United States of America: Adopted Maryland Kids Code for Data Protection of Children's Online Data (SB0571)

On 4 April 2024, the Senate adopted the Consumer Protection - Online Products and Services - Data of Children (Maryland Kids Code) Act. The Act mandates that any entity in scope offering an online product likely to be accessed by children must complete a data protection impact assessment by 1 April 2026. Entities in scope include limited liability companies, corporations, associations, or other legal entities that are operated for shareholders' profit, collect customers' personal information, and either have an annual gross revenue of USD 25 million, get in contact with personal information with at least 50'000 customers a year, or derive minimum 50% of its annual revenue from the sale of customer data. The mandatory data protection impact assessment should identify the purpose of the online product, how the online product uses children's data, and determine whether the online product is designed in the best interest of the child. Entities violating the bill's requirements may face civil penalties of USD 2'500 per affected child for each negligent violation and USD 7'500 per affected child for each intentional violation.