS OF 1,750 FEET.
342	330
343		-	(2) “PRECISE GEOLOCATION ” INCLUDES LATITUDE AN D LONGITUDE
344		-	COORDINATES OF SIMIL AR PRECISION TO THOS E PRODUCED BY A GLOB AL
345		-	POSITIONING SYSTEM O R A SIMILAR MECHANIS M.
	331	+	(II) THE SALE, DELIVERY, OR USE OF A PHYSICAL PRODUCT 1
	332	+	SOLD BY AN ONLINE RE TAILER; OR 2
346	333
347		-	(3) “PRECISE GEOLOCATION ” DOES NOT INCLUDE :
	334	+	(III) A BROADBAND INTERNET ACCESS SERVI CE, AS DEFINED IN 3
	335	+	47 C.F.R. § 8.1(B). 4
348	336
349		-	(I) THE CONTENT OF COMMUN ICATIONS;
	337	+	(P) (N) (1) “PERSONAL DATA ” MEANS INFORMATION TH AT IS LINKED 5
	338	+	OR REASONABLY ABLE T O BE LINKED, ALONE OR IN COMBINAT ION WITH OTHER 6
	339	+	INFORMATION , TO AN IDENTIFIED OR IDENTIFIABLE INDIVID UAL. 7
350	340
351		-	(II) DATA GENERATED BY OR CONNECTED WITH A UTIL ITY
352		-	COMPANY’S ADVANCED METERING INFRASTRUCTURE ; OR
	341	+	(2) “PERSONAL DATA ” INCLUDES DERIVED DAT A THAT OTHERWISE 8
	342	+	MEETS THE DEFINITION IN PARAGRAPH (1) OF THIS SUBSECTION DOES NOT 9
	343	+	INCLUDE: 10
353	344
354		-	(III) DATA GENERATED BY EQU IPMENT USED BY A UTI LITY
355		-	COMPANY.
	345	+	(I) DE–IDENTIFIED DATA ; OR 11
356	346
357		-	(R) (P) (1) “PROCESS” MEANS TO CONDUCT OR DIRECT ANY
358		-	OPERATION THAT MAY BE PERFORME D ON PERSONAL DATA , WHETHER OR NOT BY
359		-	AUTOMATED MEANS TO PERFORM AN OPERAT ION OR SET OF OPERAT IONS BY
360		-	MANUAL OR AUTOMATED MEANS ON PERSONAL DA TA.
	347	+	(II) PUBLICLY AVAILABLE IN FORMATION. 12
361	348
362		-	(2) “~~PROCESS~~” ~~INCLUDES~~:
	349	+	(Q) (O) (1) “PRECISE GEOLOCATION ” MEANS ANY DATA THAT IS: 13
363	350
364		-	(I) ~~COLLECTING PERSONAL D ATA~~;
	351	+	(1) DERIVED FROM A DEVICE ; AND 14
365	352
366		-	(II) USING PERSONAL DATA ;
	353	+	(2) USED OR INTENDED TO B E USED TO LOCATE A C ONSUMER 15
	354	+	GEOGRAPHICALLY WITHI N A RADIUS OF UP TO 1,850 FEET INFORMATION DERIVED 16
	355	+	FROM TECHNOLOGY THAT CAN PRECISELY AND AC CURATELY IDENTIFY TH E 17
	356	+	SPECIFIC LOCATION OF A CONSUMER WITHIN A RADIUS OF 1,750 FEET. 18
367	357
368		-	(III) STORING PERSONAL DATA ; WES MOORE, Governor Ch. 461
	358	+	(2) “PRECISE GEOLOCATION ” INCLUDES LATITUDE AN D LONGITUDE 19
	359	+	COORDINATES OF SIMIL AR PRECISION TO THOS E PRODUCED BY A GLOB AL 20
	360	+	POSITIONING SYSTEM O R A SIMILAR MECHANIS M. 21
369	361
370		-	~~– 9 –~~
	362	+	(3) “PRECISE GEOLOCATION ” DOES NOT INCLUDE : 22
371	363
372		-	(IV) ~~DISCLOSING PERSONAL D ATA~~;
	364	+	(I) THE CONTENT OF COMMUN ICATIONS; 23
373	365
374		-	(V) ANALYZING PERSONAL DA TA;
	366	+	(II) DATA GENERATED BY OR CONNECTED WITH A UTI LITY 24
	367	+	COMPANY’S ADVANCED METERING INFRASTRUCTURE ; OR 25
375	368
376		-	(VI) DELETING PERSONAL DAT A;
	369	+	(III) DATA GENERATED BY EQU IPMENT USED BY A UTI LITY 26
	370	+	COMPANY. 27
377	371
378		-	(VII) MODIFYING PERSONAL DA TA; AND
	372	+	(R) (P) (1) “PROCESS” MEANS TO CONDUCT OR DIRECT ANY 28
	373	+	OPERATION THAT MAY BE PERFORME D ON PERSONAL DATA , WHETHER OR NOT BY 29 HOUSE BILL 603 9
379	374
380		-	(VIII) OTHERWISE HANDLING PE RSONAL DATA COLLECTING,
381		-	USING, STORING, DISCLOSING, ANALYZING, DELETING, OR MODIFYING PERSONA L
382		-	DATA.
383	375
384		-	(S) (Q) (1) “PROFILING” MEANS ANY FORM OF AU TOMATED
385		-	PROCESSING OF PERSON AL DATA THAT USES PE RSONAL DATA TO EVALU ATE,
386		-	ANALYZE, OR PREDICT CERTAIN A SPECTS RELATING TO A N INDIVIDUAL, INCLUDING
387		-	AN INDIVIDUAL’S ECONOMIC SITUATION , HEALTH, PERSONAL PREFERENCES ,
388		-	INTERESTS, RELIABILITY, BEHAVIOR, LOCATION, OR MOVEMENTS .
	376	+	AUTOMATED MEANS TO PERFORM AN OPERAT ION OR SET OF OPERAT IONS BY 1
	377	+	MANUAL OR AUTOMATED MEANS ON PERSONAL DA TA. 2
389	378
390		-	(2) “PROFILING” DOES NOT INCLUDE THE PROCESSING OF
391		-	PERSONAL DATA THAT D OES NOT RESULT IN AN ASSESSMENT OR JUDGME NT ABOUT
392		-	AN INDIVIDUAL.
	379	+	(2) “PROCESS” INCLUDES: 3
393	380
394		-	(T) (R) (1) “PUBLICLY AVAILABLE IN FORMATION” MEANS
395		-	INFORMATION THAT :
	381	+	(I) COLLECTING PERSONAL D ATA; 4
396	382
397		-	(I) IS LAWFULLY MADE AVAI LABLE FROM FEDERAL , STATE, OR
398		-	LOCAL GOVERNMENT REC ORDS; OR
	383	+	(II) USING PERSONAL DATA ; 5
399	384
400		-	(II) A COVERED ENTITY HAS A REASONABLE BASIS TO BELIEVE
401		-	IS LAWFULLY MADE AVA ILABLE TO THE GENERAL PUBLIC BY TH E CONSUMER OR BY
402		-	WIDELY DISTRIBUTED M EDIA.
	385	+	(III) STORING PERSONAL DATA ; 6
403	386
404		-	(2) “PUBLICLY AVAILABLE IN FORMATION” DOES NOT INCLUDE
405		-	BIOMETRIC INFORMATION DATA COLLECTED BY A COVER ED ENTITY ABOUT A
406		-	CONSUMER WITHOUT THE CONSUMER ’S KNOWLEDGE .
	387	+	(IV) DISCLOSING PERSONAL D ATA; 7
407	388
408		-	(U) (S) “REASONABLY LIKEL Y TO BE ACCESSED BY CHILDREN” MEANS
409		-	REASONABLY EXPECTED IT IS REASONABLE TO EXPECT THAT THE ONLINE PROD UCT
410		-	WOULD BE ACCESSED BY CHILDREN, BASED ON SATISFYING ANY OF THE FOLLOWING
411		-	CRITERIA:
	389	+	(V) ANALYZING PERSONAL DA TA; 8
412	390
413		-	(1) THE ONLINE PRODUCT IS DIRECTED TO CHILDREN AS DEFINED IN
414		-	THE FEDERAL CHILDREN’S ONLINE PRIVACY PROTECTION ACT; Ch. 461 2024 LAWS OF MARYLAND
	391	+	(VI) DELETING PERSONAL DAT A; 9
415	392
416		-	– 10 –
	393	+	(VII) MODIFYING PERSONAL DA TA; AND 10
417	394
418		-	(2) ~~THE ONLINE PRODUCT IS DETERMINED~~ , ~~BASED ON COMPETENT~~
419		-	~~AND RELIABLE EVIDENC E REGARDING AUDIENCE COMPOSITION~~ , ~~TO BE ROUTINELY~~
420		-	~~ACCESSED BY A SIGNIF ICANT NUMBER OF CHIL DREN;~~
	395	+	(VIII) OTHERWISE HANDLING PE RSONAL DATA COLLECTING, 11
	396	+	USING, STORING, DISCLOSING, ANALYZING, DELETING, OR MODIFYING PERSONA L 12
	397	+	DATA. 13
421	398
422		-	(3) THE ONLINE PRODUCT IS SUBSTANTIALLY SIMILA R OR THE SAME
423		-	AS AN ONLINE PRODUCT THAT SATISFIES ITEM (2) OF THIS SUBSECTION ;
	399	+	(S) (Q) (1) “PROFILING” MEANS ANY FORM OF AU TOMATED 14
	400	+	PROCESSING OF PERSON AL DATA THAT USES PE RSONAL DATA TO EVALU ATE, 15
	401	+	ANALYZE, OR PREDICT CERTAIN A SPECTS RELATING TO A N INDIVIDUAL, INCLUDING 16
	402	+	AN INDIVIDUAL’S ECONOMIC SITUATION , HEALTH, PERSONAL PREFERENCES , 17
	403	+	INTERESTS, RELIABILITY, BEHAVIOR, LOCATION, OR MOVEMENTS . 18
424	404
425		-	(4) THE ONLINE PRODUCT FE ATURES ADVERTISEMENT S MARKETED
426		-	TO CHILDREN;
	405	+	(2) “PROFILING” DOES NOT INCLUDE THE PROCESSING OF 19
	406	+	PERSONAL DATA THAT D OES NOT RESULT IN AN ASSESSMENT OR JUDGME NT ABOUT 20
	407	+	AN INDIVIDUAL. 21
427	408
428		-	(5) THE COVERED ENTITY ’S INTERNAL RESEARCH FINDINGS
429		-	DETERMINE THAT A SIG NIFICANT AMOUNT OF THE ONLINE PRODUCT’S AUDIENCE IS
430		-	COMPOSED OF CHILDREN ; OR
	409	+	(T) (R) (1) “PUBLICLY AVAILABLE IN FORMATION” MEANS 22
	410	+	INFORMATION THAT : 23
431	411
432		-	(6) ~~THE COVERED ENTITY KN OWS~~ OR ~~SHOULD HAVE K NOWN THAT A~~
433		-	~~USER IS A CHILD.~~
	412	+	(I) IS LAWFULLY MADE AVAI LABLE FROM FEDERAL , STATE, OR 24
	413	+	LOCAL GOVERNMENT REC ORDS; OR 25
434	414
435		-	(V) (T) (1) “SELL” MEANS TO TRANSFER , RENT, RELEASE, DISCLOSE,
436		-	DISSEMINATE, MAKE AVAILABLE , OR OTHERWISE COMMU NICATE, WHETHER
437		-	ORALLY, IN WRITING, OR BY ELECTRONIC OR OTHER MEANS , A CONSUMER ’S
438		-	PERSONAL DATA , IN A TRANSACTION FOR MONETARY OR OTHER VA LUABLE
439		-	CONSIDERATION BETWEE N A COVERED ENTITY A ND A THIRD PARTY .
	415	+	(II) A COVERED ENTITY HAS A REASONABLE BASIS TO BELIEVE 26
	416	+	IS LAWFULLY MADE AVA ILABLE TO THE GENERAL PUBLIC BY TH E CONSUMER OR BY 27
	417	+	WIDELY DISTRIBUTED M EDIA. 28
	418	+	10 HOUSE BILL 603
440	419
441		-	(2) “SELL” DOES NOT INCLUDE :
442	420
443		-	(I) THE DISCLOSUR E OF PERSONAL DATA T O THE SERVICE
444		-	PROVIDER THAT PROCES SES PERSONAL DATA ON BEHALF OF THE COVERE D ENTITY;
	421	+	(2) “PUBLICLY AVAILABLE IN FORMATION” DOES NOT INCLUDE 1
	422	+	BIOMETRIC INFORMATION DATA COLLECTED BY A COVER ED ENTITY ABOUT A 2
	423	+	CONSUMER WITHOUT THE CONSUMER ’S KNOWLEDGE . 3
445	424
446		-	(II) THE DISCLOSURE OF PER SONAL DATA TO A THIR D PARTY
447		-	FOR PURPOSES OF PROV IDING A PRODUCT OR S ERVICE REQUESTED BY THE
448		-	CONSUMER ;
	425	+	(U) (S) “REASONABLY LIKEL Y TO BE ACCESSED BY CHILDREN” MEANS 4
	426	+	REASONABLY EXPECTED IT IS REASONABLE TO EXPECT THAT THE ONLINE PROD UCT 5
	427	+	WOULD BE ACCESSED BY CHILDREN, BASED ON SATISFYING ANY OF THE FOLLOWING 6
	428	+	CRITERIA: 7
449	429
450		-	(~~III~~) THE ~~DISCLOSURE OR TRANSF ER OF PERSONAL DATA~~ TO AN
451		-	~~AFFILIATE OR SUBSIDI ARY OF~~ THE ~~COVERED E NTITY~~;
	430	+	(1) THE ONLINE PRODUCT IS DIRECTED TO CHILDREN AS DEFINED IN 8
	431	+	THE FEDERAL CHILDREN’S ONLINE PRIVACY PROTECTION ACT; 9
452	432
453		-	(IV) THE ~~DISCLOSURE OF PER SONAL DATA WHERE THE~~
454		-	~~CONSUMER DIRECTS THE COVERED ENTITY~~ TO ~~DI SCLOSE THE PERSONAL DATA OR~~
455		-	~~INTENTIONALLY USES T HE COVERED ENTITY TO INTERACT WITH~~ A ~~THIRD PARTY~~; OR
	433	+	(2) THE ONLINE PRODUCT IS DETERMINED , BASED ON COMPETENT 10
	434	+	AND RELIABLE EVIDENC E REGARDING AUDIENCE COMPOSITION , TO BE ROUTINELY 11
	435	+	ACCESSED BY A SIGNIF ICANT NUMBER OF CHIL DREN; 12
456	436
457		-	(V) THE ~~DISCLOSURE~~ OR ~~TRA NSFER OF PERSONAL DA TA TO A~~
458		-	~~THIRD PARTY~~ AS AN ~~AS SET~~ THAT ~~IS PART~~ OF ~~AN ACTUAL OR PROPOSE D MERGER, WES MOORE, Governor Ch. 461~~
	437	+	(3) THE ONLINE PRODUCT IS SUBSTANTIALLY SIMILA R OR THE SAME 13
	438	+	AS AN ONLINE PRODUCT THAT SATISFIES ITEM (2) OF THIS SUBSECTION ; 14
459	439
460		-	– 11 –
461		-	ACQUISITION, BANKRUPTCY , OR OTHER TRANSACTION , IN WHICH THE THIRD P ARTY
462		-	ASSUMES CONTROL OF A LL OR PART OF THE COVERED E NTITY’S ASSETS.
	440	+	(4) THE ONLINE PRODUCT FE ATURES ADVERTISEMENT S MARKETED 15
	441	+	TO CHILDREN; 16
463	442
464		-	(W) (1) “SENSITIVE PERSONAL DA TA” MEANS:
	443	+	(5) THE COVERED ENTITY ’S INTERNAL RESEARCH FINDINGS 17
	444	+	DETERMINE THAT A SIG NIFICANT AMOUNT OF THE ONLINE PRODUCT’S AUDIENCE IS 18
	445	+	COMPOSED OF CHILDREN ; OR 19
465	446
466		-	(I) PERSONAL DATA THAT RE VEALS A CONSUMER ’S:
	447	+	(6) THE COVERED ENTITY KN OWS OR SHOULD HAVE K NOWN THAT A 20
	448	+	USER IS A CHILD. 21
467	449
468		-	1. SOCIAL SECURITY NUMBER , DRIVER’S LICENSE
469		-	NUMBER, STATE IDENTIFICATION CARD NUMBER , OR PASSPORT NUMBER ;
	450	+	(V) (T) (1) “SELL” MEANS TO TRANSFER , RENT, RELEASE, DISCLOSE, 22
	451	+	DISSEMINATE, MAKE AVAILABLE , OR OTHERWISE COMM UNICATE, WHETHER 23
	452	+	ORALLY, IN WRITING, OR BY ELECTRONIC OR OTHER MEANS , A CONSUMER ’S 24
	453	+	PERSONAL DATA , IN A TRANSACTION FOR MONETARY OR OTHER VA LUABLE 25
	454	+	CONSIDERATION BETWEE N A COVERED ENTITY A ND A THIRD PARTY . 26
470	455
471		-	2. ACCOUNT LOGIN INFORMATION , FINANCIAL
472		-	ACCOUNT NUMBER , DEBIT CARD NUMBER , OR CREDIT CARD NUMBE R, IN
473		-	COMBINATION WITH ANY REQUIRED SECURITY OR ACCESS CODE , PASSWORD, OR
474		-	CREDENTIALS THAT ALL OW ACCESS TO AN ACCO UNT;
	456	+	(2) “SELL” DOES NOT INCLUDE : 27
475	457
476		-	3. PRECISE GEOLOCATION ;
	458	+	(I) THE DISCLOSU RE OF PERSONAL DATA TO THE SERVICE 28
	459	+	PROVIDER THAT PROCES SES PERSONAL DATA ON BEHALF OF THE COVERE D ENTITY; 29
477	460
478		-	4. RACIAL OR ETHNIC ORIGIN OR RELIGIOUS OR
479		-	PHILOSOPHICAL BELIEF S;
	461	+	(II) THE DISCLOSURE OF PER SONAL DATA TO A THIR D PARTY 30
	462	+	FOR PURPOSES OF PROV IDING A PRODUCT OR S ERVICE REQUESTED BY THE 31
	463	+	CONSUMER ; 32
	464	+	HOUSE BILL 603 11
480	465
481		-	5. MAIL, E–MAIL, TEXT, OR MESSAGE CONTENTS ,
482		-	UNLESS THE COVERED E NTITY IS THE INTENDE D RECIPIENT; OR
483	466
484		-	6. GENETIC DATA;
	467	+	(III) THE DISCLOSURE OR TRANSF ER OF PERSONAL DATA TO AN 1
	468	+	AFFILIATE OR SUBSIDI ARY OF THE COVERED E NTITY; 2
485	469
486		-	(II) BIOMETRIC INFORMATION THAT IS OR MAY BE PR OCESSED
487		-	FOR THE PURPOSE OF U NIQUELY IDENTIFYING A C ONSUMER;
	470	+	(IV) THE DISCLOSURE OF PER SONAL DATA WHERE THE 3
	471	+	CONSUMER DIRECTS THE COVERED ENTITY TO DI SCLOSE THE PERSONAL DATA OR 4
	472	+	INTENTIONALLY USES T HE COVERED ENTITY TO INTERACT WITH A THIRD PARTY; OR 5
488	473
489		-	(III) PERSONAL DATA COLLECT ED AND ANALYZED CONC ERNING
490		-	A CONSUMER ’S HEALTH; OR
	474	+	(V) THE DISCLOSURE OR TRA NSFER OF PERSONAL DA TA TO A 6
	475	+	THIRD PARTY AS AN AS SET THAT IS PART OF AN ACTUAL OR PROPOSE D MERGER, 7
	476	+	ACQUISITION, BANKRUPTCY , OR OTHER TRANSACTION , IN WHICH THE THIRD P ARTY 8
	477	+	ASSUMES CONTROL OF A LL OR PART OF THE COVERED E NTITY’S ASSETS. 9
491	478
492		-	(IV) PERSONAL DATA COLLECT ED AND ANALYZED CONC ERNING
493		-	A CONSUMER ’S SEX LIFE OR SEXUAL ORIENTATION .
	479	+	(W) (1) “SENSITIVE PERSONAL DA TA” MEANS: 10
494	480
495		-	(2) “SENSITIVE PERSONAL DA TA” DOES NOT I NCLUDE PUBLICLY
496		-	AVAILABLE INFORMATIO N.
	481	+	(I) PERSONAL DATA THAT RE VEALS A CONSUMER ’S: 11
497	482
498		-	(X) (U) “SERVICE PROVIDER ” MEANS A PERSON THAT PROCESSES
499		-	PERSONAL DATA ON BEH ALF OF A COVERED ENT ITY AND THAT RECEIVE S FROM OR
500		-	ON BEHALF OF THE COV ERED ENTITY A CONSUM ER’S PERSONAL DATA FOR
501		-	BUSINESS PURPOSES IN ACCORDANCE WITH A WR ITTEN CONTRACT , IF THE
502		-	CONTRACT PROHIBITS T HE PERSON FROM :
	483	+	1. SOCIAL SECURITY NUMBER , DRIVER’S LICENSE 12
	484	+	NUMBER, STATE IDENTIFICATION CARD NUMBER , OR PASSPORT NUMBER ; 13
503	485
504		-	(1) SELLING OR SHARING TH E PERSONAL DATA ; Ch. 461 2024 LAWS OF MARYLAND
	486	+	2. ACCOUNT L OGIN INFORMATION , FINANCIAL 14
	487	+	ACCOUNT NUMBER , DEBIT CARD NUMBER , OR CREDIT CARD NUMBE R, IN 15
	488	+	COMBINATION WITH ANY REQUIRED SECURITY OR ACCESS CODE , PASSWORD, OR 16
	489	+	CREDENTIALS THAT ALL OW ACCESS TO AN ACCO UNT; 17
505	490
506		-	~~– 12 –~~
	491	+	3. PRECISE GEOLOCATION ; 18
507	492
508		-	(2) RETAINING, USING, OR DISCLOSING THE PE RSONAL DATA FOR
509		-	ANY PURPOSE OTHER TH AN FOR THE BUSINESS PURPOSES SPECIFIED I N THE
510		-	CONTRACT FOR THE COV ERED ENTITY , INCLUDING RETAINING , USING, OR
511		-	DISCLOSING THE PERSO NAL DATA FOR A COMME RCIAL PURPOSE OTHER THAN THE
512		-	BUSINESS PURPOSES SP ECIFIED IN THE CONTR ACT WITH THE COVERED ENTITY, OR
513		-	AS OTHERWISE ALLOWED UNDER THIS SUBTITLE ;
	493	+	4. RACIAL OR ETHNIC ORIGIN OR RELIGIOUS OR 19
	494	+	PHILOSOPHICAL BELIEF S; 20
514	495
515		-	(3) RETAINING, USING, OR DISCLOSING THE PE RSONAL DATA
516		-	OUTSIDE THE DIRECT B USINESS RELATIONSHIP BETWEEN THE SERVICE PROVIDER
517		-	AND THE COVERED ENTI TY; AND
	496	+	5. MAIL, E–MAIL, TEXT, OR MESSAGE CONTENTS , 21
	497	+	UNLESS THE COVERED E NTITY IS THE INTENDE D RECIPIENT; OR 22
518	498
519		-	(4) COMBINING THE PERSONA L DATA THAT THE SERV ICE PROVIDER
520		-	RECEIVES FROM , OR ON BEHALF OF , THE COVERED ENTIT Y WITH PERSONAL DATA
521		-	THAT IT RECEIVES FRO M, OR ON BEHALF OF , ANOTHER PERSON OR PE RSONS, OR
522		-	COLLECTS FROM ITS OW N INTERACTION WITH T HE CONSUMER .
	499	+	6. GENETIC DATA; 23
523	500
524		-	(Y) (V) “SHARE” MEANS TO RENT , RELEASE, DISSEMINATE, MAKE
525		-	AVAILABLE, TRANSFER, OR OTHERWISE COMMUNI CATE, WHETHER ORALLY, IN
526		-	WRITING, OR BY ELECTRONIC OR OTHER MEANS , A CONSUMER ’S PERSONAL DATA TO
527		-	A THIRD PARTY FOR CR OSS–CONTEXT BEHAVIORAL A DVERTISING WHETHER O R NOT
528		-	FOR MONETARY OR OTHE R VALUABLE CONSIDERA TION, INCLUDING IN A
529		-	TRANSACTION BETWEEN A COVERED EN TITY AND A THIRD PARTY FOR TARGETED
530		-	ADVERTISING FOR THE BENEFIT OF A COVERED ENTITY IN WHICH NO M ONEY IS
531		-	EXCHANGED .
	501	+	(II) BIOMETRIC INFORMATION THAT IS OR MAY BE PR OCESSED 24
	502	+	FOR THE PURPOSE OF U NIQUELY IDENTIFYING A CO NSUMER; 25
532	503
533		-	(Z) (1) “TARGETED ADVERTISING ” MEANS DISPLAYING
534		-	ADVERTISEMENTS TO A CONSUMER WHERE THE A DVERTISEMENT IS SELE CTED
535		-	BASED ON PERSONAL DA TA OBTAINED OR INFERRED FROM THA T CONSUMER ’S
536		-	ACTIVITIES OVER TIME AND ACROSS NONAFFILI ATED INTERNET WEBSITES OR
537		-	ONLINE APPLICATIONS TO PREDICT THE CONSU MER’S PREFERENCES OR
538		-	INTERESTS.
	504	+	(III) PERSONAL DATA COLLECT ED AND ANALYZED CONC ERNING 26
	505	+	A CONSUMER ’S HEALTH; OR 27
539	506
540		-	(2) “TARGETED ADVERTISING ” DOES NOT INCLUDE :
	507	+	(IV) PERSONAL DATA COLLECT ED AND ANALYZED CONC ERNING 28
	508	+	A CONSUMER ’S SEX LIFE OR SEXUAL ORIENTATION . 29
	509	+	12 HOUSE BILL 603
541	510
542		-	(I) ADVERTISEMENTS BASED ON ACTIVITIES WITHIN A
543		-	COVERED ENTITY ’S OWN INTERNET WEBSITES OR ONLINE APPLICATIONS ;
544	511
545		-	(II) ADVERTISEMENTS BASED ON THE CONTEXT OF A
546		-	CONSUMER ’S CURRENT SEARCH QUE RY, VISIT TO AN INTERNET WEBSITE , OR USE OF
547		-	AN ONLINE APPLICATIO N;
548		-	WES MOORE, Governor Ch. 461
	512	+	(2) “SENSITIVE PERSONAL DA TA” DOES NOT IN CLUDE PUBLICLY 1
	513	+	AVAILABLE INFORMATIO N. 2
549	514
550		-	– 13 –
551		-	(III) ADVERTISEMENTS DI RECTED TO A CONSUMER IN
552		-	RESPONSE TO THE CONS UMER’S REQUEST FOR INFORM ATION OR FEEDBACK ; OR
	515	+	(X) (U) “SERVICE PROVIDER ” MEANS A PERSON THAT PROCESSES 3
	516	+	PERSONAL DATA ON BEH ALF OF A COVERED ENT ITY AND THAT RECEIVE S FROM OR 4
	517	+	ON BEHALF OF THE COV ERED ENTITY A CONSUM ER’S PERSONAL DATA FOR 5
	518	+	BUSINESS PURPOSES IN ACCORDANCE WITH A WR ITTEN CONTRACT , IF THE 6
	519	+	CONTRACT PROHIBITS T HE PERSON FROM : 7
553	520
554		-	(IV) PROCESSING PERSONAL D ATA SOLELY TO MEASUR E OR
555		-	REPORT ADVERTISING F REQUENCY, PERFORMANCE , OR REACH.
	521	+	(1) SELLING OR SHARING TH E PERSONAL DATA ; 8
556	522
557		-	(AA) (W) “THIRD PARTY” MEANS A PERSON WHO I S NOT:
	523	+	(2) RETAINING, USING, OR DISCLOSING THE PE RSONAL DATA FOR 9
	524	+	ANY PURPOSE OTHER TH AN FOR THE BUSINESS PURPOSES SPECIFIED I N THE 10
	525	+	CONTRACT FOR THE COVERED ENTITY, INCLUDING RETAINING , USING, OR 11
	526	+	DISCLOSING THE PERSO NAL DATA FOR A COMME RCIAL PURPOSE OTHER THAN THE 12
	527	+	BUSINESS PURPOSES SP ECIFIED IN THE CONTR ACT WITH THE COVERED ENTITY, OR 13
	528	+	AS OTHERWISE ALLOWED UNDER THIS SUBTITLE ; 14
558	529
559		-	(1) THE COVERED ENTITY WI TH WHICH THE CONSUME R
560		-	INTENTIONALLY INTERA CTS AND THAT COLLECT S PERSONAL DATA FROM THE
561		-	CONSUMER AS PART OF THE CONSUMER ’S INTERACTION WITH T HE COVERED
562		-	ENTITY; OR
	530	+	(3) RETAINING, USING, OR DISCLOSING THE PE RSONAL DATA 15
	531	+	OUTSIDE THE DIRECT B USINESS RELATIONSHIP BETWEEN THE SERVICE PROVIDER 16
	532	+	AND THE COVERED ENTI TY; AND 17
563	533
564		-	(2) A SERVICE PROVIDER FOR THE COVERED ENTITY .
	534	+	(4) COMBINING THE PERSONA L DATA THAT THE SERV ICE PROVIDER 18
	535	+	RECEIVES FROM , OR ON BEHALF OF , THE COVERED ENTITY W ITH PERSONAL DATA 19
	536	+	THAT IT RECEIVES FRO M, OR ON BEHALF OF , ANOTHER PERSON OR PE RSONS, OR 20
	537	+	COLLECTS FROM ITS OW N INTERACTION WITH T HE CONSUMER . 21
565	538
566		-	14–4602.
	539	+	(Y) (V) “SHARE” MEANS TO RENT , RELEASE, DISSEMINATE, MAKE 22
	540	+	AVAILABLE, TRANSFER, OR OTHERWISE COMMUNI CATE, WHETHER OR ALLY, IN 23
	541	+	WRITING, OR BY ELECTRONIC OR OTHER MEANS , A CONSUMER ’S PERSONAL DATA TO 24
	542	+	A THIRD PARTY FOR CR OSS–CONTEXT BEHAVIORAL A DVERTISING WHETHER O R NOT 25
	543	+	FOR MONETARY OR OTHE R VALUABLE CONSIDERA TION, INCLUDING IN A 26
	544	+	TRANSACTION BETWEEN A COVERED EN TITY AND A THIRD PARTY FOR TARGE TED 27
	545	+	ADVERTISING FOR THE BENEFIT OF A COVERED ENTITY IN WHICH NO M ONEY IS 28
	546	+	EXCHANGED . 29
567	547
568		-	THIS SUBTITLE DOES NOT AP PLY TO:
	548	+	(Z) (1) “TARGETED ADVERTISING ” MEANS DISPLAYING 30
	549	+	ADVERTISEMENTS TO A CONSUMER WHERE THE A DVERTISEMENT IS SELE CTED 31
	550	+	BASED ON PERSONAL DA TA OBTAINED OR INFERRED FROM THAT C ONSUMER’S 32
	551	+	ACTIVITIES OVER TIME AND ACROSS NONAFFILI ATED INTERNET WEBSITES OR 33
	552	+	ONLINE APPLICATIONS TO PREDICT THE CONSU MER’S PREFERENCES OR 34
	553	+	INTERESTS. 35
569	554
570		-	(1) DATA SUBJECT TO A STA TUTE OR REGULATION I DENTIFIED
571		-	UNDER ITEM (I) OF THIS ITEM THAT IS CONTROLLED BY A COVE RED ENTITY OR
572		-	SERVICE PROVIDER THA T IS:
	555	+	(2) “TARGETED ADVERTISING ” DOES NOT INCLUDE : 36 HOUSE BILL 603 13
573	556
574		-	(I) REQUIRED TO COMPLY WI TH:
575	557
576		-	1. TITLE V OF THE FEDERAL GRAMM–LEACH–BLILEY
577		-	ACT;
578	558
579		-	~~2. THE FEDERAL HEALTH INFORMATION TECHNOLOGY~~
580		-	~~FOR ECONOMIC AND CLINICAL HEALTH ACT;~~ OR
	559	+	(I) ADVERTISEMENTS BASED ON ACTIVITIES WITHIN A 1
	560	+	COVERED ENTITY ’S OWN INTERNET WEBSITES OR ONLINE APPLICATIONS ; 2
581	561
582		-	3. REGULATIONS PROMULGAT ED UNDER § 264(C) OF
583		-	THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996; AND
	562	+	(II) ADVERTISEMENTS BASED ON THE CONTEXT OF A 3
	563	+	CONSUMER ’S CURRENT SEARCH QUE RY, VISIT TO AN INTERNET WEBSITE , OR USE OF 4
	564	+	AN ONLINE APPLICATIO N; 5
584	565
585		-	(II) IN COMPLIANCE WITH THE INFORMATION SECURITY
586		-	REQUIREMENTS OF APPL ICABLE STATUTES OR R EGULATIONS IDENTIFIE D IN ITEM
587		-	(I) OF THIS ITEM; OR PROTECTED HEALTH INFO RMATION THAT IS COLL ECTED BY A
588		-	COVERED ENTITY OR BU SINESS ASSOCIATION G OVERNED BY THE PRIVA CY
589		-	SECURITY AND BREACH NOTIFICATION RULES I N 45 C.F.R. PARTS 160 AND 164,
590		-	ESTABLISHED UNDER TH E FEDERAL HEALTH INSURANCE PORTABILITY AND
591		-	ACCOUNTABILITY ACT OF 1996 AND THE FEDERAL HEALTH INFORMATION
592		-	TECHNOLOGY FOR ECONOMIC AND CLINICAL HEALTH ACT;
593		-	Ch. 461 2024 LAWS OF MARYLAND
	566	+	(III) ADVERTISEMENTS DI RECTED TO A CONSUMER IN 6
	567	+	RESPONSE TO THE CONS UMER’S REQUEST FOR INFORM ATION OR FEEDBACK ; OR 7
594	568
595		-	– 14 –
596		-	(2) A COVERED ENTITY GOVERNED BY THE PRIV ACY SECURITY AND
597		-	BREACH NOTIFICATION RULES IN 45 C.F.R. PARTS 160 AND 164, ESTABLISHED
598		-	UNDER THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY
599		-	ACT OF 1996 AND THE FEDERAL HEALTH INFORMATION TECHNOLOGY FOR
600		-	ECONOMIC AND CLINICAL HEALTH ACT, TO THE EXTENT THAT T HE COVERED
601		-	ENTITY MAINTAINS PAT IENT INFORMATION IN THE SAME MANNER AS M EDICAL
602		-	INFORMATION OR PROTE CTED HEALTH INFORMAT ION AS DESCRIBED IN ITEM (1) OF
603		-	THIS SECTION; OR
	569	+	(IV) PROCESSING PERSONAL D ATA SOLELY TO MEASUR E OR 8
	570	+	REPORT ADVERTISING F REQUENCY, PERFORMANCE , OR REACH. 9
604	571
605		-	(3) (2) INFORMATION COLLECTED AS PART OF A CLINICA L TRIAL
606		-	SUBJECT TO THE FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS,
607		-	IN ACCORDANCE WITH :
	572	+	(AA) (W) “THIRD PARTY” MEANS A PERSON WHO I S NOT: 10
608	573
609		-	(I) GOOD CLINICAL PRACTIC E GUIDELINES ISSUED BY THE
610		-	INTERNATIONAL COUNCIL FOR HARMONISATION OF TECHNICAL REQUIREMENTS
611		-	FOR PHARMACEUTICALS FOR HUMAN USE; OR
	574	+	(1) THE COVERED ENTITY WI TH WHICH THE CONSUME R 11
	575	+	INTENTIONALLY INTERA CTS AND THAT COLLECT S PERSONAL DATA FROM THE 12
	576	+	CONSUMER AS PART OF THE CONSUMER ’S INTERACTION WITH T HE COVERED 13
	577	+	ENTITY; OR 14
612	578
613		-	(II) HUMAN SUBJECT PROTECT ION REQUIREMENTS OF THE
614		-	U.S. FOOD AND DRUG ADMINISTRATION .
	579	+	(2) A SERVICE PROVIDER FOR THE COVERED ENTITY . 15
615	580
616		-	14–~~4603~~.
	581	+	14–4602. 16
617	582
618		-	~~IT IS THE INTENT OF T HE GENERAL ASSEMBLY THAT~~ :
	583	+	THIS SUBTITLE DOES NOT APPL Y TO: 17
619	584
620		-	(1) ~~CHILDREN SHOULD BE AF FORDED PROTECTIONS N OT ONLY BY~~
621		-	~~ONLINE PRODUCTS SPEC IFICALLY DIRECTED AT THEM,~~ ~~BUT~~ BY ~~ALL ONLINE~~
622		-	~~PRODUCTS THEY ARE RE ASONABLY LIKELY TO A CCESS;~~
	585	+	(1) DATA SUBJECT TO A STA TUTE OR REGULATION I DENTIFIED 18
	586	+	UNDER ITEM (I) OF THIS ITEM THAT IS CONTROLLED BY A COVE RED ENTITY OR 19
	587	+	SERVICE PROVIDER THA T IS: 20
623	588
624		-	(2) COVERED ENTITIES THAT DEVELOP AND PROVIDE ONLINE
625		-	SERVICES PRODUCTS THAT CHILDREN ARE REASONABLY LIKELY TO ACCESS SHA LL
626		-	ENSURE THE BEST INTE RESTS OF CHILDREN WH EN DESIGNING, DEVELOPING , AND
627		-	PROVIDING THOSE ONLI NE PRODUCTS ;
	589	+	(I) REQUIRED TO COMPLY WI TH: 21
628	590
629		-	(3) ALL COVERED ENTITIES THAT OPERATE IN THE STATE AND
630		-	PROCESS CHILDREN ’S DATA IN ANY CAPACI TY SHALL DO SO IN A MANNER
631		-	CONSISTENT WITH THE BEST INTERESTS OF CH ILDREN;
	591	+	1. TITLE V OF THE FEDERAL GRAMM–LEACH–BLILEY 22
	592	+	ACT; 23
632	593
633		-	(4) IF A CONFLICT ARISES BETWEEN COMMERCIAL I NTERESTS AND
634		-	THE BEST INTERESTS O F CHILDREN, COVERED ENTITIES THA T DEVELOP ONLINE
635		-	PRODUCTS LIKELY TO B E ACCESSED BY CHILDR EN SHALL GIVE PRIORITY TO
636		-	PRIORITIZE THE PRIVACY, SAFETY, AND WELL–BEING OF CHILDREN OVER THOSE
637		-	COMMERCIAL INTERESTS; AND;
638		-	WES MOORE, Governor Ch. 461
	594	+	2. THE FEDERAL HEALTH INFORMATION TECHNOLOGY 24
	595	+	FOR ECONOMIC AND CLINICAL HEALTH ACT; OR 25
639	596
640		-	– 15 –
641		-	(5) NOTHING IN THIS SUBTITLE MAY BE CONSTRUED TO INFRINGE ON
642		-	THE EXISTING RIGHTS AND FREEDOMS OF CHIL DREN REQUIRE A COVERED EN TITY
643		-	TO MONITOR OR CENSOR THIRD–PARTY CONTENT OR OTH ERWISE IMPACT THE
644		-	EXISTING RIGHTS AND FREEDOMS OF ANY PERS ON; AND
	597	+	3. REGULATIONS PROMULGAT ED UNDER § 264(C) OF 26
	598	+	THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996; AND 27
645	599
646		-	(6) NOTHING IN THIS SUBTITLE MAY BE CONS TRUED TO
647		-	DISCRIMINATE AGAINST CHILDREN ON THE BASI S OF RACE, COLOR, RELIGION,
648		-	NATIONAL ORIGIN , DISABILITY, GENDER IDENTITY , SEX, OR SEXUAL ORIENTATIO N.
	600	+	(II) IN COMPLIANCE WITH TH E INFORMATION SECURI TY 28
	601	+	REQUIREMENTS OF APPL ICABLE STATUTES OR R EGULATIONS IDENTIFIE D IN ITEM 29 14 HOUSE BILL 603
649	602
650		-	14–4604.
651	603
652		-	(A) (1) SUBJECT TO PARAGRAPH (2) OF THIS SUBSECTION , A COVERED
653		-	ENTITY TH AT PROVIDES AN ONLIN E PRODUCT REASONABLY LIKELY TO BE
654		-	ACCESSED BY CHILDREN SHALL PREPARE A DATA PROTECTION IMPACT
655		-	ASSESSMENT FOR THE O NLINE PRODUCT .
	604	+	(I) OF THIS ITEM; OR PROTECTED HEALTH INFO RMATION THAT IS COLL ECTED BY A 1
	605	+	COVERED ENTITY OR BU SINESS ASSOCIATION G OVERNED BY THE PRIVA CY 2
	606	+	SECURITY AND BREACH NOTIFI CATION RULES IN 45 C.F.R. PARTS 160 AND 164, 3
	607	+	ESTABLISHED UNDER TH E FEDERAL HEALTH INSURANCE PORTABILITY AND 4
	608	+	ACCOUNTABILITY ACT OF 1996 AND THE FEDERAL HEALTH INFORMATION 5
	609	+	TECHNOLOGY FOR ECONOMIC AND CLINICAL HEALTH ACT; 6
656	610
657		-	(2) ON OR BEFORE APRIL 1, 2026, A COVERED ENTITY SHA LL
658		-	PREPARE A DATA PROTE CTION IMPACT ASSESSM ENT FOR ANY ONLINE PRODUCT
659		-	THAT:
	611	+	(2) A COVERED ENTITY GOVERNED BY T HE PRIVACY SECURITY AND 7
	612	+	BREACH NOTIFICATION RULES IN 45 C.F.R. PARTS 160 AND 164, ESTABLISHED 8
	613	+	UNDER THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY 9
	614	+	ACT OF 1996 AND THE FEDERAL HEALTH INFORMATION TECHNOLOGY FOR 10
	615	+	ECONOMIC AND CLINICAL HEALTH ACT, TO THE EXTENT THAT T HE COVERED 11
	616	+	ENTITY MAINTAINS PAT IENT INFORMATION IN THE SAME MANNER AS M EDICAL 12
	617	+	INFORMATION OR PROTE CTED HEALTH INFORMAT ION AS DESCRIBED IN ITEM (1) OF 13
	618	+	THIS SECTION; OR 14
660	619
661		-	(I) MEETS THE CRITERIA UN DER PARAGRAPH (1) OF THIS
662		-	SUBSECTION;
	620	+	(3) (2) INFORMATION COLLECTED AS PART OF A CLI NICAL TRIAL 15
	621	+	SUBJECT TO THE FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS, 16
	622	+	IN ACCORDANCE WITH : 17
663	623
664		-	(II) IS OFFERED TO THE PUB LIC ON OR BEFORE APRIL 1, 2026;
665		-	AND
	624	+	(I) GOOD CLINICAL PRACTIC E GUIDELINES ISSUED BY THE 18
	625	+	INTERNATIONAL COUNCIL FOR HARMONISATION OF TECHNICAL REQUIREMENTS 19
	626	+	FOR PHARMACEUTICALS FOR HUMAN USE; OR 20
666	627
667		-	(~~III~~) ~~WILL CONTINUE TO BE O FFERED TO~~ THE ~~PUBLIC AFTER~~
668		-	~~JULY 1, 2026~~.
	628	+	(II) HUMAN SUBJECT PROTECT ION REQUIREMENTS OF THE 21
	629	+	U.S. FOOD AND DRUG ADMINISTRATION . 22
669	630
670		-	(3) FOR AN ONLINE PRODUCT THAT MEETS THE CRITE RIA UNDER
671		-	PARAGRAPH (1) OF THIS SUBSECTION A ND IS INITIALLY OFFE RED TO THE PUBLIC
672		-	AFTER APRIL 1, 2026, A COVERED ENTITY SHA LL COMPLETE A DATA P ROTECTION
673		-	IMPACT ASSESSMENT WITHIN 90 DAYS AFTER THE ONLIN E PRODUCT IS OFFERED TO
674		-	THE PUBLIC.
	631	+	14–4603. 23
675	632
676		-	~~(B)~~ THE ~~DATA PROTECTION I MPACT ASSESSMENT SHA LL~~:
	633	+	IT IS THE INTENT OF T HE GENERAL ASSEMBLY THAT : 24
677	634
678		-	(1) IDENTIFY THE PURPOSE OF THE ONLINE PRODUC T;
	635	+	(1) CHILDREN SHOULD BE AF FORDED PROTECTIONS N OT ONLY BY 25
	636	+	ONLINE PRODUCTS SPEC IFICALLY DIRECTED AT THEM, BUT BY ALL ONLINE 26
	637	+	PRODUCTS THEY ARE RE ASONABLY LIKELY TO A CCESS; 27
679	638
680		-	(2) IDENTIFY HOW THE ONLI NE PRODUCT USES CHIL DREN’S DATA;
	639	+	(2) COVERED ENTITIES THAT DEVELOP AND PROVIDE ONLINE 28
	640	+	SERVICES PRODUCTS THAT CHILDREN ARE REASONABLY LIKELY TO ACCESS SHA LL 29
	641	+	ENSURE THE BEST INTE RESTS OF CHILDREN WH EN DESIGNING, DEVELOPING, AND 30
	642	+	PROVIDING THOSE ONLI NE PRODUCTS ; 31
681	643
682		-	(3) DETERMINE WHETHER THE ONLINE PRODUCT IS DE SIGNED AND
683		-	OFFERED IN A MANNER CONSISTE NT WITH THE BEST INT ERESTS OF CHILDREN Ch. 461 2024 LAWS OF MARYLAND
	644	+	(3) ALL COVERED ENTITIES THAT OPERATE IN THE STATE AND 32
	645	+	PROCESS CHILDREN ’S DATA IN ANY CAPACI TY SHALL DO SO IN A MANNER 33
	646	+	CONSISTENT WITH THE BEST INTERESTS OF CH ILDREN; 34
	647	+	HOUSE BILL 603 15
684	648
685		-	– 16 –
686		-	REASONABLY LIKELY TO ACCESS THE ONLINE PR ODUCT THROUGH CONSID ERATION
687		-	OF:
688	649
689		-	(I) WHETHER THE DATA MANA GEMENT OR PROCESSING
690		-	PRACTICES OF THE ONL INE PRODUCT COULD LE AD TO CHILDREN EXPER IENCING OR
691		-	BEING TARGETED BY CONT ACTS THAT WOULD RESU LT IN:
	650	+	(4) IF A CONFLICT ARISES BETWEEN COMMER CIAL INTERESTS AND 1
	651	+	THE BEST INTERESTS O F CHILDREN, COVERED ENTITIES THA T DEVELOP ONLINE 2
	652	+	PRODUCTS LIKELY TO B E ACCESSED BY CHILDR EN SHALL GIVE PRIORITY TO 3
	653	+	PRIORITIZE THE PRIVACY, SAFETY, AND WELL–BEING OF CHILDREN OVER THOSE 4
	654	+	COMMERCIAL INTERESTS; AND; 5
692	655
693		-	1. REASONABLY FORESEEABL E AND MATERIAL
694		-	PHYSICAL OR FINANCIA L HARM TO THE CHILD CHILDREN;
	656	+	(5) NOTHING IN THIS SUBTI TLE MAY BE CONSTRUED TO INFRINGE ON 6
	657	+	THE EXISTING RIGHTS AND FREEDOMS OF CHIL DREN REQUIRE A COVERED EN TITY 7
	658	+	TO MONITOR OR CENSOR THIRD–PARTY CONTENT OR OTH ERWISE IMPACT THE 8
	659	+	EXISTING RIGHTS AND FREEDOMS OF ANY PERS ON; AND 9
695	660
696		-	2. REASONABLY FORESEEABL E AND EXTREME
697		-	PSYCHOLOGICAL OR EMO TIONAL HARM TO THE CHILD CHILDREN;
	661	+	(6) NOTHING IN THIS SUBTI TLE MAY BE CONSTRUED TO 10
	662	+	DISCRIMINATE AGAINST CHILDREN ON THE BASI S OF RACE, COLOR, RELIGION, 11
	663	+	NATIONAL ORIGIN , DISABILITY, GENDER IDENTITY , SEX, OR SEXUAL ORIENTATIO N. 12
698	664
699		-	3. A HIGHLY OFFENSIVE INTRUSIO N ON THE CHILD’S
700		-	CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY; OR
	665	+	14–4604. 13
701	666
702		-	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN
703		-	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER
704		-	IDENTITY, SEX, OR SEXUAL ORIENTATIO N;
	667	+	(A) (1) SUBJECT TO PARAGRAPH (2) OF THIS SUBSECTION , A COVERED 14
	668	+	ENTITY THAT PROVIDES AN ONLINE PRODUCT RE ASONABLY LIKELY TO B E 15
	669	+	ACCESSED BY CHILDREN SHALL PREPARE A DATA PROTECTION IMPACT 16
	670	+	ASSESSMENT FOR THE O NLINE PRODUCT . 17
705	671
706		-	(II) ~~WHETHER THE DATA MANA GEMENT~~ OR ~~PROCESSING~~
707		-	~~PRACTICES OF THE ONL INE~~ PRODUCT ~~COULD PE RMIT CHILDREN TO WITNESS,~~
708		-	~~PARTICIPATE IN, OR BE SUBJECT TO CON DUCT~~ THAT ~~WOULD RESU LT IN~~:
	672	+	(2) ON OR BEFORE APRIL 1, 2026, A COVERED ENTITY SHA LL 18
	673	+	PREPARE A DATA PROTE CTION IMPACT ASSESSMENT FOR ANY O NLINE PRODUCT 19
	674	+	THAT: 20
709	675
710		-	1~~. REASONABLY FORESEEABL E AND MATERIAL~~
711		-	~~PHYSICAL OR FINANCIA L HARM TO THE CHILD CHILDREN~~;
	676	+	(I) MEETS THE CRITERIA UN DER PARAGRAPH (1) OF THIS 21
	677	+	SUBSECTION; 22
712	678
713		-	~~2. REASONABLY FORESEEABL E AND EXTREME~~
714		-	~~PSYCHOLOGICAL OR EMO TIONAL HARM TO THE CHILD CHILDREN;~~
	679	+	(II) IS OFFERED TO THE PUB LIC ON OR BEFORE APRIL 1, 2026; 23
	680	+	AND 24
715	681
716		-	~~3. A HIGHLY OFFENSIVE INT RUSION ON~~ THE ~~CHILD’S~~
717		-	~~CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY; OR~~
	682	+	(III) WILL CONTINUE TO BE O FFERED TO THE PUBLIC AFTER 25
	683	+	JULY 1, 2026. 26
718	684
719		-	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN
720		-	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER
721		-	IDENTITY, SEX, OR SEXUAL ORIENTATIO N;
	685	+	(3) FOR AN ONLINE PRODUCT THAT MEETS THE CRITE RIA UNDER 27
	686	+	PARAGRAPH (1) OF THIS SUBSECTION A ND IS INITIALLY OFFE RED TO THE PUBLIC 28
	687	+	AFTER APRIL 1, 2026, A COVERED ENTITY SHA LL COMPLETE A DATA P ROTECTION 29
	688	+	IMPACT ASSESSMENT WITHIN 90 DAYS AFTER THE ONLIN E PRODUCT IS OFFERED TO 30
	689	+	THE PUBLIC. 31
722	690
723		-	(III) WHETHER THE DATA MANA GEMENT OR PROCESSING
724		-	PRACTICES OF THE ONL INE PRODUCT ARE REAS ONABLY EXPECTED TO A LLOW
725		-	CHILDREN BECOMING PA RTY TO OR EXPLOITED BY A CONTRACT THROUG H THE
726		-	ONLINE PRODUCT THAT WOULD RESULT IN :
727		-	WES MOORE, Governor Ch. 461
	691	+	(B) THE DATA PROTECTION I MPACT ASSESSMENT SHA LL: 32
728	692
729		-	– 17 –
730		-	1. REASONABLY FORESEEABL E AND MATERIAL
731		-	PHYSICAL OR FINANCIA L HARM TO THE CHILD CHILDREN;
	693	+	(1) IDENTIFY THE PURPOSE OF THE ONLINE PRODUC T; 33 16 HOUSE BILL 603
732	694
733		-	2. REASONABLY FORESEEABL E AND EXTREME
734		-	PSYCHOLOGICAL OR EMOTIONAL HARM TO THE CHILD CHILDREN;
735	695
736		-	3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD’S
737		-	CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY; OR
738	696
739		-	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN
740		-	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER
741		-	IDENTITY, SEX, OR SEXUAL ORIENTATIO N;
	697	+	(2) IDENTIFY HOW THE ONLI NE PRODUCT USES CHIL DREN’S DATA; 1
742	698
743		-	(IV) WHETHER TARGETED ADVE RTISING SYSTEMS USED BY THE
744		-	ONLINE PRODUCT WOULD RESULT IN:
	699	+	(3) DETERMINE WHETHER THE ONLINE PRODUCT IS DE SIGNED AND 2
	700	+	OFFERED IN A MANNER CONSISTEN T WITH THE BEST INTE RESTS OF CHILDREN 3
	701	+	REASONABLY LIKELY TO ACCESS THE ONLINE PR ODUCT THROUGH CONSID ERATION 4
	702	+	OF: 5
745	703
746		-	1. REASONABLY FORESEEABL E AND MATERIAL
747		-	PHYSICAL OR FINANCIA L HARM TO THE CHILD ;
	704	+	(I) WHETHER THE DATA MANA GEMENT OR PROCESSING 6
	705	+	PRACTICES OF THE ONL INE PRODUCT COULD LE AD TO CHILDREN EXPER IENCING OR 7
	706	+	BEING TARGETED BY CONTAC TS THAT WOULD RESULT IN: 8
748	707
749		-	2. REASONABLY FORESEEABL E AND ~~EXTREME~~
750		-	~~PSYCHOLOGICAL~~ OR ~~EMO TIONAL~~ HARM TO THE ~~C HILD~~;
	708	+	1. REASONABLY FORESEEABL E AND MATERIAL 9
	709	+	PHYSICAL OR FINANCIA L HARM TO THE CHILD CHILDREN; 10
751	710
752		-	3. ~~A HIGHLY OFFENSIVE INT RUSION ON THE CHILD ’S~~
753		-	~~REASONABLE EXPECTATI ON OF PRIVACY;~~ OR
	711	+	2. REASONABLY FORESEEABL E AND EXTREME 11
	712	+	PSYCHOLOGICAL OR EMO TIONAL HARM TO THE CHILD CHILDREN; 12
754	713
755		-	4. DISCRIMINATION AGAINS T THE CHILD BASED ON
756		-	RACE, COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, SEX, OR SEXUAL
757		-	ORIENTATION ;
	714	+	3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD’S 13
	715	+	CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY; OR 14
758	716
759		-	(V) WHETHER THE ONLINE PR ODUCT USES SYSTEM DE SIGN
760		-	FEATURES TO INCREASE , SUSTAIN, OR EXTEND THE USE OF THE ONLINE PRODUCT ,
761		-	INCLUDING THE AUTOMA TIC PLAYING OF MEDIA , REWARDS FOR TIME SPE NT, AND
762		-	NOTIFICATIONS THAT W OULD RESULT IN :
	717	+	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN 15
	718	+	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER 16
	719	+	IDENTITY, SEX, OR SEXUAL ORIENTATIO N; 17
763	720
764		-	1. REASONABLY FORESEEABL E AND MATERIAL
765		-	PHYSICAL OR FINANCIA L HARM TO THE CHILD CHILDREN;
	721	+	(II) WHETHER THE DATA MANA GEMENT OR PROCESSING 18
	722	+	PRACTICES OF THE ONL INE PRODUCT COULD PE RMIT CHILDREN TO WITNESS, 19
	723	+	PARTICIPATE IN, OR BE SUBJECT TO CON DUCT THAT WOULD RESU LT IN: 20
766	724
767		-	2. REASONABLY FORESEEABL E AND ~~EXTREME~~
768		-	~~PSYCHOLOGICAL~~ OR ~~EMO TIONAL~~ HARM TO THE CHILD CHILDREN;
	725	+	1. REASONABLY FORESEEABL E AND MATERIAL 21
	726	+	PHYSICAL OR FINANCIA L HARM TO THE CHILD CHILDREN; 22
769	727
770		-	3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD’S
771		-	CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY; OR
772		-	Ch. 461 2024 LAWS OF MARYLAND
	728	+	2. REASONABLY FORESEEABL E AND EXTREME 23
	729	+	PSYCHOLOGICAL OR EMO TIONAL HARM TO THE CHILD CHILDREN; 24
773	730
774		-	– 18 –
775		-	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN
776		-	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER
777		-	IDENTITY, SEX, OR SEXUAL ORIENTATIO N;
	731	+	3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD’S 25
	732	+	CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY; OR 26
778	733
779		-	~~(VI) (V) WHETHER,~~ ~~HOW, AND FOR WHAT PURPOSE~~ THE
780		-	~~ONLINE PRODUCT COLLECTS OR PR OCESSES SENSITIVE PERSONAL DATA OF~~
781		-	~~CHILDREN AND WHETHER THOSE PRACTICES WOUL D RESULT IN:~~
	734	+	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN 27
	735	+	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER 28
	736	+	IDENTITY, SEX, OR SEXUAL ORIENTATIO N; 29
782	737
783		-	~~1. REASONABLY FORESEEABL E AND MATERIAL~~
784		-	~~PHYSICAL OR FINANCIA L HARM~~ TO ~~THE CHILD CHILDREN;~~
	738	+	(III) WHETHER THE DATA MANA GEMENT OR PROCESSING 30
	739	+	PRACTICES OF THE ONL INE PRODUCT ARE REAS ONABLY EXPECTED TO A LLOW 31 HOUSE BILL 603 17
785	740
786		-	2. REASONABLY FORESEEABL E AND EXTREME
787		-	PSYCHOLO GICAL OR EMOTIONAL H ARM TO THE CHILD CHILDREN;
788	741
789		-	3. A ~~HIGHLY OFFENSIVE INT RUSION ON~~ THE ~~CHILD’S~~
790		-	~~CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY;~~ OR
	742	+	CHILDREN BECOMING PA RTY TO OR EXPLOITED BY A CONTRACT THROUG H THE 1
	743	+	ONLINE PRODUCT THAT WOULD RESULT IN : 2
791	744
792		-	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN
793		-	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER
794		-	IDENTITY, SEX, OR SEXUAL ORIENTATIO N;
	745	+	1. REASONABLY FORESEEABL E AND MATERIAL 3
	746	+	PHYSICAL OR FINANCIA L HARM TO THE CHILD CHILDREN; 4
795	747
796		-	(VII) (VI) WHETHER AND HOW DATA COLLECTED TO
797		-	UNDERSTAND THE EXPER IMENTAL IMPACT OF TH E PRODUCT REVEALS DA TA
798		-	MANAGEMENT OR DESIGN PRACTICES THAT WO ULD RESULT IN:
	748	+	2. REASONABLY FORESEEABL E AND EXTREME 5
	749	+	PSYCHOLOGICAL OR EMOTIONAL HARM TO THE CHILD CHILDREN; 6
799	750
800		-	1. ~~REASONABLY FORESEEABL E AND MATERIAL~~
801		-	~~PHYSICAL~~ OR ~~FINANCIA L HARM TO THE CHILD CHILDREN;~~
	751	+	3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD’S 7
	752	+	CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY; OR 8
802	753
803		-	2. REASONABLY FORESEEABL E AND EXTREME
804		-	PSYCHOLOGICAL OR EMO TIONAL HARM TO THE CHILD CHILDREN;
	754	+	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN 9
	755	+	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER 10
	756	+	IDENTITY, SEX, OR SEXUAL ORIENTATIO N; 11
805	757
806		-	~~3. A HIGHLY OFFENSIVE INT RUSION ON~~ THE ~~CHILD’S~~
807		-	~~CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY; OR~~
	758	+	(IV) WHETHER TARGETED ADVE RTISING SYSTEMS USED BY THE 12
	759	+	ONLINE PRODUCT WOULD RESULT IN: 13
808	760
809		-	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN
810		-	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER
811		-	IDENTITY, SEX, OR SEXUAL ORIENTATIO N;
	761	+	1. REASONABLY FORESEEABL E AND MATERIAL 14
	762	+	PHYSICAL OR FINANCIA L HARM TO THE CHILD ; 15
812	763
813		-	~~(VIII) (VII) WHETHER ALGORITHMS US ED BY THE ONLINE~~
814		-	~~PRODUCT WOULD RESULT IN:~~
	764	+	2. REASONABLY FORESEEABL E AND EXTREME 16
	765	+	PSYCHOLOGICAL OR EMO TIONAL HARM TO THE C HILD; 17
815	766
816		-	1. ~~REASONABLY FORESEEABL E AND MATERIAL~~
817		-	~~PHYSICAL~~ OR ~~FINANCIA L HARM TO THE CHILD CHILDREN; WES MOORE, Governor Ch. 461~~
	767	+	3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD ’S 18
	768	+	REASONABLE EXPECTATI ON OF PRIVACY; OR 19
818	769
819		-	– 19 –
	770	+	4. DISCRIMINATION AGAINS T THE CHILD BASED ON 20
	771	+	RACE, COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, SEX, OR SEXUAL 21
	772	+	ORIENTATION ; 22
820	773
821		-	2. REASONABLY FORESEEABL E AND EXTREME
822		-	PSYCHOLOGICAL OR EMO TIONAL HARM TO THE CHILD CHILDREN;
	774	+	(V) WHETHER THE ONLINE PR ODUCT USES SYSTEM DE SIGN 23
	775	+	FEATURES TO INCREASE , SUSTAIN, OR EXTEND THE USE OF THE ONLINE PRODUCT , 24
	776	+	INCLUDING THE AUTOMA TIC PLAYING OF MEDIA , REWARDS FOR TIME SPE NT, AND 25
	777	+	NOTIFICATIONS THAT W OULD RESULT IN : 26
823	778
824		-	3. ~~A HIGHLY OFFENSIVE INT RUSION ON THE CHILD’S~~
825		-	~~CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY;~~ OR
	779	+	1. REASONABLY FORESEEABL E AND MATERIAL 27
	780	+	PHYSICAL OR FINANCIA L HARM TO THE CHILD CHILDREN; 28
826	781
827		-	4. ~~DISCRIMINATION AGAINS T THE CHILD CHILDREN~~
828		-	~~BASED ON RACE , COLOR,~~ ~~RELIGION, NATIONAL ORIGIN , DISABILITY,~~ ~~GENDER~~
829		-	~~IDENTITY, SEX,~~ ~~OR SEXUAL ORIENTATION;~~ ~~AND~~
	782	+	2. REASONABLY FORESEEABL E AND EXTREME 29
	783	+	PSYCHOLOGICAL OR EMO TIONAL HARM TO THE CHILD CHILDREN; 30
	784	+	18 HOUSE BILL 603
830	785
831		-	(IX) (VIII) ANY OTHER FACTOR THAT MAY INDICATE THAT TH E
832		-	ONLINE PRODUCT IS DE SIGNED AND OFFERED IN A MANNER THAT IS INCONSISTENT
833		-	WITH THE BEST INTERE STS OF CHILDREN ; AND
834	786
835		-	(4) INCLUDE A DESCRIPTION OF STEPS THAT THE CO VERED ENTITY
836		-	HAS TAKEN AND WILL TAKE TO COMPLY WITH THE D UTY TO ACT IN A MANN ER
837		-	CONSISTENT WITH THE BEST INTERESTS OF CH ILDREN.
	787	+	3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD’S 1
	788	+	CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY; OR 2
838	789
839		-	(C) (1) A DATA PROTECTION IMPA CT ASSESSMENT PREPAR ED BY A
840		-	COVERED ENTITY FOR T HE PURPOSE OF COMPLI ANCE WITH ANY OTHER LAW
841		-	COMPLIES WITH THIS SECTION IF THE ASSES SMENT MEETS THE REQU IREMENTS OF
842		-	THIS SECTION.
	790	+	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN 3
	791	+	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER 4
	792	+	IDENTITY, SEX, OR SEXUAL ORIENTATIO N; 5
843	793
844		-	(2) ~~A SINGLE DATA PROTECTI ON IMPACT ASSESSMENT MAY CONTAIN~~
845		-	~~MULTIPLE SIMILAR PRO CESSING OPERATIONS T HAT PRESENT SIMILAR RISKS ONLY~~
846		-	~~IF EACH RELEVANT ONL INE PRODUCT IS ADDRE SSED.~~
	794	+	(VI) (V) WHETHER, HOW, AND FOR WHAT PURPOSE THE 6
	795	+	ONLINE PRODUCT COLLECTS OR PR OCESSES SENSITIVE PERSONAL DATA OF 7
	796	+	CHILDREN AND WHETHER THOSE PRACTICES WOUL D RESULT IN: 8
847	797
848		-	14–4605.
	798	+	1. REASONABLY FORESEEABL E AND MATERIAL 9
	799	+	PHYSICAL OR FINANCIA L HARM TO THE CHILD CHILDREN; 10
849	800
850		-	~~A COVERED ENTITY REQUI RED TO COMPLETE A DA TA PROTECTION IMPACT~~
851		-	~~ASSESSMENT UNDER § 14–4604 OF THIS SUBTITLE SHA LL:~~
	801	+	2. REASONABLY FORESEEABL E AND EXTREME 11
	802	+	PSYCHOLO GICAL OR EMOTIONAL H ARM TO THE CHILD CHILDREN; 12
852	803
853		-	~~(1) MAINTAIN DOCUMENTATIO N OF~~ THE ~~ASSESSMENT FOR AS LONG~~
854		-	~~AS THE ONLINE PRODUC T IS LIKELY TO BE AC CESSED BY CHILDREN~~ ;
	804	+	3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD’S 13
	805	+	CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY; OR 14
855	806
856		-	~~(2) REVIEW EACH DA TA PROTECTION IMPACT ASSESSMENT AS~~
857		-	~~NECESSARY TO ACCOUNT FOR MATERIAL CHANGES TO PROCESSING PERTAI NING TO~~
858		-	~~THE ONLINE PRODUCT W ITHIN 90 DAYS OF SUCH MATERIA L CHANGES~~;
	807	+	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN 15
	808	+	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER 16
	809	+	IDENTITY, SEX, OR SEXUAL ORIENTATIO N; 17
859	810
860		-	(3) ~~CONFIGURE NOTWITHSTANDING ANY O THER LAW,~~ ~~CONFIGURE~~
861		-	~~ALL DEFAULT PRIVACY SETTINGS PROV IDED TO CHILDREN BY~~ THE ~~ONLINE~~
862		-	~~PRODUCT TO OFFER A H IGH LEVEL OF PRIVACY , UNLESS THE COVERED E NTITY CAN Ch.~~ ~~461 2024 LAWS OF MARYLAND~~
	811	+	(VII) (VI) WHETHER AND HOW DATA COLLECTED TO 18
	812	+	UNDERSTAND THE EXPER IMENTAL IMPACT OF TH E PRODUCT REVEALS DA TA 19
	813	+	MANAGEMENT OR DESIGN PRACTICES THAT WO ULD RESULT IN: 20
863	814
864		-	– 20 –
865		-	DEMONSTRATE A COMPEL LING REASON THAT A D IFFERENT SETTING IS IN THE BEST
866		-	INTERESTS OF CHILDRE N;
	815	+	1. REASONABLY FORESEEABL E AND MATERIAL 21
	816	+	PHYSICAL OR FINANCIA L HARM TO THE CHILD CHILDREN; 22
867	817
868		-	(4) PROVIDE ANY PRIVACY I NFORMATION , TERMS OF SERVICE ,
869		-	POLICIES, AND COMMUNITY STANDA RDS CONCISELY , PROMINENTLY , AND USING
870		-	CLEAR LANGUAGE SUITE D TO THE AGE OF CHIL DREN LIKELY TO ACCES S THE
871		-	ONLINE PRODUCT ; AND
	818	+	2. REASONABLY FORESEEABL E AND EXTREME 23
	819	+	PSYCHOLOGICAL OR EMO TIONAL HARM TO THE CHILD CHILDREN; 24
872	820
873		-	(5) PROVIDE PROMINENT , ACCESSIBLE, AND RESPONSIVE TOOLS TO
874		-	HELP CHILDREN OR THE IR PARENTS OR GUARDIANS, IF APPLICABLE, EXERCISE
875		-	THEIR PRIVACY RIGHTS AND REPORT CONCERNS .
	821	+	3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD’S 25
	822	+	CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY; OR 26
876	823
877		-	14–4606.
	824	+	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN 27
	825	+	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER 28
	826	+	IDENTITY, SEX, OR SEXUAL ORIENTATIO N; 29
878	827
879		-	(A) A COVERED ENTITY THAT PROVIDES AN ONLINE P RODUCT THAT IS
880		-	ACCESSED OR REASONAB LY LIKELY TO BE ACCE SSED BY CHILDREN MAY NOT:
	828	+	(VIII) (VII) WHETHER ALGORITHMS US ED BY THE ONLINE 30
	829	+	PRODUCT WOULD RESULT IN: 31
	830	+	HOUSE BILL 603 19
881	831
882		-	(1) PROCESS THE PERSONAL DATA OF A CH ILD IN A WAY THAT IS
883		-	INCONSISTENT WITH TH E BEST INTERESTS OF CHILDREN REASONABLY LIKELY TO
884		-	ACCESS THE ONLINE PR ODUCT;
885	832
886		-	(2) PROFILE A CHILD BY DE FAULT, UNLESS:
	833	+	1. REASONABLY FORESEEABL E AND MATERIAL 1
	834	+	PHYSICAL OR FINANCIA L HARM TO THE CHILD CHILDREN; 2
887	835
888		-	(I) THE COVERED ENTITY CA N DEMONSTRATE THAT T HE
889		-	COVERED ENTITY HAS A PPROPRIATE SAFEGUARD S IN PLACE TO ENSURE T HAT
890		-	PROFILING IS CONSIST ENT WITH THE BEST IN TERESTS OF CHILDREN WHO ACCESS
891		-	OR ARE REASONABLY LI KELY TO ACCESS THE O NLINE PRODUCT ; AND
	836	+	2. REASONABLY FORESEEABL E AND EXTREME 3
	837	+	PSYCHOLOGICAL OR EMO TIONAL HARM TO THE CHILD CHILDREN; 4
892	838
893		-	(II) 1. PROFILING IS NECESSAR Y TO PROVIDE THE
894		-	REQUESTED ONLINE PRODUCT , AND IS DONE ONLY WIT H RESPECT TO THE ASPECTS
895		-	OF THE ONLINE PRODUC T THAT THE CHILD IS ACTIVELY AND KNOWING LY ENGAGED
896		-	WITH; OR
	839	+	3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD’S 5
	840	+	CHILDREN’S REASONABLE EXPECTATI ON OF PRIVACY; OR 6
897	841
898		-	2. THE COVERED ENTITY CA N DEMONSTRATE A
899		-	COMPELLING REASON TH AT PROFILING IS IN T HE BEST INTERESTS OF CHILDREN;
	842	+	4. DISCRIMINATION AGAINS T THE CHILD CHILDREN 7
	843	+	BASED ON RACE , COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, GENDER 8
	844	+	IDENTITY, SEX, OR SEXUAL ORIENTATION; AND 9
900	845
901		-	(3) ~~PROCESS PERSONAL DATA OF A CHILD~~ THAT ~~IS NOT REASONABL Y~~
902		-	~~NECESSARY TO PROVIDE AN~~ ONLINE PRODUCT ~~TH AT THE CHILD~~ IS ~~ACTI VELY AND~~
903		-	~~KNOWINGLY ENGAGED WI TH~~;
	846	+	(IX) (VIII) ANY OTHER FACTOR THAT MAY INDICATE THAT TH E 10
	847	+	ONLINE PRODUCT IS DE SIGNED AND OFFERED IN A MANNER THAT IS INCONSISTENT 11
	848	+	WITH THE BEST INTERE STS OF CHILDREN ; AND 12
904	849
905		-	(4) ~~PROCESS~~ THE ~~PERSONAL DATA OF A CHILD END USER FOR ANY~~
906		-	~~REASON OTHER THAN~~ A ~~REASON FOR WHICH THA T PERSONAL DATA WAS~~
907		-	~~COLLECTED;~~ ~~WES MOORE, Governor~~ Ch. ~~461~~
	850	+	(4) INCLUDE A DESCRIPTION OF STEPS THAT THE CO VERED ENTITY 13
	851	+	HAS TAKEN AND WILL TAKE TO COMPLY WITH THE D UTY TO ACT IN A MANN ER 14
	852	+	CONSISTENT WITH THE BEST INTERESTS OF CH ILDREN. 15
908	853
909		-	– 21 –
	854	+	(C) (1) A DATA PROTECTION IMPA CT ASSESSMENT PREPAR ED BY A 16
	855	+	COVERED ENTITY FOR T HE PURPOSE OF COMPLI ANCE WITH ANY OTHER LAW 17
	856	+	COMPLIES WITH THIS SECTION IF THE ASSES SMENT MEETS THE REQU IREMENTS OF 18
	857	+	THIS SECTION. 19
910	858
911		-	(5) PROCESS ANY PRECISE G EOLOCATION INFORMATION DATA OF A
912		-	CHILD BY DEFAULT , UNLESS:
	859	+	(2) A SINGLE DATA PROTECTI ON IMPACT ASSESSMENT MAY CONTAIN 20
	860	+	MULTIPLE SIMILAR PRO CESSING OPERATIONS T HAT PRESENT SIMILAR RISKS ONLY 21
	861	+	IF EACH RELEVANT ONL INE PRODUCT IS ADDRE SSED. 22
913	862
914		-	(I) THE COLLECTION OF THE PRECISE GEOLOCATION
915		-	INFORMATION DATA IS STRICTLY NECESSAR Y FOR THE COVERED EN TITY TO
916		-	PROVIDE THE ONLINE P RODUCT; AND
	863	+	14–4605. 23
917	864
918		-	~~(II) THE PRECISE GEOLOCATI ON DATA IS PROCESSED ONLY FOR~~
919		-	~~THE LIMITED TIME THA T IS NECESSARY TO PR OVIDE THE ONLINE PRO DUCT;~~
	865	+	A COVERED ENTITY REQUI RED TO COMPLETE A DA TA PROTECTION IMPACT 24
	866	+	ASSESSMENT UNDER § 14–4604 OF THIS SUBTITLE SHA LL: 25
920	867
921		-	(6) PROCESS ANY PRECISE G EOLOCATION INFORMATION DATA OF A
922		-	CHILD WITHOUT PROVID ING AN OBVIOUS SIGNA L TO THE CHILD FOR T HE DURATION
923		-	THAT THE PRECISE GEO LOCATION INFORMATION DATA IS BEING COLLECTED ;
	868	+	(1) MAINTAIN DOCUMENTATIO N OF THE ASSESSMENT FOR AS LONG 26
	869	+	AS THE ONLINE PRODUC T IS LIKELY TO BE AC CESSED BY CHILDREN ; 27
924	870
925		-	(7) USE DARK PATTERNS TO :
	871	+	(2) REVIEW EACH DA TA PROTECTION IMPACT ASSESSMENT AS 28
	872	+	NECESSARY TO ACCOUNT FOR MATERIAL CHANGES TO PROCESSING PERTAI NING TO 29
	873	+	THE ONLINE PRODUCT W ITHIN 90 DAYS OF SUCH MATERIA L CHANGES; 30
926	874
927		-	(I) ~~CAUSE A CHILD TO PROV IDE PERSONAL DATA BE YOND~~
928		-	~~WHAT IS REASONABLY E XPECTED~~ TO ~~PROVIDE~~ THE ONLINE ~~P RODUCT;~~
	875	+	(3) CONFIGURE NOTWITHSTANDING ANY O THER LAW, CONFIGURE 31
	876	+	ALL DEFAULT PRIVACY SETTINGS PROV IDED TO CHILDREN BY THE ONLINE 32 20 HOUSE BILL 603
929	877
930		-	(II) CIRCUMVENT PRIVACY PR OTECTIONS; OR
931	878
932		-	~~(III) TAKE ANY ACTION THAT~~ THE COVERED ~~ENTITY K NOWS,~~ OR
933		-	~~HAS~~ REASON ~~TO KNOW ,~~ IS ~~NOT~~ IN THE BEST ~~I NTERESTS OF CHILDREN WHO ACCESS~~
934		-	~~OR ARE REASONABLY LI KELY TO ACCESS THE O NLINE PRODU CT~~;
	879	+	PRODUCT TO OFFER A H IGH LEVEL OF PRIVACY , UNLESS THE COVERED E NTITY CAN 1
	880	+	DEMONSTRATE A COMPEL LING REASON THAT A D IFFERENT SETTING IS IN THE BEST 2
	881	+	INTERESTS OF CHILDRE N; 3
935	882
936		-	(8) ~~PROCESS~~ ANY ~~PERSONAL DATA FOR THE PURPOSE~~ OF
937		-	~~ESTIMATING THE AGE O F A CHILD THAT IS AC TIVELY~~ AND ~~KNOWINGLY ENGAGED~~
938		-	~~WITH AN ONLINE PRODU CT THAT IS NOT REASO NABLY NECESSARY~~ TO ~~P ROVIDE~~ THE
939		-	ONLINE PRODUCT ; OR
	883	+	(4) PROVIDE ANY PRIVACY I NFORMATION , TERMS OF SERVICE , 4
	884	+	POLICIES, AND COMMUNITY STANDA RDS CONCISELY , PROMINENTLY , AND USING 5
	885	+	CLEAR LANGUAGE SUITE D TO THE AGE OF CHIL DREN LIKELY TO ACCES S THE 6
	886	+	ONLINE PRODUCT ; AND 7
940	887
941		-	(9) ALLOW A CHILD’S PARENT, GUARDIAN, OR ANY OTHER CONSUME R
942		-	TO MONITOR THE CHILD ’S ONLINE ACTIVITY OR TRACK THE CHILD ’S LOCATION,
943		-	WITHOUT PROVIDING AN OBVIOUS SIGNAL TO TH E CHILD WHEN THE CHI LD IS BEING
944		-	MONITORED OR TRACKED ALLOW A PERSON OTHER THAN A CHILD ’S PARENT OR
945		-	GUARDIAN TO MONITOR THE CHILD’S ONLINE ACTIVITY WI THOUT FIRST NOTIFYIN G
946		-	THE CHILD AND THE CH ILD’S PARENT OR GUARDIAN .
	888	+	(5) PROVIDE PROMINENT , ACCESSIBLE, AND RESPONSIVE TOOLS TO 8
	889	+	HELP CHILDREN OR THE IR PARENTS OR GUARDI ANS, IF APPLICABLE, EXERCISE 9
	890	+	THEIR PRIVACY RIGHTS AND REPORT CONCERNS . 10
947	891
948		-	(B) A COVERED ENTITY THAT PROVIDES AN ONLINE P RODUCT THAT IS
949		-	ACCESSED OR REASONAB LY LIKELY TO BE ACCE SSED BY CHILDREN MAY ALLOW A
950		-	CHILD’S PARENT OR GUARDIAN TO MONITOR THE CHILD ’S ONLINE ACTIVITY OR
951		-	TRACK THE CHILD ’S LOCATION, WITHOUT PROVIDING AN OBVIOUS SIGNAL TO TH E
952		-	CHILD WHEN THE CHILD IS BEING MONITORED O R TRACKED.
953		-	Ch. 461 2024 LAWS OF MARYLAND
	892	+	14–4606. 11
954	893
955		-	– 22 –
956		-	(C) IN MAKING A DETERMINA TION AS TO WHETHER A N ONLINE PRODUCT IS
957		-	REASONABLY LIKELY TO BE ACCESSED BY CHILDREN , A COVERED ENTITY MAY NOT
958		-	COLLECT OR PROCESS A NY PERSONAL DATA BEY OND WHAT IS REASONAB LY
959		-	NECESSARY TO MAKE TH E DETERMINATION .
	894	+	(A) A COVERED ENTITY THAT PROVIDES AN ONLINE P RODUCT THAT IS 12
	895	+	ACCESSED OR REASONAB LY LIKELY TO BE ACCE SSED BY CHILDREN MAY NOT: 13
960	896
961		-	14–4607.
	897	+	(1) PROCESS THE PERSONAL DATA OF A CHILD IN A WAY THAT IS 14
	898	+	INCONSISTENT WITH TH E BEST INTERESTS OF CHILDREN REASONABLY LIKELY TO 15
	899	+	ACCESS THE ONLINE PR ODUCT; 16
962	900
963		-	(A) WITHIN 5 BUSINESS DAYS AFTER RECEIVING A WRITTEN REQUEST FROM
964		-	THE DIVISION, A COVERED ENTITY THA T PROVIDES AN ONLINE PRODUCT
965		-	REASONABLY LIKELY TO BE ACCESSED BY CHILD REN SHALL PROVIDE TO THE
966		-	DIVISION A LIST OF AL L DATA PROTECTION IM PACT ASSESSMENTS THE COVERED
967		-	ENTITY HAS COMPLETED UNDER § 14–4604 OF THIS SUBTITLE.
	901	+	(2) PROFILE A CHILD BY DE FAULT, UNLESS: 17
968	902
969		-	(B) ~~(1) WITHIN 7 BUSINESS DAYS AFT ER RECEIVING A WRITT EN REQUEST~~
970		-	~~FROM THE DIVISION, A~~ COVERED ENTITY ~~SHA LL PROVIDE~~ TO ~~THE DIVISION ANY~~
971		-	~~DATA PROTECTION IMPA CT ASSESSMENT COMPLE TED UNDER § 14–4604~~ OF ~~THIS~~
972		-	~~SUBTITLE.~~
	903	+	(I) THE COVERED ENTITY CA N DEMONSTRATE THAT T HE 18
	904	+	COVERED ENTITY HAS A PPROPRIATE SAFEGUARD S IN PLACE TO ENSURE THAT 19
	905	+	PROFILING IS CONSIST ENT WITH THE BEST IN TERESTS OF CHILDREN WHO ACCESS 20
	906	+	OR ARE REASONABLY LI KELY TO ACCESS THE O NLINE PRODUCT ; AND 21
973	907
974		-	(2) THE DIVISION MAY EXTEND B EYOND 7 DAYS THE AMOUNT OF
975		-	TIME ALLOWED FOR A COVERED ENTITY TO PR ODUCE A DATA PROTECT ION IMPACT
976		-	ASSESSMENT .
	908	+	(II) 1. PROFILING IS NECESSAR Y TO PROVIDE THE 22
	909	+	REQUESTED ONLINE PRODUCT , AND IS DONE ONLY WIT H RESPECT TO THE ASPECTS 23
	910	+	OF THE ONLINE PRODUC T THAT THE CHILD IS ACTIVELY AND KNOWING LY ENGAGED 24
	911	+	WITH; OR 25
977	912
978		-	(C) TO THE EXTENT THAT AN Y DISCLOSURE REQUIRE D UNDER SUBSECTION
979		-	(B) OF THIS SECTION INCL UDES INFORMATION SUB JECT TO ATTORNEY –CLIENT
980		-	PRIVILEGE OR WORK –PRODUCT PROTECTION , THE DISCLOSURE MAY N OT
981		-	CONSTITUTE A WAIVER OF THAT PRIVILEGE OR PROTECTION.
	913	+	2. THE COVERED ENTITY CA N DEMONSTRATE A 26
	914	+	COMPELLING REASON TH AT PROFILING IS IN T HE BEST INTERESTS OF CHILDREN; 27
982	915
983		-	14–4608.
	916	+	(3) PROCESS PERSONAL DATA OF A CHILD THAT IS NOT REASONABLY 28
	917	+	NECESSARY TO PROVIDE AN ONLINE PRODUCT TH AT THE CHILD IS ACTI VELY AND 29
	918	+	KNOWINGLY ENGAGED WI TH; 30
984	919
985		-	(A) A VIOLATION OF THIS SU BTITLE:
	920	+	(4) PROCESS THE PERSONAL DATA OF A CHILD END USER FOR ANY 31
	921	+	REASON OTHER THAN A REASON FOR WHICH THA T PERSONAL DATA WAS 32
	922	+	COLLECTED; 33 HOUSE BILL 603 21
986	923
987		-	(1) IS AN UNFAIR, ABUSIVE, OR DECEPTIVE TRADE P RACTICE; AND
988	924
989		-	(2) EXCEPT FOR § 13–410 OF THIS ARTICLE , IS SUBJECT TO THE
990		-	ENFORCEMENT PROVISIO NS CONTAINED IN TITLE 13 OF THIS ARTICLE.
991	925
992		-	(B) A ~~COVERED ENTITY THAT VIOLATES THIS SUBTIT LE IS SUBJECT TO A~~
993		-	~~CIVIL PENALTY NOT EX CEEDING~~:
	926	+	(5) PROCESS ANY PRECISE GEOL OCATION INFORMATION DATA OF A 1
	927	+	CHILD BY DEFAULT , UNLESS: 2
994	928
995		-	(1) ~~$2,500 PER AFFECTED CHILD F OR EACH NEGLIGENT VI OLATION;~~
996		-	~~AND~~
997		-	~~WES MOORE,~~ ~~Governor Ch. 461~~
	929	+	(I) THE COLLECTION OF THE PRECISE GEOLOCATION 3
	930	+	INFORMATION DATA IS STRICTLY NECESSAR Y FOR THE COVERED EN TITY TO 4
	931	+	PROVIDE THE ONLINE P RODUCT; AND 5
998	932
999		-	– 23 –
1000		-	(2) $7,500 PER AFFECTED CHILD F OR EACH INTENTIONAL
1001		-	VIOLATION.
	933	+	(II) THE PRECISE GEOLOCATI ON DATA IS PROCESSED ON LY FOR 6
	934	+	THE LIMITED TIME THA T IS NECESSARY TO PR OVIDE THE ONLINE PRO DUCT; 7
1002	935
1003		-	(C) THE DIVISION SHALL PAY AL L FINES, PENALTIES, AND EXPENSES
1004		-	COLLECTED BY THE DIVISION UNDER THIS S UBSECTION INTO THE GENERAL FUND
1005		-	WITH THE INTENT THAT FINES, PENALTIES, AND EXPENSES BE USED TO FULLY
1006		-	OFFSET ANY COSTS INC URRED BY THE DIVISION IN CONNECTION WITH T HIS
1007		-	SUBTITLE.
	936	+	(6) PROCESS ANY PRECISE G EOLOCATION INFORMATION DATA OF A 8
	937	+	CHILD WITHOUT PROVID ING AN OBVIOUS SIGNA L TO THE CHILD FOR T HE DURATION 9
	938	+	THAT THE PRECISE GEO LOCATION INFORMATION DATA IS BEING COLLECTED ; 10
1008	939
1009		-	~~14–4609.~~
	940	+	(7) USE DARK PATTERNS TO : 11
1010	941
1011		-	(A) IF A COVERED ENTITY I S IN SUBSTANTIAL COM PLIANCE WITH THE
1012		-	REQUIREMENTS OF §§ 14–4604 THROUGH 14–4606 OF THIS SUBTITLE , THE
1013		-	DIVISION SHALL PROVID E WRITTEN NOTICE TO THE COVERED ENTITY B EFORE
1014		-	FILING AN ACTION UNDER § 14–4608 OF THIS SUBTITLE .
	942	+	(I) CAUSE A CHILD TO PROV IDE PERSONAL DATA BE YOND 12
	943	+	WHAT IS REASONABLY E XPECTED TO PROVIDE T HE ONLINE PRODUCT ; 13
1015	944
1016		-	(B) NOTICE GIVEN UNDER SU BSECTION (A) OF THIS SECTION SHAL L
1017		-	IDENTIFY THE SPECIFI C PROVISIONS OF THIS SUBTITLE THAT THE DIVISION
1018		-	ALLEGES HAVE BEEN OR ARE BEING VIOLATED .
	945	+	(II) CIRCUMVENT PRIVACY PR OTECTIONS; OR 14
1019	946
1020		-	(C) A COVERED ENTITY ~~MAY N OT BE LIABLE FOR A C IVIL PENALTY FOR A~~
1021		-	~~VIOLATION FOR WHICH NOTICE~~ IS ~~GIVEN UNDE R SUBSECTION (A)~~ OF ~~THIS SECTION~~
1022		-	IF THE ~~COVERED ENTIT Y:~~
	947	+	(III) TAKE ANY ACTION THAT THE COVERED ENTITY KNO WS, OR 15
	948	+	HAS REASON TO KNOW , IS NOT IN THE BEST I NTERESTS OF CHILDREN WHO ACCESS 16
	949	+	OR ARE REASONABLY LI KELY TO ACCESS THE O NLINE PRODUCT ; 17
1023	950
1024		-	(1) HAS COMPLETED A DATA PROTECTION IMPACT AS SESSMENT
1025		-	UNDER § 14–4604(A)(2) OF THIS SUBTITLE FOR EXISTING ONLINE PROD UCTS THAT
1026		-	ARE REASONABL Y LIKELY TO BE ACCES SED BY CHILDREN ;
	951	+	(8) PROCESS ANY PERSONAL DATA FOR THE PURPOSE OF 18
	952	+	ESTIMATING THE AGE O F A CHILD THAT IS AC TIVELY AND KNOWINGLY ENGAGED 19
	953	+	WITH AN ONLINE PRODU CT THAT IS NOT REASO NABLY NECESSARY TO P ROVIDE THE 20
	954	+	ONLINE PRODUCT ; OR 21
1027	955
1028		-	(2) HAS COMPLETED A DATA PROTECTION IMPACT AS SESSMENT
1029		-	UNDER § 14–4604(A)(3) OF THIS SUBTITLE PRI OR TO OFFERING TO TH E PUBLIC A
1030		-	NEW ONLINE PRODUCT T HAT IS REASONABLY LI KELY TO BE ACCESSED BY
1031		-	CHILDREN;
	956	+	(9) ALLOW A CHILD’S PARENT, GUARDIAN, OR ANY OTHER CONSUME R 22
	957	+	TO MONITOR THE CHILD ’S ONLINE ACTIVITY OR TRACK THE CHILD ’S LOCATION, 23
	958	+	WITHOUT PROVID ING AN OBVIOUS SIGNA L TO THE CHILD WHEN THE CHILD IS BEING 24
	959	+	MONITORED OR TRACKED ALLOW A PERSON OTHER THAN A CHILD ’S PARENT OR 25
	960	+	GUARDIAN TO MONITOR THE CHILD’S ONLINE ACTIVITY WI THOUT FIRST NOTIFYIN G 26
	961	+	THE CHILD AND THE CH ILD’S PARENT OR GUARDIAN . 27
1032	962
1033		-	(3) CURES THE VIOLATION SPECIFIED IN THE DIVISION’S NOTICE
1034		-	WITHIN 90 DAYS AFTER ISSUANCE OF THE NOTICE UNDER SUBSECTION (A) OF THIS
1035		-	SECTION;
	963	+	(B) A COVERED ENTITY THAT PROVIDES AN ONLINE P RODUCT THAT IS 28
	964	+	ACCESSED OR REASONAB LY LIKELY TO BE ACCE SSED BY CHILDREN MAY ALLOW A 29
	965	+	CHILD’S PARENT OR GUARDIAN TO MONITOR THE CHILD ’S ONLINE ACTIVITY OR 30
	966	+	TRACK THE CHILD ’S LOCATION, WITHOUT PROVIDING AN OBVIOUS SIGNAL TO THE 31
	967	+	CHILD WHEN THE CHILD IS BEING MONITORED O R TRACKED. 32
	968	+	22 HOUSE BILL 603
1036	969
1037		-	(4) PROVIDES THE DIVISION WITH A WRITT EN STATEMENT THAT TH E
1038		-	ALLEGED VIOLATION HA S BEEN CURED; AND
1039	970
1040		-	(5) TAKES MEASURES TO PR EVENT ANY FUTURE VIO LATION THAT
1041		-	THE DIVISION AGREED TO BE SUFFICIENT.
	971	+	(C) IN MAKING A DETERMINA TION AS TO WHETHER A N ONLINE PRODUCT IS 1
	972	+	REASONABLY LIKELY TO BE ACCESSED BY CHILD REN, A COVERED ENTITY MAY NOT 2
	973	+	COLLECT OR PROCESS A NY PERSONAL DATA BEY OND WHAT IS REASON ABLY 3
	974	+	NECESSARY TO MAKE TH E DETERMINATION . 4
1042	975
1043		-	14–~~4610~~. ~~Ch. 461 2024 LAWS OF MARYLAND~~
	976	+	14–4607. 5
1044	977
1045		-	– 24 –
	978	+	(A) WITHIN 5 BUSINESS DAYS AFTER RECEIVING A WRITTEN REQUEST FROM 6
	979	+	THE DIVISION, A COVERED ENTITY THA T PROVIDES AN ONLINE PRODUCT 7
	980	+	REASONABLY LIKELY TO BE ACCESSED BY CHILD REN SHALL PROVIDE TO THE 8
	981	+	DIVISION A LIST OF ALL DATA PROTECTION IMPACT AS SESSMENTS THE COVERE D 9
	982	+	ENTITY HAS COMPLETED UNDER § 14–4604 OF THIS SUBTITLE. 10
1046	983
1047		-	NOTHING IN THIS SUBTI TLE MAY BE INTERPRET ED OR CONSTRUED TO :
	984	+	(B) (1) WITHIN 7 BUSINESS DAYS AFTER RECEIVING A WRITTEN REQUEST 11
	985	+	FROM THE DIVISION, A COVERED ENTITY SHA LL PROVIDE TO THE DIVISION ANY 12
	986	+	DATA PROTECTION IMPAC T ASSESSMENT COMPLET ED UNDER § 14–4604 OF THIS 13
	987	+	SUBTITLE. 14
1048	988
1049		-	(1) PROVIDE A PRIVATE RIG HT OF ACTION UNDER T HIS SUBTITLE OR
1050		-	ANY OTHER LAW ;
	989	+	(2) THE DIVISION MAY EXTEND B EYOND 7 DAYS THE AMOUNT OF 15
	990	+	TIME ALLOWED FOR A C OVERED ENTITY TO PRO DUCE A DATA PROTECTI ON IMPACT 16
	991	+	ASSESSMENT . 17
1051	992
1052		-	(2) IMPOSE LIABILITY IN A MANNER THAT IS INCON SISTENT WITH 47
1053		-	U.S.C. § 230;
	993	+	(C) TO THE EXTENT THAT AN Y DISCLOSUR E REQUIRED UNDER SUB SECTION 18
	994	+	(B) OF THIS SECTION INCL UDES INFORMATION SUB JECT TO ATTORNEY –CLIENT 19
	995	+	PRIVILEGE OR WORK –PRODUCT PROTECTION , THE DISCLOSURE MAY N OT 20
	996	+	CONSTITUTE A WAIVER OF THAT PRIVILEGE OR PROTECTION. 21
1054	997
1055		-	(3) PREVENT OR PRECLUDE A CHILD FROM DELIBERAT ELY OR
1056		-	INDEPENDENTLY SEARCH ING FOR OR SPECIFICA LLY REQUESTING CONTE NT; OR
	998	+	14–4608. 22
1057	999
1058		-	(4) REQUIRE A COVERED ENT ITY TO IMPLEMENT AN AGE–GATING
1059		-	REQUIREMENT .
	1000	+	(A) A VIOLATION OF THIS SU BTITLE: 23
1060	1001
1061		-	~~14–4611.~~
	1002	+	(1) IS AN UNFAIR, ABUSIVE, OR DECEPTIVE TRADE P RACTICE; AND 24
1062	1003
1063		-	NOTWITHSTANDING ANY O THER LAW , A DATA PROTECTION IM PACT
1064		-	ASSESSMENT IS PROTEC TED AS CONFIDENTIAL AND SHALL BE EXEMPT FROM
1065		-	PUBLIC DISCLOSURE , INCLUDING UNDER THE MARYLAND PUBLIC INFORMATION
1066		-	ACT.
	1004	+	(2) EXCEPT FOR § 13–410 OF THIS ARTICLE , IS SUBJECT TO THE 25
	1005	+	ENFORCEMENT PROVISIO NS CONTAINED IN TITLE 13 OF THIS ARTICLE. 26
1067	1006
1068		-	14–4612.
	1007	+	(B) A COVERED ENTITY THAT VIOLATES THIS SUBTIT LE IS SUBJECT TO A 27
	1008	+	CIVIL PENALTY NOT EXCE EDING: 28
1069	1009
1070		-	(A) WHEREVER POSSIBLE , LAW RELATING TO CONS UMERS’ PERSONAL
1071		-	DATA SHOULD BE CONST RUED TO HARMONIZE WI TH THE PROVISIONS OF THIS
1072		-	SUBTITLE.
	1010	+	(1) $2,500 PER AFFECTED CHILD F OR EACH NEGLIGENT VI OLATION; 29
	1011	+	AND 30
1073	1012
1074		-	(B) IN THE EVENT OF A CON FLICT BETWEEN OTHER LAWS AND THIS
1075		-	SUBTITLE, THE PROVISIONS OF TH E LAW THAT AFFORD TH E GREATEST PROTECTIO N
1076		-	FOR THE RIGHT OF PRI VACY FOR CONSUMERS SHALL CONTROL .
	1013	+	(2) $7,500 PER AFFECTED CHILD F OR EACH INTENTIONAL 31
	1014	+	VIOLATION. 32 HOUSE BILL 603 23
1077	1015
1078		-	14–4613.
1079	1016
1080		-	THIS SUBTITLE MAY BE CITED AS THE MARYLAND AGE–APPROPRIATE
1081		-	DESIGN CODE ACT.
1082	1017
1083		-	SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect
1084		-	October 1, 2024.
	1018	+	(C) THE DIVISION SHALL PAY AL L FINES, PENALTIES, AND EXPENSES 1
	1019	+	COLLECTED BY THE DIVISION UNDER THIS SUBSECTION INTO THE GENERAL FUND 2
	1020	+	WITH THE INTENT THAT FINES, PENALTIES, AND EXPENSES BE USED TO FULLY 3
	1021	+	OFFSET ANY COSTS INC URRED BY THE DIVISION IN CONNECTIO N WITH THIS 4
	1022	+	SUBTITLE. 5
1085	1023
1086		-	Approved by the Governor, May 9, 2024.
	1024	+	14–4609. 6
	1025	+
	1026	+	(A) IF A COVERED ENTITY I S IN SUBSTANTIAL COM PLIANCE WITH THE 7
	1027	+	REQUIREMENTS OF §§ 14–4604 THROUGH 14–4606 OF THIS SUBTITLE , THE 8
	1028	+	DIVISION SHALL PROVID E WRITTEN NOTICE TO THE COVERED ENTITY B EFORE 9
	1029	+	FILING AN ACTION UND ER § 14–4608 OF THIS SUBTITLE . 10
	1030	+
	1031	+	(B) NOTICE GIVEN UNDER SU BSECTION (A) OF THIS SECTION SHAL L 11
	1032	+	IDENTIFY THE SPECIFIC PROVISIO NS OF THIS SUBTITLE THAT THE DIVISION 12
	1033	+	ALLEGES HAVE BEEN OR ARE BEING VIOLATED . 13
	1034	+
	1035	+	(C) A COVERED ENTITY MAY N OT BE LIABLE FOR A C IVIL PENALTY FOR A 14
	1036	+	VIOLATION FOR WHICH NOTICE IS GIVEN UNDE R SUBSECTION (A) OF THIS SECTION 15
	1037	+	IF THE COVERED EN TITY: 16
	1038	+
	1039	+	(1) HAS COMPLETED A DATA PROTECTION IMPACT AS SESSMENT 17
	1040	+	UNDER § 14–4604(A)(2) OF THIS SUBTITLE FOR EXISTING ONLINE PROD UCTS THAT 18
	1041	+	ARE REASONABLY LIKEL Y TO BE ACCESSED BY CHILDREN; 19
	1042	+
	1043	+	(2) HAS COMPLETED A DATA PROTECTION IMPACT AS SESSMENT 20
	1044	+	UNDER § 14–4604(A)(3) OF THIS SUBTITLE PRI OR TO OFFERING TO TH E PUBLIC A 21
	1045	+	NEW ONLINE PRODUCT T HAT IS REASONABLY LI KELY TO BE ACCESSED BY 22
	1046	+	CHILDREN; 23
	1047	+
	1048	+	(3) CURES THE VIOLATION S PECIFIED IN THE DIVISION’S NOTICE 24
	1049	+	WITHIN 90 DAYS AFTER ISSUANCE OF THE NOTICE UNDER SUBSECTION (A) OF THIS 25
	1050	+	SECTION; 26
	1051	+
	1052	+	(4) PROVIDES THE DIVISION WITH A WRITT EN STATEMENT THAT TH E 27
	1053	+	ALLEGED VIOLATION HA S BEEN CURED; AND 28
	1054	+
	1055	+	(5) TAKES MEASURES TO PRE VENT ANY FUTURE VIOL ATION THAT 29
	1056	+	THE DIVISION AGREED TO BE SUFFICIENT. 30
	1057	+
	1058	+	14–4610. 31
	1059	+
	1060	+	NOTHING IN THIS SUBTI TLE MAY BE INTERPRETED O R CONSTRUED TO : 32 24 HOUSE BILL 603
	1061	+
	1062	+
	1063	+
	1064	+	(1) PROVIDE A PRIVATE RIG HT OF ACTION UNDER T HIS SUBTITLE OR 1
	1065	+	ANY OTHER LAW ; 2
	1066	+
	1067	+	(2) IMPOSE LIABILITY IN A MANNER THAT IS INCON SISTENT WITH 47 3
	1068	+	U.S.C. § 230; 4
	1069	+
	1070	+	(3) PREVENT OR PRECLUDE A CHILD FROM DELIBERAT ELY OR 5
	1071	+	INDEPENDENTLY SEARCH ING FOR OR SPECIFICA LLY REQUESTING CONTE NT; OR 6
	1072	+
	1073	+	(4) REQUIRE A COVERED ENT ITY TO IMPLEMENT AN AGE–GATING 7
	1074	+	REQUIREMENT . 8
	1075	+
	1076	+	14–4611. 9
	1077	+
	1078	+	NOTWITHSTANDING ANY O THER LAW , A DATA PROTECTION IM PACT 10
	1079	+	ASSESSMENT IS PROTEC TED AS CONFIDENTIAL AND SHALL BE EXEMPT FROM 11
	1080	+	PUBLIC DISCLOSURE , INCLUDING UNDER THE MARYLAND PUBLIC INFORMATION 12
	1081	+	ACT. 13
	1082	+
	1083	+	14–4612. 14
	1084	+
	1085	+	(A) WHEREVER POSSIBLE , LAW RELATING TO CONS UMERS’ PERSONAL 15
	1086	+	DATA SHOULD BE CONST RUED TO HARMONIZE WI TH THE PROVISIONS OF THIS 16
	1087	+	SUBTITLE. 17
	1088	+
	1089	+	(B) IN THE EVENT OF A CONFLICT BETWEEN O THER LAWS AND THIS 18
	1090	+	SUBTITLE, THE PROVISIONS OF TH E LAW THAT AFFORD TH E GREATEST PROTECTIO N 19
	1091	+	FOR THE RIGHT OF PRI VACY FOR CONSUMERS S HALL CONTROL . 20
	1092	+
	1093	+	14–4613. 21
	1094	+
	1095	+	THIS SUBTITLE MAY BE CITED AS THE MARYLAND AGE–APPROPRIATE 22
	1096	+	DESIGN CODE ACT. 23
	1097	+
	1098	+	SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect 24
	1099	+	October 1, 2024. 25