In forceLegalIn force 1 Oct 2024

Maryland restricts default profiling of under-18 users

Does Maryland's Kids Code change how I email minors?

In one sentence

In Maryland, default ad-style profiling of known under-18s is restricted — fix age capture and suppress abuse, do not panic-wipe every family account.

Plain English

If you know a Maryland resident is under 18, do not run default targeted profiling the way adult ad systems do. Capture age carefully, suppress high-risk marketing use, and involve privacy/legal for edge cases. Blanket deleting every household with a teen is usually over-reaction; ignoring known minors is under-reaction.

Why it matters. Kids-and-ads rules are political and litigious. Email teams get pulled in when CRM holds age flags.

Dotted words open definitions. Full glossary.

What to do

Your move — not a lecture

This one needs you

No platform does this for you. One concrete move, then you are done.

store what you send them; they do not decide Maryland age duty of care.

Your part: Age signals, default profile configuration, and marketing suppression rules for minors.

What to do first

Find every field that could mark a profile under 18. Confirm marketing journeys cannot target that segment for behavioural advertising use cases.

You can skip this if: You have no under-18 users and no reason to know of any.

Who this applies to

Brands with Maryland users under 18, youth products, or age-gated experiences that feed email profiles.

Checklist

01Inventory age collection points (checkout, account, quizzes).
02Default minors out of advertising profiling and non-essential tracking.
03Keep essential service messages in a separate, justified path.
04Watch litigation updates; youth privacy statutes move.

That’s enough to act. Sources and exact wording are below for counsel, bosses, or AI tools that need a citation. Not legal advice.

Proof

Exact position, enforcement, sources

For records and people who will check you. Skip if Monday’s move is already clear.

The exact position

Maryland's age-appropriate design / kids privacy rules restrict default profiling and certain data practices for users the business knows or should know are under 18. For lifecycle email, the practical duties are: do not build minor profiles for advertising by default, know how age is collected, and do not assume "segments" are outside scope. Exact application of every campaign type remains fact-specific; this is not a general ban on to households that include minors.

What happens if you do not

State AG enforcement risk; details evolve with litigation. Do not invent per-email fine figures without a primary order.

Source

Maryland Age-Appropriate Design Code / youth privacy materials (state legislature and AG guidance as published)
No publisher dateRead primary source

California GPC opts out of sale and sharing, not marketing emailIn force

History of this page

2 Aug 2026Added with narrow email interpretation; not a blanket household email ban.

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.