Maryland is one of two states, with California, to pass a so-called Kids Code law — legislation aimed at providing privacy and other protections to children using online platforms.
But a federal appeals court’s decision this month to uphold much of a lower court’s injunction of the California law – on which Maryland’s law is based – is raising new fears about the vulnerability of the Maryland law to court challenge.
“There’s definitely, for those of us who are constantly looking at the legality of these provisions, there are some open questions,” said Meetali Jain, director of the Tech Justice Law Project — an organization that has supported the passage of Kids Code laws.
The Aug. 16 ruling by a three-judge panel of the 9th U.S. Circuit Court of Appeals held some positives for Kids Code supporters: It said a lower court may have gone too far when it issued a preliminary injunction on First Amendment grounds.
But the appellate court largely agreed with the lower court that tech firms were likely to succeed on their claim that the law violates free speech protections, by requiring them to review products they believe would be used by children looking for content that could be harmful. Those portions of the California Age-Appropriate Design Code Act amount to a restraint on speech, the court said.
That was the claim made by NetChoice, a tech industry group that has aggressively opposed state efforts to impose regulations. The group has lobbyists in more than two dozen states. The effort in Maryland is in addition to lobbyists hired by individual members including Google, Facebook parent company Meta, and Amazon.
Maryland passed its Kids Code law this year, and advocates consider it an evolved, upgraded version of the California law.
“I think a lot of people believe that the district court in California got it wrong, but just because they got it wrong doesn’t mean that folks can’t try and strengthen the bill against a legal attack in Maryland,” said Nichole Rocha, a California-based data privacy rights attorney who worked on both the California and Maryland laws. “So absolutely, there was a lot of consideration given to amendments to make it legally stronger.”
A similar bill passed this year in Vermont, but Gov. Phil Scott (R) vetoed it and lawmakers there were unable to override his veto.
The Maryland bills — House Bill 603 and Senate Bill 571 — were signed into law in May and take effect in October. It will require default privacy settings and safety measures for children. The law limits the collection of data, including geolocation data, from minors by social media and other companies, as well as the sale of that data. And it requires that companies complete assessments in 2026 of new features, focusing on the effects on children.
Negligent violations of the law are punishable by a fine of $2,500 per child per instance, while intentional violations carry a fine of $7,500 per child per instance.
Attorney General Anthony Brown, in a letter to Moore, said that while the law was “not clearly unconstitutional,” there are “potential constitutional issues” within the act.
Key among them were the state’s data privacy provisions. Brown wrote that there is risk that “a reviewing court will construe some of the Maryland Act’s provisions … to regulate speech or other expressive conduct, and as such, subject them to heightened scrutiny under the First Amendment and find those provisions unconstitutional.”
But Brown concluded that any individual provisions struck down by the court could be severed from the rest of the law.
So far, there has been no legal challenge.
Rocha said she and others believe NetChoice could be biding its time in Maryland while awaiting a final decision on the California law.
“They’re just waiting to see what happens so they can position themselves,” Rocha said.
A spokesperson for NetChoice said the group does not publicly discuss legal strategy.
Del. Jared Solomon (D-Montgomery), who sponsored the House version of the bill, said in May that he was confident the Maryland law would be the first to withstand judicial scrutiny. Solomon did not respond to a request for comment on the impact of the California ruling.
A key change in the Maryland law is language making it clear that there is no intent to censor content or limiting access to content, Rocha said. Additionally, Maryland more clearly defines “best interest of the child” and includes physical, financial and psychological harm.
And advocates point out that Maryland included language that prevents the entire law from being struck down if a court finds one or more provisions are unconstitutional.
California passed its version in 2022. NetChoice – whose members include Amazon, Google, Meta, Netflix and X – sued in federal district court on Dec. 14, 2022, and it asked for a preliminary injunction of the law on Feb. 17, 2023.
The district court agreed with NetChoice, temporarily blocking the law on Sept. 18, 2023, sparking the appeal to the 9th Circuit.
The appeals court ruling was, in some ways, a setback for supporters of the California law. In a 44-page decision handed down on Aug. 16, a three-judge panel agreed that a required data protection impact assessment in California law violated the First Amendment.
The assessment’s requirement that “covered businesses opine on and mitigate the risk that children may be exposed to harmful or potentially harmful materials online … facially violates the First Amendment,” the court panel said.
The appellate court remanded the case back to the lower court for additional review. In the opinion, the panel said it was “unclear,” based on the initial court review, if other challenged provisions of the California law “violated the First Amendment.”
The lack of litigation against the Maryland law so far does not mean it is in the clear.
Jain said the appeals court ruling in the California case leaves four open constitutional questions: Are data privacy protections and design safeguards constitutional; can the rest of the law stand if the court finds data privacy impact assessments unconstitutional; can social media platforms be required to verify or estimate the age of a user; and are duty of care provisions constitutional?
The Maryland law goes into effect in October. A legal challenge could still come when Maryland implements the law.
“Maryland’s law is very similar to (the California law), especially the Data Protection Impact Assessment provision, which the Ninth Circuit focused on as likely unconstitutional under strict scrutiny. That is an even higher standard than the District Court reviewed it under,” Krista Chavez, a spokesperson for NetChoice, wrote in an email response to questions.
