Maryland governor signs online data privacy bills

ANNAPOLIS, Md. -- Maryland Gov. Wes Moore signed two measures into law on Thursday that are aimed at better protecting personal data online from Big Tech, including a bill making Maryland the second state to try to create strong limits on information collected on children.

The measure, known as the Maryland Kids Code, seeks to limit data that could be collected from children online and protect them from being flooded with harmful material they were not trying to find.

“Look, the bottom line is Big Tech has been preying on and victimizing our children for way, way too long,” said state Sen. Ben Kramer, a Democrat in the suburbs of the nation's capital.

Big Tech companies sought to assure lawmakers that the industry could take care of problem without interference from the government, Kramer noted. “But the fact of the matter is, leaving the fox to guard the chicken coop has left Big Tech fat and greedy, because they have prioritized cash over our kids,” the senator said.

Supporters say the new law aimed at protecting children was crafted to withstand court challenges like one that halted a California law. For example, the measure incorporates case law and established consumer protection law, supporters said.

Carl Szabo, vice president and general counsel of NetChoice, said the group shares lawmakers’ desire to better protect children online. “But this goal can be achieved in ways that don’t violate the Constitution and leave a litany of serious, unintended consequences in their wake,” he said.

NetChoice is a commercial association whose members include Google, Amazon, Meta and TikTok. It challenged the California law.

“Unfortunately, the law Gov. Moore signed today will fail to accomplish its goal — creating a safer online environment for young Marylanders. An unconstitutional law will not keep anyone safe. By discounting the rights and privacy of their citizens, Maryland lawmakers have unfortunately signed onto a path that will make everyone worse off — especially children,” Szabo said in an email.

Under the law, businesses would not be able to profile a child by default, with some limited exceptions, or process personal data that is not reasonably necessary to provide an online product with which the child is actively and knowingly engaged.

Del. Jared Solomon, a bill sponsor, said lawmakers were careful to make sure the measure is not meant to moderate available content. He said protective language was added to ensure a child could not be prevented from searching for content online.

“If you want to go and you want to look for things that you probably shouldn't be looking at, we are not scrubbing that from the internet,” Solomon, a Montgomery Democrat, said. “But what we are saying to companies is you should not be essentially be accumulating data on somebody and making assumptions that that is the content that they want to see.”

Design It For Us, a coalition advocating for safer social media and online platforms for children, praised the new law.

“We hope this will bring urgency to other states to pass and adopt much needed Kids Code legislation and end Big Tech’s power over our safety and privacy,” said Zamaan Qureshi, a co-chair of the group.

The governor, a Democrat, also signed the Maryland Online Data Privacy Act of 2024.

The new law will impose certain duties on businesses to protect an individual’s personal information. For example, a business in possession of personal information will be required to implement and maintain security procedures and practices to protect the information from unauthorized access, use, modification or disclosure.

“It puts guardrails up on the amount of data that companies can collect on people online and also what they do with that data, and it gives consumers more control over their own data,” said Del. Sara Love, a Montgomery County Democrat who sponsored the measure.

The new law also will create consumer protections and rights, as well as disclosure obligations, relating to online personal data controlled or processed by certain entities that conduct business in Maryland or provide services or products that are targeted to residents of the state.

A consumer also will have the right to opt out of the processing of personal data for the purposes of targeted advertising, the sale of personal data and certain profiling activities.