Maryland restricts default profiling of under-18 users
Does Maryland's Kids Code change how I email minors?
In one sentence
In Maryland, default ad-style profiling of known under-18s is restricted — fix age capture and suppress abuse, do not panic-wipe every family account.
Emailrules interpretation
If you know a Maryland resident is under 18, do not run default targeted profiling the way adult ad systems do. Capture age carefully, suppress high-risk marketing use, and involve privacy/legal for edge cases. Blanket deleting every household with a teen is usually over-reaction; ignoring known minors is under-reaction.
Why it matters. Kids-and-ads rules are political and litigious. Email teams get pulled in when CRM holds age flags.
Dotted words open definitions. See how email actually works.
What to do
Your move — not a lecture
This one needs you
No platform does this for you. One concrete move, then you are done.
store what you send them; they do not decide Maryland age duty of care.
Your part: Age signals, default profile configuration, and marketing suppression rules for minors.
What to do first
Find every field that could mark a profile under 18. Confirm marketing journeys cannot target that segment for behavioural advertising use cases.
You can skip this if: You have no under-18 users and no reason to know of any.
Who this applies to
Brands with Maryland users under 18, youth products, or age-gated experiences that feed email profiles.
Checklist
- 01Inventory age collection points (checkout, account, quizzes).
- 02Default minors out of advertising profiling and non-essential tracking.
- 03Keep essential service messages in a separate, justified path.
- 04Watch litigation updates; youth privacy statutes move.
That’s enough to act. The exact wording, the enforcement record and every primary source sit under Proof & sources, for counsel, bosses, or AI tools that need a citation. Not legal advice.
Proof
Exact position, enforcement, sources
For records and people who will check you. Skip if Monday’s move is already clear.
Source fact
Maryland's age-appropriate design / kids privacy rules restrict default profiling and certain data practices for users the business knows or should know are under 18. For lifecycle email, the practical duties are: do not build minor profiles for advertising by default, know how age is collected, and do not assume "segments" are outside scope. Exact application of every campaign type remains fact-specific; this is not a general ban on to households that include minors.
What happens if you do not
State AG enforcement risk; details evolve with litigation. Do not invent per-email fine figures without a primary order.
Sources
- Maryland Age-Appropriate Design Code Act, Md. Code Com. Law § 14-4601 et seq.Published 1 Oct 2024Read primary source
- Maryland General Assembly, HB 603 (2024), Chapter 461 as enactedPublished 9 May 2024Read primary source
History of this page
- Correction: this page cited the Attorney General's homepage under a name that described "materials as published" rather than naming a document. Replaced with the statute itself, Md. Code Com. Law § 14-4601 et seq., and the enacted chapter text of HB 603, both dated. A citation has to land on the thing it cites.
- Added with narrow email interpretation; not a blanket household email ban.
Related
Take this with you
GET https://emailrules.today/rules/maryland-restricts-default-profiling-of-minors?format=json
Same URL, same answer, every field including the ones behind the Proof tab. An Accept: application/json header on the plain URL does the same thing. All the endpoints.