Maryland Kids Code Signed Into Law, But May Face Legal Challenges

On Thursday, May 9, advocates for child online safety legislation celebrated Maryland Governor Wes Moore signing the Kids Code into law despite lobbying from big tech trade groups.

The Kids Code was introduced by Maryland Delegates Jared Solomon (D-18) and Chair C.T. Wilson (D-26), along with State Senators Benjamin Kramer (D-19) and Chris West (R-42). It passed unanimously out of the General Assembly on April 6 alongside the Maryland Online Data Privacy Act, which would also restrict how tech companies collect and use consumers’ personal data. Modeled after California’s Age Appropriate Design Code (AADC), Maryland is only the second state to enact such legislation. Other states, including Hawaii, New Mexico, and Minnesota, have considered a similar approach to child online safety laws.

The Maryland Age Appropriate Design Code (HB 603/SB 571), or the Kids Code, requires online service providers to complete a data protection impact assessment (DPIA) if their products are “reasonably likely” to be accessed by children, implement monitoring practices for guardians, and prohibit certain data collection practices that might be harmful to children. Companies could face fines up to $2,500 per child for each negligent violation and $7,500 per child for each intentional violation. The Kids Code will go into effect on October 1, 2024, but companies will have an additional year to comply with the Online Data Privacy Act.

At a Wednesday press briefing hosted by the Maryland Kids Code Coalition, which includes groups like Fairplay, 5Rights Foundation, and Accountable Tech, some of the bill’s sponsors criticized the tech industry for failing to cooperate with lawmakers’ efforts to protect children online. “They came to the table at the bill hearings and said, leave it to us, we’re going to deal with it, we do not need the government stepping into this space,” said Maryland Sen. Kramer. “But the fact of the matter is leaving the fox to guard the chicken coop has left Big Tech fat and greedy, because they have prioritized cash over our kids.”

Chair Wilson invited the tech industry to join Maryland lawmakers in better protecting the needs of children and parents. “When you see the tech industry push back, sometimes I feel like we're dealing with children that just don't want to be told what to do, even if it's the right thing,” he said. “Protecting our children is the right thing.”

The Maryland Kids Code will likely face legal challenges. NetChoice, a tech trade association that represents Google, Meta, and TikTok, among others, sued the California Attorney General in December 2022 over the constitutionality of the state’s Age Appropriate Design Code. The suit (NetChoice v. Bonta) argues that the law is “a content-based restriction on speech” styled as “a privacy regulation to protect minors” that would deprive NetChoice’s members of their First Amendment rights.

On Sept. 18, 2023, a District Court judge blocked California’s Age Appropriate Design Code, concluding that NetChoice demonstrated a likelihood of success in proving it is “facially unconstitutional” and would violate the First Amendment, and that such “speech restrictions” would fail strict or even lesser scrutiny.

Maryland’s Attorney General joined a coalition of 19 states and Washington, DC in filing an amicus brief in the NetChoice case. The states argued that the court’s “over broad” application of general free-speech principles ignores relevant First Amendment doctrine and could “strangle” good-faith state efforts to regulate internet practices if widely adopted, among other claims. It asked the court to reverse the injunction, which the Ninth Circuit will review as early as this summer.

With this in mind, the architects of the Maryland bill “optimized the framework” to make clear that the Kids Code is about compelling tech companies to comply with the privacy by default and safety by design approach, not about policing content or shutting off access to entire platforms, said Meetali Jain, director of the Tech Law Justice Project, at the press briefing.

“The Maryland Kids Code uses a constitutional scalpel, not a blunt ax, to create a legally sound and effective piece of regulation,” said Jain. One of the major ways it does so is by first recognizing that kids are a critical consumer base for these platforms, and then tying the Codes’ provisions to consumer protection statutes for its enforcement and implementation, she explained.

For these reasons, some believe it will be more difficult for groups like NetChoice to make the arguments it did against California’s law. “The California Age Appropriate Design Code used words like content, and so they [NetChoice] were like, okay, this is a bill about content. It's restricting content, it talks about harmful content,” said Bailey Sanchez, senior counsel of US Legislation at the Future of Privacy Forum. The potential issues for Maryland’s Kids Code, according to Sanchez, may come down to whether age verification is implied (Maryland removed express age estimation mandates from its Code) or if companies are allowed to store a child’s data when they aren’t “actively or knowingly engaged.” (FPF published a useful side-by-side chart comparing California and Maryland’s respective design codes.)

Others aren’t worried about the threat of legal action. “If there's anything worth defending, it would be the right to take care of our children. So I'm more than happy to take on any lawsuit,” Chair Wilson said. He also believes that most Marylanders are “one hundred percent” behind the law. “It really comes down to stepping up with your chest and doing the right thing,” he added.

Such confidence has drawn criticism by opponents of these bills. At the International Association of Privacy Professionals’ four-day Global Privacy Summit in April, Caleb Williamson, state policy counsel at the trade group ACT | The App Association, expressed concern for states’ willingness to pass laws without fear of litigation. “If it is a genuine attempt to truly protect kids online, it begs the question of, should I throw something at the wall and see what sticks?” Williamson said. “It seems like the courts are saying, ‘Listen, you can't really do this.’ But the states are saying, ‘You know what, we're going to keep trying, and we're not going to stop.’ I am a little weary about that.”

Part of the division among stakeholders at least partly stems from the questions under consideration, according to Sanchez. “There’s a lot of active questions about where should teens exist online? Should they get to talk to strangers online?” she said. “It’s a lot of existential societal questions rather than data governance questions.”

While Maryland's Kids Code adopted the general framework of California’s Design Code, it was also purposefully built to better withstand constitutional scrutiny. Only time will tell, however, whether this new model can withstand its critics in the courts.

Related Reading:

• Evaluating the Argument Over the California Age Appropriate Design Code Act
• 2024 Set To Be Crucial Year For Child Online Safety Litigation
• Addictive Technologies Conference Tackles Social Media’s Impact On Children, Online Safety