Maryland § 14-4806

§ 14-4806.

    (a)    A covered entity that provides an online product that is accessed or reasonably likely to be accessed by children may not:

        (1)    Process the personal data of a child in a way that is inconsistent with the best interests of children reasonably likely to access the online product;

        (2)    Profile a child by default, unless:

            (i)    The covered entity can demonstrate that the covered entity has appropriate safeguards in place to ensure that profiling is consistent with the best interests of children who access or are reasonably likely to access the online product; and

            (ii)    1.    Profiling is necessary to provide the requested online product, and is done only with respect to the aspects of the online product that the child is actively and knowingly engaged with; or

                2.    The covered entity can demonstrate a compelling reason that profiling is in the best interests of children;

        (3)    Process personal data of a child that is not reasonably necessary to provide an online product that the child is actively and knowingly engaged with;

        (4)    Process the personal data of a child end user for any reason other than a reason for which that personal data was collected;

        (5)    Process any precise geolocation data of a child by default, unless:

            (i)    The collection of the precise geolocation data is strictly necessary for the covered entity to provide the online product; and

            (ii)    The precise geolocation data is processed only for the limited time that is necessary to provide the online product;

        (6)    Process any precise geolocation data of a child without providing an obvious signal to the child for the duration that the precise geolocation data is being collected;

        (7)    Use dark patterns to:

            (i)    Cause a child to provide personal data beyond what is reasonably expected to provide the online product;

            (ii)    Circumvent privacy protections; or

            (iii)    Take any action that the covered entity knows, or has reason to know, is not in the best interests of children who access or are reasonably likely to access the online product;

        (8)    Process any personal data for the purpose of estimating the age of a child that is actively and knowingly engaged with an online product that is not reasonably necessary to provide the online product; or

        (9)    Allow a person other than a child’s parent or guardian to monitor the child’s online activity without first notifying the child and the child’s parent or guardian.

    (b)    A covered entity that provides an online product that is accessed or reasonably likely to be accessed by children may allow a child’s parent or guardian to monitor the child’s online activity or track the child’s location, without providing an obvious signal to the child when the child is being monitored or tracked.

    (c)    In making a determination as to whether an online product is reasonably likely to be accessed by children, a covered entity may not collect or process any personal data beyond what is reasonably necessary to make the determination.