Law / United States / 
Maryland
HB 603 / SB 571, Maryland Age-Appropriate Design Code Act (Kids Code)
Md. Code, Com. Law §§ 14-4801 to 14-4813 (Subtitle 48), 2024 Md. Laws ch. 461
In force since , under challenge in court.
An age-appropriate design code rule binding private bodies.
- Age threshold
- 18
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Kept, Produced on request
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- Applies to online products reasonably likely to be accessed by children under 18.
- Set high default privacy settings.NIST Privacy FrameworkGV.PO-P2
- Complete data protection impact assessments.NIST Privacy FrameworkID.RA-P4
- Avoid data practices harmful to children.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: NetChoice v. Brown, No. RDB-25-0322 (D. Md. ) (recorded ).
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Civil penalties up to $2,500 per affected child for each negligent violation and $7,500 per affected child for each intentional violation, with a 90 day cure period.
Who enforces it
Enforcement body
Maryland Division of Consumer Protection, Office of the Attorney General.
Litigation
- Court
- U.S. District Court for the District of Maryland
- Docket
- NetChoice v. Brown, No. RDB-25-0322
- Posture
- Motion to dismiss denied ; NetChoice's motion for leave to file a second amended complaint adding a dormant Commerce Clause claim was filed and granted ; case proceeding in district court, no injunction in place as of the order.
Settledness
The court's ruling found NetChoice's claims plausible, made no determination of their merits, and left the Kids Code in effect pending the litigation.
- As of
- Case link
- https://www.govinfo.gov/content/pkg/USCOURTS-mdd-1_25-cv-00322/pdf/USCOURTS-mdd-1_25-cv-00322-0.pdf
- Case citation
- NetChoice v. Brown, No. RDB-25-0322 (D. Md. )
- Under challenge
- Yes
- Open questions
- How does a covered entity count a "significant number of children" under Commercial Law section 14-4801(s)(2), by share of the audience or by number of child users?
- When is an online product "substantially similar or the same as" a product that satisfies Commercial Law section 14-4801(s)(2), under section 14-4801(s)(3)?
What it makes you log
Who may demand the log
Regulator
Log retention
Section 14-4806(a)(8) bars that processing, and the definition of process in section 14-4801(p) includes storing. Separately, section 14-4805(1) requires documentation of each assessment to be kept for as long as the online product is likely to be accessed by children, which states no fixed period.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Personal data processed to estimate the age of a child that is actively and knowingly engaged with an online product, where the processing is not reasonably necessary to provide the online product
Logging duty
Section 14-4804 requires a data protection impact assessment, and section 14-4805(1) requires the covered entity to maintain documentation of it. The subtitle uses the word documentation, not log, and requires no record of an age check; section 14-4806(a)(8) instead limits the personal data a covered entity may process to estimate a child's age. Section 14-4811 makes the assessment confidential.
- Kind
- Implicit
- As of
- Provision
- Md. Code, Com. Law § 14-4805(1)
- Trigger
- personal_data_processing
What this law does
Requires online products reasonably likely to be accessed by children under 18 to set high default privacy settings, complete data protection impact assessments, and avoid data practices harmful to children. A First Amendment and federal preemption challenge by NetChoice survived a motion to dismiss in November 2025 and is proceeding without an injunction.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .