EXPLANATION: CAPITALS INDICATE MAT TER ADDED TO EXISTIN G LAW.
[Brackets] indicate matter deleted from existing law.
*sb0571*
SENATE BILL 571
I3, S1 4lr1822
SB 844/23 – FIN CF HB 603
By: Senators Kramer, Hester, and West
Introduced and read first time: January 25, 2024
Assigned to: Finance
A BILL ENTITLED
AN ACT concerning 1
Consumer Protection – Online Products and Services – Data of Children 2
(Maryland Kids Code) 3
FOR the purpose of requiring a covered entity that offers an online product reasonably 4
likely to be accessed by children to complete a certain data protection impact 5
assessment under certain circumstances; requiring certain privacy protections for 6
certain online products; prohibiting certain data collection and sharing practices; 7
and generally relating to the protection of online privacy of children. 8
BY repealing and reenacting, with amendments, 9
Article – Commercial Law 10
Section 13–301(14)(xl) 11
Annotated Code of Maryland 12
(2013 Replacement Volume and 2023 Supplement) 13
BY repealing and reenacting, without amendments, 14
Article – Commercial Law 15
Section 13–301(14)(xli) 16
Annotated Code of Maryland 17
(2013 Replacement Volume and 2023 Supplement) 18
BY adding to 19
Article – Commercial Law 20
Section 13–301(14)(xlii); and 14–4601 through 14–4612 to be under the new subtitle 21
“Subtitle 46. Maryland Age–Appropriate Design Code Act” 22
Annotated Code of Maryland 23
(2013 Replacement Volume and 2023 Supplement) 24
Preamble 25
WHEREAS, The United Nations Convention on the Rights of the Child recognizes 26 2 SENATE BILL 571
that children need special safeguards and care in all aspects of their lives, specifying how 1
children’s rights apply in the digital environment in General Comment No. 25; and 2
WHEREAS, As children spend more of their time interacting with the online world, 3
the impact of the design of online products on their well–being has become a focus of 4
significant concern; and 5
WHEREAS, There is widespread agreement at the international level, and 6
bipartisan agreement in the United States, that more needs to be done to create a safer 7
online space for children to learn, explore, and play; and 8
WHEREAS, Lawmakers around the globe have taken steps to enhance privacy 9
protections for children based on the understanding that, in relation to data protection, 10
greater privacy necessarily means greater security and well–being; and 11
WHEREAS, Children should be afforded protections not only by online products and 12
services specifically directed at them, but by all online products they are likely to access, 13
and thus covered entities should take into account the unique needs of different age ranges, 14
including the following developmental stages: 0 to 5 years of age, or “preliterate and early 15
literacy”; 6 to 9 years of age, or “core primary school years”; 10 to 12 years of age, or 16
“transition years”; 13 to 15 years of age, or “early teens”; and 16 to 17 years of age, or 17
“approaching adulthood”; and 18
WHEREAS, While it is clear that the same data protection regime may not be 19
appropriate for children of all ages, children of all ages should nonetheless be afforded 20
privacy and protection, and online products should adopt data protection regimes 21
appropriate for children of the ages likely to access those products; and 22
WHEREAS, According to the Pew Research Center, in 2022, 97% of American 23
teenagers aged 13–17 used the Internet every day, with 46% responding they used the 24
Internet almost constantly; and, additionally, 36% of teens reported being concerned about 25
their social media use, while an earlier Pew Research Center study found that 59% of teens 26
have been bullied or harassed online; and 27
WHEREAS, The findings of the Pew Research Center are not surprising, given what 28
is known about controllers’ use of personal data and how it is utilized to inform 29
manipulative practices, to which children are particularly vulnerable; and 30
WHEREAS, Online products that are likely to be accessed by children should offer 31
strong privacy protections that, by design, prevent the use of children’s personal data to 32
offer elements that the covered entity offering the online product knows, or has reason to 33
know, are likely to be materially detrimental to the physical health, mental health, or 34
well–being of children; and 35
WHEREAS, Ensuring robust privacy, and thus safety, protections for children by 36
design is consistent with federal safety laws and policies applied to children’s products, 37
regulating everything from toys to clothing to furniture and games; and 38 SENATE BILL 571 3
WHEREAS, The consumer protections that federal safety laws apply to children’s 1
products require these products to comply with certain safety standards by their very 2
design, so that harms to children, and in some cases other consumers, are prevented; and 3
WHEREAS, It is the intent of the Maryland General Assembly that the Maryland 4
Age–Appropriate Design Code Act promote innovation by covered entities whose online 5
products are likely to be accessed by children by ensuring that those online products are 6
designed in a manner that recognizes the distinct needs of children within different age 7
ranges; and 8
WHEREAS, It is the intent of the Maryland General Assembly that covered entities 9
covered by the Maryland Age–Appropriate Design Code Act may look to guidance and 10
innovation in response to the Age–Appropriate Design Code established in the United 11
Kingdom and California when developing online products that are likely to be accessed by 12
children; now, therefore, 13
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 14
That the Laws of Maryland read as follows: 15
Article – Commercial Law 16
13–301. 17
Unfair, abusive, or deceptive trade practices include any: 18
(14) Violation of a provision of: 19
(xl) Title 14, Subtitle 13 of the Public Safety Article; [or] 20
(xli) Title 14, Subtitle 45 of this article; or 21
(XLII) TITLE 14, SUBTITLE 46 OF THIS ARTICLE; OR 22
SUBTITLE 46. MARYLAND AGE–APPROPRIATE DESIGN CODE ACT. 23
14–4601. 24
(A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANINGS 25
INDICATED. 26
(B) (1) “AGGREGATE CONSUMER IN FORMATION” MEANS INFORMATION : 27
(I) THAT RELATES TO A GRO UP OR CATEGORY OF CO NSUMERS; 28
(II) FROM WHICH I NDIVIDUAL CONSUMER I DENTITIES HAVE 29 4 SENATE BILL 571
BEEN REMOVED ; AND 1
(III) THAT IS NOT LINKED OR REASONABLY LINKABLE TO ANY 2
CONSUMER OR HOUSEHOL D, INCLUDING BY A DEVIC E. 3
(2) “AGGREGATE CONSUMER IN FORMATION” DOES NOT INCLUDE 4
INDIVIDUAL CONSUMER RECORDS THAT HAVE BEEN DE–IDENTIFIED. 5
(C) “BEST INTERESTS OF CHI LDREN” MEANS A COVERED ENTI TY’S USE OF 6
THE PERSONAL DATA OF A CHILD OR THE DESIG N OF AN ONLINE PRODU CT IN A WAY 7
THAT DOES NOT : 8
(1) BENEFIT THE COVERED E NTITY TO THE DETRIME NT OF A CHILD; 9
AND 10
(2) RESULT IN: 11
(I) REASONABLY FORESEEABL E AND MATERIAL PHYSI CAL OR 12
FINANCIAL HARM TO A CHILD; 13
(II) SEVERE AND REASONABLY FORESEEABLE PSYCHOLO GICAL 14
OR EMOTIONAL HARM TO A CHILD; 15
(III) A HIGHLY OFFENSIVE INT RUSION ON A CHILD ’S 16
REASONABLE EXPECTATI ON OF PRIVACY; OR 17
(IV) DISCRIMINATION AGAINS T A CHILD BASED ON R ACE, 18
COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, SEX, OR SEXUAL ORIENTATIO N. 19
(D) (1) “BIOMETRIC INFORMATION ” MEANS INFORMATION GE NERATED 20
BY AUTOMATIC MEASURE MENTS OF AN INDIVIDU AL’S BIOLOGICAL 21
CHARACTERISTICS . 22
(2) “BIOMETRIC INFORMATION ” INCLUDES: 23
(I) A FINGERPRINT ; 24
(II) A VOICEPRINT; 25
(III) AN EYE RETINA OR IRIS PATTERN; OR 26
(IV) ANY OTHER UNIQUE BIOL OGICAL PATTERN OR 27
CHARACTERISTIC THAT IS USED TO IDENTIFY A SPECIFIC INDIVIDUA L. 28 SENATE BILL 571 5
(3) “BIOMETRIC INFORMATION ” DOES NOT INCLUDE : 1
(I) A DIGITAL OR PHYSICAL PHOTOGRAPH ; 2
(II) AN AUDIO OR VIDEO REC ORDING; OR 3
(III) DATA GENERATED FROM A DIGITAL OR PHYSICAL 4
PHOTOGRAPH , OR AN AUDIO OR VIDEO RECORDING, UNLESS THE DATA IS 5
GENERATED TO IDENTIF Y A SPECIFIC INDIVID UAL. 6
(E) “CHILD” MEANS A CONSUMER WHO IS UNDER THE AGE OF 18 YEARS. 7
(F) (1) “COLLECT” MEANS TO BUY, RENT, GATHER, OBTAIN, RECEIVE, OR 8
ACCESS PERSONAL DATA RELATING TO A CONSUM ER. 9
(2) “COLLECT” INCLUDES: 10
(I) ACTIVELY OR PASSIVELY RECEIVING DATA FROM THE 11
CONSUMER ; AND 12
(II) OBSERVING THE CONSUME R’S BEHAVIOR. 13
(G) (1) “CONSUMER” MEANS AN INDIVIDUAL WHO IS A RESIDENT OF THE 14
STATE, HOWEVER IDENTIFIED , INCLUDING BY A UNIQU E IDENTIFIER. 15
(2) “CONSUMER” DOES NOT INCLUDE AN INDIV IDUAL ACTING IN A 16
COMMERCIAL OR EMPLOY MENT CONTEXT OR AS A N EMPLOYER , AN OWNER, A 17
DIRECTOR, AN OFFICER, OR A CONTRACTOR OF A COMPANY, PARTNERSHIP , SOLE 18
PROPRIETORSHIP , NONPROFIT ORGANIZATI ON, OR GOVERNMENT AGENCY WHOSE 19
COMMUNICATIONS OR TRANSACTIONS WITH TH E COVERED ENTITY OCC UR SOLELY 20
WITHIN THE CONTEXT O F THAT INDIVIDUAL ’S ROLE WITH THE COMP ANY, 21
PARTNERSHIP , SOLE PROPRIETORSHIP , NONPROFIT ORGANIZATI ON, OR 22
GOVERNMENT AGENCY . 23
(H) (1) “COVERED ENTITY ” MEANS A SOLE PROPRIE TORSHIP, A LIMITED 24
LIABILITY COMPANY , A CORPORATION , AN ASSOCIATION , OR ANY OTHER LEGAL 25
ENTITY THAT: 26
(I) IS ORGANIZED OR OPERA TED FOR THE PROFIT O R 27
FINANCIAL BENEFIT OF ITS SHAREHOLDERS OR OTHER OWNERS ; 28
(II) COLLECTS CONSUMERS ’ PERSONAL INFORMATION OR USES 29 6 SENATE BILL 571
ANOTHER ENTITY TO CO LLECT CONSUMERS ’ PERSONAL INFORMATION ON ITS 1
BEHALF; 2
(III) ALONE, OR JOINTLY WITH ITS AFFILIATES OR 3
SUBSIDIARIES, DETERMINES THE PURPO SES AND MEANS OF THE PROCESSING OF 4
CONSUMERS ’ PERSONAL DATA ; 5
(IV) DOES BUSINESS IN THE STATE; AND 6
(V) 1. HAS ANNUAL GROSS REVE NUES IN EXCESS OF 7
$25,000,000, ADJUSTED EVERY ODD –NUMBERED YEAR TO REF LECT ADJUSTMENTS 8
IN THE CONSUMER PRICE INDEX; 9
2. ANNUALLY BUYS , RECEIVES, SELLS, OR SHARES THE 10
PERSONAL DATA OF 50,000 OR MORE CONSUMERS , HOUSEHO LDS, OR DEVICES, 11
ALONE OR IN COMBINAT ION WITH ITS AFFILIA TES OR SUBSIDIARIES , FOR THE 12
COVERED ENTITY ’S COMMERCIAL PURPOSE S; OR 13
3. DERIVES AT LEAST 50% OF ITS ANNUAL REVENU ES 14
FROM THE SALE OF CON SUMERS’ PERSONAL DATA . 15
(2) “COVERED ENTITY ” INCLUDES: 16
(I) AN ENTITY THAT CONTRO LS OR IS CONTROLLED BY A 17
BUSINESS AND THAT SH ARES A NAME, SERVICE MARK , OR TRADEMARK THAT WO ULD 18
CAUSE A REASONABLE C ONSUMER TO UNDERSTAN D THAT TWO OR MORE E NTITIES 19
ARE COMMONLY OWNED ; AND 20
(II) A JOINT VENTURE OR PAR TNERSHIP COMPOSED OF 21
BUSINESSES IN WHICH EACH HAS AT LEAST A 40% INTEREST IN THE JOIN T VENTURE 22
OR PARTNERSHIP . 23
(I) “DARK PATTERN ” MEANS A USER INTERFA CE DESIGNED OR 24
MANIPULATED WITH THE PURPOSE OF SUBVERTIN G OR IMPAIRING USER 25
AUTONOMY , DECISION MAKING , OR CHOICE. 26
(J) “DATA PROTECTION IMPAC T ASSESSMENT” OR “ASSESSMENT” MEANS A 27
SYSTEMATIC SURVEY TO ASSESS COMPLIANCE WI TH THE DUTY TO ACT I N THE BEST 28
INTERESTS OF CHILDRE N. 29
(K) “DEFAULT” MEANS A PRESELECTED OPTION ADOPTED BY TH E 30
COVERED ENTITY FOR A N ONLINE PRODUC T. 31
SENATE BILL 571 7
(L) “DE–IDENTIFIED INFORMATI ON” MEANS DATA THAT CANN OT 1
REASONABLY BE USED T O INFER INFORMATION ABOUT, OR OTHERWISE BE LINK ED 2
TO, AN IDENTIFIED OR IDE NTIFIABLE INDIVIDUAL , IF THE COVERED ENTIT Y THAT 3
POSSESSES THE DATA : 4
(1) TAKES REASONABLE MEAS URES TO ENSURE THAT THE D ATA 5
CANNOT BE LINKED WIT H AN INDIVIDUAL; 6
(2) PUBLICLY COMMITS TO : 7
(I) MAINTAIN AND USE THE DATA IN DE–IDENTIFIED FORM ; 8
AND 9
(II) NOT ATTEMPT TO RE –IDENTIFY THE INFORMA TION; AND 10
(3) CONTRACTUALLY OBLIGAT ES ANY RECIPIENTS OF THE 11
INFORMATION TO COMPL Y WITH ALL PROVISION S OF THIS SUBSECTION . 12
(M) “DERIVED DATA” MEANS DATA THAT ARE DERIVED FROM OTHER D ATA 13
OR INFORMATION , OR OTHERWISE OBTAINE D THROUGH CORRELATIO NS, 14
PREDICTIONS, ASSUMPTIONS , INFERENCES, OR CONCLUSIONS DRAWN FROM FACTS 15
OR EVIDENCE OR ANOTH ER SOURCE OF INFORMA TION OR DATA ABOUT A CHILD OR 16
A CHILD’S DEVICE. 17
(N) “DIVISION” MEANS THE DIVISION OF CONSUMER PROTECTION OF THE 18
OFFICE OF THE ATTORNEY GENERAL. 19
(O) (1) “ONLINE PRODUCT ” MEANS AN ONLINE SERV ICE, PRODUCT, OR 20
FEATURE. 21
(2) “ONLINE PRODUCT ” DOES NOT INCLUDE : 22
(I) A TELECOMMUNICATIONS S ERVICE, AS DEFINED IN 47 23
U.S.C. § 153; 24
(II) THE SALE, DELIVERY, OR USE OF A PHYSICAL PRODUCT 25
SOLD BY AN ONLINE RE TAILER; OR 26
(III) A BROADBAND INTERNET ACCESS SERVI CE, AS DEFINED IN 27
47 C.F.R. § 8.1(B). 28
(P) (1) “PERSONAL DATA ” MEANS INFORMATION TH AT IS LINKED OR 29
REASONABLY ABLE TO B E LINKED, ALONE OR IN COMBINAT ION WITH OTHER 30 8 SENATE BILL 571
INFORMATION , TO AN IDENTIFIED OR IDENTIFIABLE INDIVID UAL. 1
(2) “PERSONAL DATA ” INCLUDES DERIVE D DATA THAT OTHERWIS E 2
MEETS THE DEFINITION IN PARAGRAPH (1) OF THIS SUBSECTION . 3
(Q) “PRECISE GEOLOCATION ” MEANS ANY DATA THAT IS: 4
(1) DERIVED FROM A DEVICE ; AND 5
(2) USED OR INTENDED TO B E USED TO LOCATE A C ONSUMER 6
GEOGRAPHICALLY WITHI N A RADIUS OF UP TO 1,850 FEET. 7
(R) (1) “PROCESS” MEANS TO CONDUCT OR DIRECT ANY OPERATION 8
THAT MAY BE PERFORME D ON PERSONAL DATA , WHETHER OR NOT BY AU TOMATED 9
MEANS. 10
(2) “PROCESS” INCLUDES: 11
(I) COLLECTING PERSONAL D ATA; 12
(II) USING PERSONAL DATA ; 13
(III) STORING PERSONAL DATA ; 14
(IV) DISCLOSING PERSONAL D ATA; 15
(V) ANALYZING PERSONAL DA TA; 16
(VI) DELETING PERSONAL DAT A; 17
(VII) MODIFYING PERSONAL DA TA; AND 18
(VIII) OTHERWISE HANDLING PE RSONAL DATA. 19
(S) (1) “PROFILING” MEANS ANY FORM OF AU TOMATED PROCESSING OF 20
PERSONAL DATA THAT U SES PERSONAL DATA TO EVALUATE, ANALYZE, OR PREDICT 21
CERTAIN ASPECTS RELA TING TO AN INDIVIDUA L, INCLUDING AN INDIVID UAL’S 22
ECONOMIC SITUATION , HEALTH, PERSONAL PREFERENCES , INTERESTS, 23
RELIABILITY, BEHAVIOR, LOCATION, OR MOVEMENTS. 24
(2) “PROFILING” DOES NOT INCLUDE THE PROCESSING OF 25
PERSONAL DATA THAT D OES NOT RESULT IN AN ASSESSMENT OR JUDGME NT ABOUT 26
AN INDIVIDUAL. 27 SENATE BILL 571 9
(T) (1) “PUBLICLY AVAILABLE IN FORMATION” MEANS INFORMATION 1
THAT: 2
(I) IS LAWFULLY MADE AVAI LABLE FROM FEDERAL, STATE, OR 3
LOCAL GOVERNMENT REC ORDS; OR 4
(II) A COVERED ENTITY HAS A REASONABLE BASIS TO BELIEVE 5
IS LAWFULLY MADE AVA ILABLE TO THE GENERA L PUBLIC BY THE CONS UMER OR BY 6
WIDELY DISTRIBUTED M EDIA. 7
(2) “PUBLICLY AVAILABLE IN FORMATION” DOES NOT IN CLUDE 8
BIOMETRIC INFORMATIO N COLLECTED BY A COV ERED ENTITY ABOUT A CONSUMER 9
WITHOUT THE CONSUMER ’S KNOWLEDGE . 10
(U) “REASONABLY LIKELY TO BE ACCESSED BY CHILD REN” MEANS 11
REASONABLY EXPECTED THAT THE ONLINE PROD UCT WOULD BE ACCESSE D BY 12
CHILDREN, BASED ON SATI SFYING ANY OF THE FO LLOWING CRITERIA : 13
(1) THE ONLINE PRODUCT IS DIRECTED TO CHILDREN AS DEFINED IN 14
THE FEDERAL CHILDREN’S ONLINE PRIVACY PROTECTION ACT; 15
(2) THE ONLINE PRODUCT IS DETERMINED , BASED ON COMPETENT 16
AND RELIABLE EVIDENC E REGARDING AUDIENCE COMPOSITION , TO BE ROUTINELY 17
ACCESSED BY A SIGNIF ICANT NUMBER OF CHIL DREN; 18
(3) THE ONLINE PRODUCT IS SUBSTANTIALLY SIMILA R OR THE SAME 19
AS AN ONLINE PRODUCT THAT SATISFIES ITEM (2) OF THIS SUBSECTION ; 20
(4) THE ONLINE PRODUCT FE ATURES ADVERTISEMENT S MARKETED 21
TO CHILDREN; 22
(5) THE COVERED ENTITY ’S INTERNAL RESEARCH FINDINGS 23
DETERMINE THAT A SIG NIFICANT AMOUNT OF T HE ONLINE PRODUCT ’S AUDIENCE IS 24
COMPOSED OF CHILDREN ; OR 25
(6) THE COVERED ENTITY KN OWS OR SHOULD HAVE K NOWN THAT A 26
USER IS A CHILD. 27
(V) (1) “SELL” MEANS TO TRANSFER , RENT, RELEASE, DISCLOSE, 28
DISSEMINATE, MAKE AVAILABLE , OR OTHERWISE COMMUNI CATE, WHETHER 29
ORALLY, IN WRITING, OR BY ELECTRONIC OR OTHER MEANS , A CONSUMER ’S 30
PERSONAL DATA , IN A TRANSACTION FOR MONETARY OR OTHER VA LUABLE 31 10 SENATE BILL 571
CONSIDERAT ION BETWEEN A COVERE D ENTITY AND A THIRD PARTY. 1
(2) “SELL” DOES NOT INCLUDE : 2
(I) THE DISCLOSURE OF PER SONAL DATA TO THE SE RVICE 3
PROVIDER THAT PROCES SES PERSONAL DATA ON BEHALF OF THE COVERE D ENTITY; 4
(II) THE DISCLOSURE OF PER SONAL DATA TO A THIRD PARTY 5
FOR PURPOSES OF PROV IDING A PRODUCT OR S ERVICE REQUESTED BY THE 6
CONSUMER ; 7
(III) THE DISCLOSURE OR TRA NSFER OF PERSONAL DA TA TO AN 8
AFFILIATE OR SUBSIDI ARY OF THE COVERED E NTITY; 9
(IV) THE DISCLOSURE OF PER SONAL DATA WHERE THE 10
CONSUMER DIR ECTS THE COVERED ENT ITY TO DISCLOSE THE PERSONAL DATA OR 11
INTENTIONALLY USES T HE COVERED ENTITY TO INTERACT WITH A THIR D PARTY; OR 12
(V) THE DISCLOSURE OR TRA NSFER OF PERSONAL DA TA TO A 13
THIRD PARTY AS AN AS SET THAT IS PART OF AN ACTUAL OR PROPOSE D MERGER, 14
ACQUISITION, BANKRUPTCY , OR OTHER TRANSACTION , IN WHICH THE THIRD P ARTY 15
ASSUMES CONTROL OF A LL OR PART OF THE CO VERED ENTITY’S ASSETS. 16
(W) (1) “SENSITIVE PERSONAL DA TA” MEANS: 17
(I) PERSONAL DATA THAT RE VEALS A CONSUMER ’S: 18
1. SOCIAL SECURITY NUMB ER, DRIVER’S LICENSE 19
NUMBER, STATE IDENTIFICATION CARD NUMBER , OR PASSPORT NUMBER ; 20
2. ACCOUNT LOGIN INFORMA TION, FINANCIAL 21
ACCOUNT NUMBER , DEBIT CARD NUMBER , OR CREDIT CARD NUMBE R, IN 22
COMBINATION WITH ANY REQUIRED SECURITY OR ACCESS CODE , PASSWORD, OR 23
CREDENTIALS THAT ALL OW ACCESS TO AN ACCO UNT; 24
3. PRECISE GEOLOCATION ; 25
4. RACIAL OR ETHNIC ORIG IN OR RELIGIOUS OR 26
PHILOSOPHICAL BELIEF S; 27
5. MAIL, E–MAIL, TEXT, OR MESSAGE CONTENTS , 28
UNLESS THE COVERED E NTITY IS THE INTENDE D RECIPIENT; OR 29
SENATE BILL 571 11
6. GENETIC DATA; 1
(II) BIOMETRIC INFORMATION THAT IS OR MAY BE PR OCESSED 2
FOR THE PURPOSE OF U NIQUELY IDENTIFYING A CONSUMER ; 3
(III) PERSONAL DATA COLLECT ED AND ANALYZED CONC ERNING 4
A CONSUMER ’S HEALTH; OR 5
(IV) PERSONAL DATA COLLECT ED AND ANALYZED CONCERNING 6
A CONSUMER ’S SEX LIFE OR SEXUAL ORIENTATION . 7
(2) “SENSITIVE PERSONAL DA TA” DOES NOT INCLUDE PUB LICLY 8
AVAILABLE INFORMATIO N. 9
(X) “SERVICE PROVIDER ” MEANS A PERSON THAT PROCESSES PERSONAL 10
DATA ON BEHALF OF A COVERED ENTITY AND T HAT RECEIVES F ROM OR ON BEHALF 11
OF THE COVERED ENTIT Y A CONSUMER’S PERSONAL DATA FOR BUSINESS PURPOSES 12
IN ACCORDANCE WITH A WRITTEN CONTRACT , IF THE CONTRACT PROH IBITS THE 13
PERSON FROM : 14
(1) SELLING OR SHARING TH E PERSONAL DATA ; 15
(2) RETAINING, USING, OR DISCLOSING TH E PERSONAL DATA FOR 16
ANY PURPOSE OTHER TH AN FOR THE BUSINESS PURPOSES SPECIFIED I N THE 17
CONTRACT FOR THE COV ERED ENTITY , INCLUDING RETAINING , USING, OR 18
DISCLOSING THE PERSO NAL DATA FOR A COMME RCIAL PURPOSE OTHER THAN THE 19
BUSINESS PURPOSES SP ECIFIED IN THE CO NTRACT WITH THE COVE RED ENTITY, OR 20
AS OTHERWISE ALLOWED UNDER THIS SUBTITLE ; 21
(3) RETAINING, USING, OR DISCLOSING THE PE RSONAL DATA 22
OUTSIDE THE DIRECT B USINESS RELATIONSHIP BETWEEN THE SERVICE PROVIDER 23
AND THE COVERED ENTI TY; AND 24
(4) COMBINING THE PER SONAL DATA THAT THE SERVICE PROVIDER 25
RECEIVES FROM , OR ON BEHALF OF , THE COVERED ENTITY W ITH PERSONAL DATA 26
THAT IT RECEIVES FRO M, OR ON BEHALF OF , ANOTHER PERSON OR PE RSONS, OR 27
COLLECTS FROM ITS OW N INTERACTION WITH T HE CONSUMER . 28
(Y) “SHARE” MEANS TO RENT, RELEASE, DISSEMINATE, MAKE AVAILABLE , 29
TRANSFER, OR OTHERWISE COMMUNI CATE, WHETHER ORALLY , IN WRITING, OR BY 30
ELECTRONIC OR OTHER MEANS, A CONSUMER ’S PERSONAL DATA TO A THIRD PARTY 31
FOR CROSS –CONTEXT BEHAVIORAL A DVERTISING WHETHER O R NOT FOR 32
MONETARY OR OTHER VALUABLE CONSI DERATION, INCLUDING IN A TRANS ACTION 33 12 SENATE BILL 571
BETWEEN A COVERED EN TITY AND A THIRD PAR TY FOR TARGETED ADVE RTISING 1
FOR THE BENEFIT OF A COVERED ENTITY IN WH ICH NO MONEY IS EXCH ANGED. 2
(Z) (1) “TARGETED ADVERTISING ” MEANS DISPLAYING 3
ADVERTISEMEN TS TO A CONSUMER WHE RE THE ADVERTISEMENT IS SELECTED 4
BASED ON PERSONAL DA TA OBTAINED OR INFER RED FROM THAT CONSUM ER’S 5
ACTIVITIES OVER TIME AND ACROSS NONAFFILI ATED INTERNET WEBSITES OR 6
ONLINE APPLICATIONS TO PREDICT THE CONSU MER’S PREFERENCES OR 7
INTERESTS. 8
(2) “TARGETED ADVERTISING ” DOES NOT INCLUDE : 9
(I) ADVERTISEMENTS BASED ON ACTIVITIES WITHIN A 10
COVERED ENTITY ’S OWN INTERNET WEBSITES OR ONLINE APPLICATIONS ; 11
(II) ADVERTISEMENTS BASED ON THE CONTEXT OF A 12
CONSUMER ’S CURRENT SEARCH QUE RY, VISIT TO AN INTERNET WEBSITE , OR USE OF 13
AN ONLINE APPLICATIO N; 14
(III) ADVERTISEMENTS DIRECT ED TO A CONSUMER IN 15
RESPONSE TO THE CONS UMER’S REQUEST FOR INFORM ATION OR FEEDBACK ; OR 16
(IV) PROCESSING PERSONAL D ATA SOLELY TO MEASUR E OR 17
REPORT ADVERTISING F REQUENCY, PERFORMANCE , OR REACH. 18
(AA) “THIRD PARTY” MEANS A PERSON WHO I S NOT: 19
(1) THE COVERED ENTITY WI TH WHICH THE CONSUME R 20
INTENTIONALLY INTERA CTS AND THAT COLLECT S PERSONAL DATA FROM THE 21
CONSUMER AS PART OF THE CONSUMER ’S INTERACTION WITH T HE COVERED 22
ENTITY; OR 23
(2) A SERVICE PROVIDER FOR THE COVERED ENTITY . 24
14–4602. 25
THIS SUBTITLE DOES NO T APPLY TO: 26
(1) PROTECTED HEALTH INFO RMATION THAT IS COLL ECTED BY A 27
COVERED ENTITY OR BU SINESS ASSOCIATION G OVERNED BY THE PRIVA CY 28
SECURITY AND BREACH NOTIFICATION RULES IN 45 C.F.R. PARTS 160 AND 164, 29
ESTABLISHED UNDER TH E FEDERAL HEALTH INSURANCE PORTABILITY AND 30
ACCOUNTABILITY ACT OF 1996 AND THE FEDERAL HEALTH INFORMATION 31 SENATE BILL 571 13
TECHNOLOGY FOR ECONOMIC AND CLINICAL HEALTH ACT; 1
(2) A COVERED ENTITY GOVER NED BY THE PRIV ACY SECURITY AND 2
BREACH NOTIFICATION RULES IN 45 C.F.R. PARTS 160 AND 164, ESTABLISHED 3
UNDER THE FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY 4
ACT OF 1996 AND THE FEDERAL HEALTH INFORMATION TECHNOLOGY FOR 5
ECONOMIC AND CLINICAL HEALTH ACT, TO THE EXTENT THAT THE COVE RED 6
ENTITY MAINTAINS PAT IENT INFORMATION IN THE SAME MANNER AS M EDICAL 7
INFORMATION OR PROTE CTED HEALTH INFORMAT ION AS DESCRIBED IN ITEM (1) OF 8
THIS SECTION; OR 9
(3) INFORMATION COLLECTED AS PART OF A CLINICA L TRIAL 10
SUBJECT TO THE FEDERAL POLICY FOR THE PROTECTION OF HUMAN SUBJECTS, 11
IN ACCORDANCE WITH : 12
(I) GOOD CLINICAL PRACTIC E GUIDELINES ISSUED BY THE 13
INTERNATIONAL COUNCIL FOR HARMONISATION OF TECHNICAL REQUIREMENTS 14
FOR PHARMACEUTICALS FOR HUMAN USE; OR 15
(II) HUMAN SUBJECT PROT ECTION REQUIREMENTS OF THE 16
U.S. FOOD AND DRUG ADMINISTRATION . 17
14–4603. 18
IT IS THE INTENT OF T HE GENERAL ASSEMBLY THAT : 19
(1) CHILDREN SHOULD BE AF FORDED PROTECTIONS N OT ONLY BY 20
ONLINE PRODUCTS SPEC IFICALLY DIRECTED AT THEM, BUT BY ALL ONLINE 21
PRODUCTS THEY ARE REASONABLY LIKELY TO ACCESS ; 22
(2) COVERED ENTITIES THAT DEVELOP AND PROVIDE ONLINE 23
SERVICES THAT CHILDR EN ARE LIKELY TO ACC ESS SHALL ENSURE THE BEST 24
INTERESTS OF CHILDRE N WHEN DESIGNING , DEVELOPING , AND PROVIDING THOSE 25
ONLINE PRODUCTS ; 26
(3) ALL COVERED ENTITIES T HAT OPERATE IN THE STATE AND 27
PROCESS CHILDREN ’S DATA IN ANY CAPACI TY SHALL DO SO IN A MANNER 28
CONSISTENT WITH THE BEST INTERESTS OF CH ILDREN; 29
(4) IF A CONFLICT ARISES BETWEEN COMMERCIAL I NTERESTS AND 30
THE BEST INTERESTS O F CHILDREN, COVERED ENTITIES THAT DEVELOP ONLINE 31
PRODUCTS LIKELY TO B E ACCESSED BY CHILDR EN SHALL GIVE PRIORI TY TO THE 32
PRIVACY, SAFETY, AND WELL–BEING OF CHILDREN OV ER THOSE COMMERCIAL 33 14 SENATE BILL 571
INTERESTS; AND 1
(5) NOTHING IN THIS SUBTI TLE MAY BE CONSTRUED TO INFRINGE ON 2
THE EXISTING RIGHTS AND FR EEDOMS OF CHILDREN . 3
14–4604. 4
(A) (1) SUBJECT TO PARAGRAPH (2) OF THIS SUBSECTION , A COVERED 5
ENTITY THAT PROVIDES AN ONLINE PRODUCT RE ASONABLY LIKELY TO B E 6
ACCESSED BY CHILDREN SHALL PREPARE A DATA PROTECTION IMPACT 7
ASSESSMENT FOR THE ONLINE PRODUCT . 8
(2) ON OR BEFORE APRIL 1, 2026, A COVERED ENTITY SHA LL 9
PREPARE A DATA PROTE CTION IMPACT ASSESSM ENT FOR ANY ONLINE P RODUCT 10
THAT: 11
(I) MEETS THE CRITERIA UN DER PARAGRAPH (1) OF THIS 12
SUBSECTION; 13
(II) IS OFFERED TO THE PUB LIC ON OR BEFORE APRIL 1, 2026; 14
AND 15
(III) WILL CONTINUE TO BE O FFERED TO THE PUBLIC AFTER 16
JULY 1, 2026. 17
(3) FOR AN ONLINE PRODUCT THAT MEETS THE CRITE RIA UNDER 18
PARAGRAPH (1) OF THIS SUBSECTION A ND IS INITIALLY OFFE RED TO THE PUBLIC 19
AFTER APRIL 1, 2026, A COVERED ENTITY SHALL COMP LETE A DATA PROTECTI ON 20
IMPACT ASSESSMENT WI THIN 90 DAYS AFTER THE ONLIN E PRODUCT IS OFFERED TO 21
THE PUBLIC. 22
(B) THE DATA PROTECTION I MPACT ASSESSMENT SHA LL: 23
(1) IDENTIFY THE PURPOSE OF THE ONLINE PRODUC T; 24
(2) IDENTIFY HOW THE ONLINE PRODUCT USES CHILDREN’S DATA; 25
(3) DETERMINE WHETHER THE ONLINE PRODUCT IS DE SIGNED AND 26
OFFERED IN A MANNER CONSISTENT WITH THE BEST INTERESTS OF CH ILDREN 27
REASONABLY LIKELY TO ACCESS THE ONLINE PR ODUCT THROUGH CONSID ERATION 28
OF: 29
(I) WHETHER THE DATA MANAGEMENT OR P ROCESSING 30 SENATE BILL 571 15
PRACTICES OF THE ONL INE PRODUCT COULD LE AD TO CHILDREN EXPER IENCING OR 1
BEING TARGETED BY CO NTACTS THAT WOULD RE SULT IN: 2
1. REASONABLY FORESEEABL E AND MATERIAL 3
PHYSICAL OR FINANCIA L HARM TO THE CHILD ; 4
2. REASONABLY F ORESEEABLE AND EXTRE ME 5
PSYCHOLOGICAL OR EMO TIONAL HARM TO THE C HILD; 6
3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD ’S 7
REASONABLE EXPECTATI ON OF PRIVACY; OR 8
4. DISCRIMINATION AGAINS T THE CHILD BASED ON 9
RACE, COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, SEX, OR SEXUAL 10
ORIENTATION ; 11
(II) WHETHER THE DATA MANA GEMENT OR PROCESSING 12
PRACTICES OF THE ONL INE PRODUCT COULD PE RMIT CHILDREN TO WIT NESS, 13
PARTICIPATE IN, OR BE SUBJECT TO CON DUCT THAT WOULD RESU LT IN: 14
1. REASONABLY FORESEEABL E AND MATERIAL 15
PHYSICAL OR FINANCIA L HARM TO THE CHILD ; 16
2. REASONABLY FORESEEABL E AND EXTREME 17
PSYCHOLOGICAL OR EMO TIONAL HARM TO THE C HILD; 18
3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD ’S 19
REASONABLE EXPECTATI ON OF PRIVACY; OR 20
4. DISCRIMINATION AGAINS T THE CHILD BASED ON 21
RACE, COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, SEX, OR SEXUAL 22
ORIENTATION ; 23
(III) WHETHER THE DATA MANA GEMENT OR PROCESSING 24
PRACTICES OF THE ONL INE PRODUCT ARE REAS ONABLY EXPECTED TO A LLOW 25
CHILDREN BECOMING PA RTY TO OR EXPLOITED BY A CONTRACT THROUGH THE 26
ONLINE PRODUCT THAT WOULD RESULT IN : 27
1. REASONABLY FORESEEABL E AND MATERIAL 28
PHYSICAL OR FINANCIA L HARM TO THE CHILD ; 29
2. REASONABLY FORESEEABL E AND EXTREME 30
PSYCHOLOGICAL OR EMO TIONAL HARM TO THE C HILD; 31 16 SENATE BILL 571
3. A HIGHLY OFFENS IVE INTRUSION ON THE CHILD’S 1
REASONABLE EXPECTATI ON OF PRIVACY; OR 2
4. DISCRIMINATION AGAINS T THE CHILD BASED ON 3
RACE, COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, SEX, OR SEXUAL 4
ORIENTATION ; 5
(IV) WHETHER TARGETED ADVE RTISING SYSTEMS USED BY THE 6
ONLINE PRODUCT WOULD RESULT IN: 7
1. REASONABLY FORESEEABL E AND MATERIAL 8
PHYSICAL OR FINANCIA L HARM TO THE CHILD ; 9
2. REASONABLY FORESEEABL E AND EXTREME 10
PSYCHOLOGICAL OR EMO TIONAL HARM TO THE C HILD; 11
3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD ’S 12
REASONABLE EXPECTATI ON OF PRIVACY; OR 13
4. DISCRIMINATION AGAINS T THE CHILD BASED ON 14
RACE, COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, SEX, OR SEXUAL 15
ORIENTATION ; 16
(V) WHETHER THE ONLINE PR ODUCT USES SYSTEM DE SIGN 17
FEATURES TO INCREASE , SUSTAIN, OR EXTEND THE USE OF THE ONLINE PRODUCT , 18
INCLUDING THE AUTOMA TIC PLAYING OF MEDIA , REWARDS FOR TIME SPE NT, AND 19
NOTIFICATIONS THAT W OULD RESULT IN : 20
1. REASONABLY FORESEEABL E AND MATERIAL 21
PHYSICAL OR FINANCIA L HARM TO THE CHILD ; 22
2. REASONABLY FORESE EABLE AND EXTREME 23
PSYCHOLOGICAL OR EMO TIONAL HARM TO THE C HILD; 24
3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD ’S 25
REASONABLE EXPECTATI ON OF PRIVACY; OR 26
4. DISCRIMINATION AGAINS T THE CHILD BASED ON 27
RACE, COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, SEX, OR SEXUAL 28
ORIENTATION ; 29
(VI) WHETHER, HOW, AND FOR WHAT PURPOSE THE ONLINE 30 SENATE BILL 571 17
PRODUCT COLLECTS OR PROCESSES SENSITIVE PERSONAL DATA OF CHI LDREN AND 1
WHETHER THOSE PRACTI CES WOULD RESULT IN : 2
1. REASONABLY FORESEEABL E AND MATERIAL 3
PHYSICAL OR FINANC IAL HARM TO THE CHIL D; 4
2. REASONABLY FORESEEABL E AND EXTREME 5
PSYCHOLOGICAL OR EMO TIONAL HARM TO THE C HILD; 6
3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD ’S 7
REASONABLE EXPECTATI ON OF PRIVACY; OR 8
4. DISCRIMINATION AGAINS T THE CHILD BASED ON 9
RACE, COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, SEX, OR SEXUAL 10
ORIENTATION ; 11
(VII) WHETHER AND HOW DATA COLLECTED TO UNDERST AND 12
THE EXPERIMENTAL IMP ACT OF THE PRODUCT R EVEALS DATA MANAGEME NT OR 13
DESIGN PRACTICES THA T WOULD RESULT IN : 14
1. REASONABLY F ORESEEABLE AND MATER IAL 15
PHYSICAL OR FINANCIA L HARM TO THE CHILD ; 16
2. REASONABLY FORESEEABL E AND EXTREME 17
PSYCHOLOGICAL OR EMO TIONAL HARM TO THE C HILD; 18
3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD ’S 19
REASONABLE EXPECTATI ON OF PRIVACY; OR 20
4. DISCRIMINATION AGAINST T HE CHILD BASED ON 21
RACE, COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, SEX, OR SEXUAL 22
ORIENTATION ; 23
(VIII) WHETHER ALGORITHMS US ED BY THE ONLINE PRO DUCT 24
WOULD RESULT IN : 25
1. REASONABLY FORESEEABL E AND MATERIAL 26
PHYSICAL OR FINANCIA L HARM TO THE CHILD ; 27
2. REASONABLY FORESEEABL E AND EXTREME 28
PSYCHOLOGICAL OR EMO TIONAL HARM TO THE C HILD; 29
3. A HIGHLY OFFENSIVE INT RUSION ON THE CHILD ’S 30 18 SENATE BILL 571
REASONABLE EXPECTATI ON OF PRIVACY; OR 1
4. DISCRIMINATION AGAINS T THE CHILD BASED ON 2
RACE, COLOR, RELIGION, NATIONAL ORIGIN , DISABILITY, SEX, OR SEXUAL 3
ORIENTATION ; AND 4
(IX) ANY OTHER FACTOR THAT MAY INDICATE THAT TH E ONLINE 5
PRODUCT IS DESIGNED AND OFFERED IN A MAN NER THAT IS INCONSIS TENT WITH 6
THE BEST INTERESTS O F CHILDREN. 7
(C) (1) A DATA PROTECTION IMPACT AS SESSMENT PREPARED BY A 8
COVERED ENTITY FOR T HE PURPOSE OF COMPLI ANCE WITH ANY OTHER LAW 9
COMPLIES WITH THIS S ECTION IF THE ASSESS MENT MEETS THE REQUI REMENTS OF 10
THIS SECTION. 11
(2) A SINGLE DATA PROTECTI ON IMPACT ASSESSMENT MAY CONTAIN 12
MULTIPLE SIMILAR PROC ESSING OPERATIONS TH AT PRESENT SIMILAR R ISKS ONLY 13
IF EACH RELEVANT ONL INE PRODUCT IS ADDRE SSED. 14
14–4605. 15
A COVERED ENTITY REQUI RED TO COMPLETE A DA TA PROTECTION IMPACT 16
ASSESSMENT UNDER § 14–4604 OF THIS SUBTITLE SHA LL: 17
(1) MAINTAIN DOCUMENTATION OF T HE ASSESSMENT FOR AS LONG 18
AS THE ONLINE PRODUC T IS LIKELY TO BE AC CESSED BY CHILDREN ; 19
(2) REVIEW EACH DATA PROT ECTION IMPACT ASSESS MENT AS 20
NECESSARY TO ACCOUNT FOR MATERIAL CHANGES TO PROCESSING PERTAI NING TO 21
THE ONLINE PRODUCT W ITHIN 90 DAYS OF SUCH MATERIA L CHANGES; 22
(3) CONFIGURE ALL DEFAULT PRIVACY SETTINGS PRO VIDED TO 23
CHILDREN BY THE ONLI NE PRODUCT TO OFFER A HIGH LEVEL OF PRIV ACY, UNLESS 24
THE COVERED ENTITY C AN DEMONSTRATE A COM PELLING REASON THAT A 25
DIFFERENT SETTING IS IN THE BEST INTERESTS OF CH ILDREN; 26
(4) PROVIDE ANY PRIVACY I NFORMATION , TERMS OF SERVICE , 27
POLICIES, AND COMMUNITY STANDA RDS CONCISELY , PROMINENTLY , AND USING 28
CLEAR LANGUAGE SUITE D TO THE AGE OF CHIL DREN LIKELY TO ACCES S THE 29
ONLINE PRODUCT ; AND 30
(5) PROVIDE PROMINENT, ACCESSIBLE, AND RESPONSIVE TOOLS TO 31
HELP CHILDREN OR THE IR PARENTS OR GUARDI ANS, IF APPLICABLE, EXERCISE 32 SENATE BILL 571 19
THEIR PRIVACY RIGHTS AND REPORT CONCERNS . 1
14–4606. 2
(A) A COVERED ENTITY THAT PROVIDES AN ONLINE P RODUCT THAT IS 3
ACCESSED OR REASONAB LY LIKELY TO BE ACCESSE D BY CHILDREN MAY NO T: 4
(1) PROCESS THE PERSONAL DATA OF A CHILD IN A WAY THAT IS 5
INCONSISTENT WITH TH E BEST INTERESTS OF CHILDREN REASONABLY LIKELY TO 6
ACCESS THE ONLINE PR ODUCT; 7
(2) PROFILE A CHILD BY DE FAULT, UNLESS: 8
(I) THE COVERED ENTITY CAN D EMONSTRATE THAT THE 9
COVERED ENTITY HAS A PPROPRIATE SAFEGUARD S IN PLACE TO ENSURE THAT 10
PROFILING IS CONSIST ENT WITH THE BEST IN TERESTS OF CHILDREN WHO ACCESS 11
OR ARE REASONABLY LI KELY TO ACCESS THE O NLINE PRODUCT ; AND 12
(II) 1. PROFILING IS NECESSARY TO PR OVIDE THE ONLINE 13
PRODUCT, AND IS DONE ONLY WIT H RESPECT TO THE ASP ECTS OF THE ONLINE 14
PRODUCT THAT THE CHI LD IS ACTIVELY AND K NOWINGLY ENGAGED WIT H; OR 15
2. THE COVERED ENTITY CA N DEMONSTRATE A 16
COMPELLING REASON TH AT PROFILING IS IN T HE BEST INTERESTS OF CHILDREN; 17
(3) PROCESS PERSONAL DATA OF A CHILD THAT IS N OT REASONABLY 18
NECESSARY TO PROVIDE AN ONLINE PRODUCT TH AT THE CHILD IS ACTI VELY AND 19
KNOWINGLY ENGAGED WI TH; 20
(4) PROCESS THE PERSONAL DATA OF A CHILD END USER FOR ANY 21
REASON OTHER THAN A REASON FOR WHICH THAT PERSO NAL DATA WAS 22
COLLECTED; 23
(5) PROCESS ANY PRECISE G EOLOCATION INFORMATI ON OF A CHILD 24
BY DEFAULT, UNLESS: 25
(I) THE COLLECTION OF THE PRECISE GEOLOCATION 26
INFORMATION IS STRIC TLY NECESSARY FOR TH E COVERED ENTITY TO PROVIDE THE 27
ONLINE PRODUCT ; AND 28
(II) THE PRECISE GEOLOCATI ON DATA IS PROCESSED ONLY FOR 29
THE LIMITED TIME THA T IS NECESSARY TO PR OVIDE THE ONLINE PRO DUCT; 30
20 SENATE BILL 571
(6) PROCESS ANY PRECISE G EOLOCATION INFORMATI ON OF A CHILD 1
WITHOUT PROVIDING AN OBVIOUS SIGNAL TO THE CHILD FOR THE DURATION THAT 2
THE PRECISE GEOLOCAT ION INFORMATION IS B EING COLLECTED ; 3
(7) USE DARK PATTERNS TO : 4
(I) CAUSE A CHILD TO PROV IDE PERSONAL DATA BE YOND 5
WHAT IS REASONABLY E XPECTED TO PROVIDE T HE ONLINE PRODUCT ; 6
(II) CIRCUMVENT PRIVACY PROTECTIONS ; OR 7
(III) TAKE ANY ACTION THAT THE COVERED ENTITY K NOWS, OR 8
HAS REASON TO KNOW , IS NOT IN THE BEST I NTERESTS OF CHILDREN WHO ACCESS 9
OR ARE REASONABLY LI KELY TO ACCESS THE O NLINE PRODUCT ; 10
(8) PROCESS ANY PERSONAL DATA FOR THE PURP OSE OF 11
ESTIMATING THE AGE O F A CHILD THAT IS AC TIVELY AND KNOWINGLY ENGAGED 12
WITH AN ONLINE PRODU CT THAT IS NOT REASO NABLY NECESSARY TO P ROVIDE THE 13
ONLINE PRODUCT ; OR 14
(9) ALLOW A CHILD’S PARENT, GUARDIAN, OR ANY OTHER CONSUME R 15
TO MONITOR THE CHILD ’S ONLINE ACTIVITY OR TRACK THE CHILD’S LOCATION, 16
WITHOUT PROVIDING AN OBVIOUS SIGNAL TO TH E CHILD WHEN THE CHI LD IS BEING 17
MONITORED OR TRACKED . 18
(B) IN MAKING A DETERMINA TION AS TO WHETHER A N ONLINE PRODUCT IS 19
REASONABLY LIKELY TO BE ACCESSED BY CHILD REN, A COVERED ENTITY MAY NOT 20
COLLECT OR PROCESS A NY PERSONAL DATA BEY OND WHAT IS REASONAB LY 21
NECESSARY TO MAKE TH E DETERMINATION . 22
14–4607. 23
(A) WITHIN 5 BUSINESS DAYS AFTER RECEIVING A WRITTEN REQUEST FROM 24
THE DIVISION, A COVERED ENTITY THA T PROVIDES AN ONLINE PRODUCT 25
REASONABLY LIKELY TO BE ACCESSED BY CHILD REN SHALL PROVIDE TO THE 26
DIVISION A LIST OF AL L DATA PROTECTION IM PACT ASSESSMENTS THE COVERED 27
ENTITY HAS COMPLETED UNDER § 14–4604 OF THIS SUBTITLE. 28
(B) (1) WITHIN 7 BUSINESS DAYS AFTER RECEIVING A WRITTEN REQUEST 29
FROM THE DIVISION, A COVERED ENTITY SHA LL PROVIDE TO THE DIVISION ANY 30
DATA PROTECTION IMPA CT ASSESSMENT COMPLE TED UNDER § 14–4604 OF THIS 31
SUBTITLE. 32
SENATE BILL 571 21
(2) THE DIVISION MAY EXTEND B EYOND 7 DAYS THE AMOUNT OF 1
TIME ALLOWED FOR A C OVERED ENTITY TO PRO DUCE A DATA PROTECTION IMPACT 2
ASSESSMENT . 3
(C) TO THE EXTENT THAT AN Y DISCLOSURE REQUIRE D UNDER SUBSECTION 4
(B) OF THIS SECTION INCL UDES INFORMATION SUB JECT TO ATTORNEY –CLIENT 5
PRIVILEGE OR WORK –PRODUCT PROTECTION , THE DISCLOSURE MAY N OT 6
CONSTITUTE A WAIVER OF THAT PRIVILEGE OR PROTECTION. 7
14–4608. 8
(A) A VIOLATION OF THIS SU BTITLE: 9
(1) IS AN UNFAIR, ABUSIVE, OR DECEPTIVE TRADE P RACTICE; AND 10
(2) EXCEPT FOR § 13–410 OF THIS ARTICLE , IS SUBJECT TO THE 11
ENFORCEMENT PROVISIO NS CONTAINED IN TITLE 13 OF THIS ARTICLE. 12
(B) A COVERED ENTITY THAT VIOLATES THIS SUBTIT LE IS SUBJECT TO A 13
CIVIL PENALTY NOT EX CEEDING: 14
(1) $2,500 PER AFFECTED CHILD F OR EACH NEGLIGENT VI OLATION; 15
AND 16
(2) $7,500 PER AFFECTED CHILD F OR EACH INTENTIONAL 17
VIOLATION. 18
(C) THE DIVISION SHALL PAY ALL FINES , PENALTIES, AND EXPENSES 19
COLLECTED BY THE DIVISION UNDER THIS S UBSECTION INTO THE GENERAL FUND 20
WITH THE INTENT THAT FINES, PENALTIES, AND EXPENSES BE USED TO FULLY 21
OFFSET ANY COSTS INC URRED BY THE DIVISION IN CONNECTIO N WITH THIS 22
SUBTITLE. 23
14–4609. 24
(A) IF A COVERED ENTITY I S IN SUBSTANTIAL COM PLIANCE WITH THE 25
REQUIREMENTS OF §§ 14–4604 THROUGH 14–4606 OF THIS SUBTITLE , THE 26
DIVISION SHALL PROVID E WRITTEN NOTICE TO THE COVERED ENTITY B EFORE 27
FILING AN ACTION UND ER § 14–4608 OF THIS SUBTITLE. 28
(B) NOTICE GIVEN UNDER SU BSECTION (A) OF THIS SECTION SHAL L 29
IDENTIFY THE SPECIFI C PROVISIONS OF THIS SUBTITLE THAT THE DIVISION 30
ALLEGES HAVE BEEN OR ARE BEING VIOLATED . 31 22 SENATE BILL 571
(C) A COVERED ENTITY MAY N OT BE LIABLE FOR A C IVIL PENALTY FOR A 1
VIOLATION FOR WHICH NOTICE IS GIVE N UNDER SUBSECTION (A) OF THIS SECTION 2
IF THE COVERED ENTIT Y: 3
(1) HAS COMPLETED A DATA PROTECTION IMPACT AS SESSMENT 4
UNDER § 14–4604(A)(2) OF THIS SUBTITLE FOR EXISTING ONLINE PROD UCTS THAT 5
ARE REASONABLY LIKEL Y TO BE ACCESSED BY CHILDREN; 6
(2) HAS COMPLETED A DATA PROTECTION IMPACT AS SESSMENT 7
UNDER § 14–4604(A)(3) OF THIS SUBTITLE PRI OR TO OFFERING TO TH E PUBLIC A 8
NEW ONLINE PRODUCT T HAT IS REASONABLY LI KELY TO BE ACCESSED BY 9
CHILDREN; 10
(3) CURES THE VIOLATION S PECIFIED IN THE DIVISION’S NOTICE 11
WITHIN 90 DAYS AFTER ISSUANCE OF THE NOTICE UNDER SUBSECTION (A) OF THIS 12
SECTION; 13
(4) PROVIDES THE DIVISION WITH A WRITT EN STATEMENT THAT TH E 14
ALLEGED VIOLATION HA S BEEN CURED; AND 15
(5) TAKES MEASURES TO PRE VENT ANY FUTURE VIOL ATION THAT 16
THE DIVISION AGREED TO BE SUFFICIENT. 17
14–4610. 18
NOTHING IN THIS SUBTI TLE MAY BE INTERPRET ED OR CONSTRUED TO : 19
(1) PROVIDE A PRIVATE RIG HT OF ACTION UNDER T HIS SUBTITLE OR 20
ANY OTHER LAW ; 21
(2) IMPOSE LIABILITY IN A MANNER THAT IS INCON SISTENT WITH 47 22
U.S.C. § 230; 23
(3) PREVENT OR PRECLUDE A CHILD FROM DELIBERAT ELY OR 24
INDEPENDENTLY SEARCH ING FOR OR SPECIFICA LLY REQUESTING CONTE NT; OR 25
(4) REQUIRE A COVERED ENT ITY TO IMPLEMENT AN AGE–GATING 26
REQUIREMENT . 27
14–4611. 28
NOTWITHSTANDING ANY O THER LAW , A DATA PROTECTION IM PACT 29 SENATE BILL 571 23
ASSESSMENT IS PROTEC TED AS CONFIDENTIAL AND SHALL BE EXEMPT FROM 1
PUBLIC DISCLOSURE , INCLUDING UNDER THE MARYLAND PUBLIC INFORMATION 2
ACT. 3
14–4612. 4
THIS SUBTITLE MAY BE CITED AS THE MARYLAND AGE–APPROPRIATE 5
DESIGN CODE ACT. 6
SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect 7
October 1, 2024. 8