United States of America: Signed Maryland Kids Code for Data Protection of Children's Online Data (SB0571)

On 9 May 2024, the Consumer Protection - Online Products and Services - Data of Children (Maryland Kids Code) Act was signed by the Governor of Maryland. The Act requires any entity in scope offering an online product likely to be accessed by children to complete a data protection impact assessment by 1 April 2026. Entities in scope include limited liability companies, corporations, associations, or other legal entities that are operated for shareholders' profit, collect customers' personal information, and either have an annual gross revenue of USD 25 million, get in contact with personal information with at least 50'000 customers a year, or derive minimum 50% of its annual revenue from the sale of customer data. The mandatory data protection impact assessment should identify the purpose of the online product, how the online product uses children's data, and determine whether the online product is designed in the best interest of the child. Entities violating the Act's requirements may face civil penalties of USD 2'500 per affected child for each negligent violation and USD 7'500 per affected child for each intentional violation.