In just a few days, on October 1, 2024, Maryland’s new Kid’s Code (also known as the Maryland Age-Appropriate Design Act) will go into effect.

What is the Maryland Kid’s Code?

The Maryland Kid’s Code, signed into law this past May, draws inspiration from the UK and California Age Appropriate Design Codes and aims to enhance the online safety of minors. This Act defines children as individuals under the age of 18 and outlines specific protections and responsibilities for businesses offering online products or services.

Does the Kid’s Code Apply to Your Business?

The Kid’s Code applies to any “covered entity” that offers online products or services reasonably likely to be accessed by children.

A covered entity is defined as a for-profit business that meets any of the following criteria:

1. Has annual gross revenue exceeding $25 million.
2. Annually buys, receives, sells, or shares personal data of 50,000 or more Maryland residents, households, or devices.
3. Derives at least 50% of its revenue from the sale of personal data.

The Act defines “online product” as any online service, product, or feature—excluding telecom or broadband services and online retailers. While likely intended to target social media platforms, this broad definition likely encompasses most online video games, video games with online features and video game websites.

How to Determine if A Product is “Reasonably Likely to Be Accessed by Children”

To assess whether an online product falls under the Kid’s Code, the Act provides several considerations:

1. Is the product specifically directed at children, as defined in the federal Children’s Online Privacy Protection Act (COPPA)?
2. Is the product frequently accessed by a significant number of children, as shown by reliable audience data?
3. Is the product similar to another product that is routinely accessed by children?
4. Does the product display advertisements targeting children?
5. Does the company’s own research indicate that a significant portion of the audience is composed of children?
6. Does the company know or should they know that its product is being used by children?

Given that the Act defines children as anyone under 18, most video game websites and video games meeting the criteria of an “online product” will be considered “reasonably likely to be accessed by children”.

What Are the Obligations Under the Kid’s Code?

If a business falls under the scope of the Kid’s Code, it must:

• Design and develop online products with the best interests of children in mind.
• Prioritize children’s privacy, safety, and well-being.
• Process children’s data in a way that serves their best interests.
• Adhere to the principle of data minimization, collecting only what is necessary.
• Set default privacy settings that provide a high level of privacy.
• Conduct a Data Protection Impact Assessment (DPIA) for any new service, product or feature reasonably likely to be accessed by children.
• Provide privacy notices, policies, and terms written in simple, child-friendly language.

Penalties for Non-Compliance

Failure to comply with the Kid’s Code could result in:

• Fines of $2,500 per affected child for negligent violations.
• Fines of up to $7,500 per affected child for intentional violations.