Most people scroll through social media every day without thinking twice about the law. Seriously. But Maryland has passed some of the toughest social media laws in the entire country. If you live here, work here, or run a business that reaches Maryland users, you need to know what the rules are.
This article breaks it all down. We’ll cover privacy rights, kids’ protections, cyberbullying laws, and what happens when someone breaks the rules.
What Are Social Media Laws?
Social media laws are rules that control how platforms collect your data. They also define what counts as harmful online behavior. And they set limits on what companies can do with your personal information.
Maryland now has several major laws covering these areas. They protect everyday users, especially kids and teens. Pretty straightforward, right?
The Maryland Online Data Privacy Act (MODPA)
What It Is
The Maryland Online Data Privacy Act, called MODPA, is Maryland’s big privacy law. It took effect on October 1, 2025. Enforcement officially started on April 1, 2026. That’s right now.
This law is one of the toughest data privacy laws in the United States. Honestly, Maryland didn’t hold back.
What MODPA Does for You
Here’s where things get interesting.
MODPA gives you real control over your personal data. You have the right to know what data companies collect about you. You can ask them to delete it. You can tell them to stop selling it.
Companies must explain what data they collect and why. They have to tell you who they share it with. If you ask them to stop using your data for ads, they must stop within 30 days.
Not sure what “personal data” means? Think your name, email, location, health info, and browsing habits. Basically anything that can identify you.
Special Protections for Sensitive Data
Okay, pause. This part is really important.
Maryland banned the sale of sensitive data completely. No other state has gone this far. Even with your permission, companies cannot sell sensitive data.
What counts as sensitive data? It includes your health information, race and ethnicity, religion, precise location, biometric data like fingerprints, sexual orientation, and immigration status. It also covers data about any child under 18.
You’re not alone if you didn’t know companies were selling this information. Most people have no idea.
Who Does MODPA Apply To?
MODPA applies to companies that do business in Maryland or target Maryland residents. The company must also process the personal data of at least 35,000 Maryland consumers per year. Or it processes data on 10,000 consumers and makes more than 20% of its revenue from selling that data.
Social media platforms almost certainly qualify. So do many apps and websites you use every day.
The Maryland Kids Code
What Is the Kids Code?
The Maryland Kids Code is Maryland’s law to protect children online. It’s officially called the Age-Appropriate Design Code Act. It took effect on October 1, 2025.
This law came after years of research showing how harmful social media can be for young people. Some families in Maryland fought hard for this law after losing children to dangerous social media challenges.
Wondering if this applies to your favorite apps? If a platform is “reasonably likely to be accessed by children,” this law applies to it.
What Social Media Platforms Must Do
Hold on, this part is important.
Under the Kids Code, social media companies must use the strictest privacy settings by default for all users. They cannot collect data from minors without strong protections in place. They also cannot sell that data under any circumstances.
Platforms must also stop using tricks that keep kids hooked. That means no auto-playing videos designed to trap kids in a scroll loop. No constant notifications meant to pull kids back to the screen over and over again.
By April 1, 2026, companies must complete what’s called a Data Protection Impact Assessment. This is basically a report explaining how their platform affects children and what data they use. It’s a big deal.
What Counts as a Minor?
Under Maryland’s Kids Code, a minor is anyone under 18. This is broader than many other states. Some states only protect kids under 13 or 16. Maryland protects everyone under 18.
Think of it like an upgrade from the national standard. More protection, wider coverage.
Cyberbullying and Harassment Laws
Online Harassment Is a Crime
Maryland takes online harassment seriously. It’s not just bad behavior. It can be a criminal offense.
Under Maryland law, sending threatening messages online is illegal. Using social media to repeatedly harass someone is illegal too. This includes sending unwanted messages to intimidate or frighten someone.
Most people don’t realize how strict these laws are. You could face real criminal charges for behavior you thought was “just online.”
Misuse of Interactive Computer Service
Maryland has a specific law called Misuse of an Interactive Computer Service. This law covers using the internet, including social media, to harass, threaten, or intimidate someone.
A conviction under this law is a misdemeanor. You could face up to one year in jail. You could also pay a fine.
Less severe than a felony? Yes. But still no joke.
What About Cyberstalking?
Cyberstalking is following or monitoring someone online in a way that causes fear or emotional distress. Maryland’s stalking laws apply to online conduct too.
If someone uses social media to track your movements, monitor your posts, or make you fear for your safety, that’s potentially criminal. You can report it to police or the Maryland Attorney General’s office.
Penalties for Breaking These Laws
Penalties for Companies
Companies that violate MODPA or the Kids Code face serious consequences.
For a first violation, the penalty is up to $10,000. For repeat violations, it jumps to up to $25,000 per violation. The Maryland Attorney General enforces both laws.
Wait, it gets better. Companies also face what’s called a UDAP violation. That stands for Unfair, Deceptive, or Abusive Acts or Practices. A UDAP violation can add another $10,000 per violation, and $25,000 for repeat offenses. It can also mean a misdemeanor charge, a $1,000 fine, and up to one year in prison for the person responsible.
Can You Sue a Company Yourself?
Here’s the thing: no. MODPA has no private right of action. That means you cannot sue a company yourself for violating this law.
Only the Maryland Attorney General can take legal action under MODPA or the Kids Code. But you can file a complaint with the AG’s office and push for enforcement.
Penalties for Individual Users
If you harass or threaten someone online in Maryland, you face personal criminal liability. That means you could be arrested, charged, and convicted.
Penalties vary based on the specific charge. But online harassment and cyberstalking can result in jail time, fines, and a criminal record. Think of it like a serious traffic offense, but with much longer-lasting consequences.
Special Circumstances
What About Out-of-State Companies?
A company doesn’t have to be based in Maryland to follow these laws. If a company targets Maryland users or collects data from Maryland residents, it must comply.
That means Facebook, Instagram, TikTok, YouTube, and similar platforms all fall under these rules if they have significant Maryland users.
Is the Kids Code Being Challenged in Court?
Yes, actually. A tech industry group called NetChoice filed a lawsuit in February 2025 claiming the Kids Code violates the First Amendment. Their members include Meta, Google, Amazon, Snap, and X.
As of late 2025, a federal judge allowed the lawsuit to move forward. But the law is still in effect. Companies must still comply while the case continues.
Personally, I think protecting children from addictive design is worth the legal fight. But the courts will have the final say.
What If You’re a Small Business?
Small businesses often don’t have to worry about MODPA. The law has coverage thresholds. You need to process data on at least 35,000 Maryland consumers to be covered.
Most small local businesses won’t hit that number. But if you run an app, a content site, or an online service with lots of Maryland users, check carefully.
How to Protect Yourself
What You Can Do Right Now
You’re gonna want to do these things sooner rather than later.
First, review the privacy settings on every social media platform you use. Under MODPA, you now have the right to opt out of data sales and targeted advertising. Look for those settings and use them.
Second, if you have kids who use social media, check their account privacy settings. Platforms must now use the strongest privacy settings by default for minors. But it never hurts to double-check.
Third, if you’re being harassed online in Maryland, document everything. Screenshot the messages, note the dates, and report to the platform first. If it continues or involves threats, contact local law enforcement or the Maryland Attorney General’s office.
How to File a Complaint
If you believe a company has violated your data rights under MODPA or the Kids Code, you can file a complaint with the Maryland Attorney General’s Consumer Protection Division.
Visit the AG’s website at oag.state.md.us. You can file complaints online, by phone, or by mail. The AG has 60 days to notify the company of the violation before taking enforcement action.
Frequently Asked Questions
Does MODPA apply to me as an individual user? MODPA gives you rights as a consumer, but it places obligations on companies, not individuals. You can use it to request data deletion or opt out of data sales.
Can social media companies still show me ads? Yes, but they cannot use your sensitive data for targeted advertising. And if you opt out, they must stop using your personal data for ads within 30 days.
Does the Kids Code mean my child can’t use social media? No. The law doesn’t ban minors from using platforms. It requires platforms to use safer, more private settings for users under 18 by default.
What if someone is threatening me on social media? Contact local police if you feel physically threatened. You can also report to the Maryland Attorney General’s office for cyberstalking or harassment violations.
How do I know if a company is breaking the law? If a company refuses your data deletion request, sells your sensitive data, or doesn’t let you opt out of targeted advertising, that may be a violation. File a complaint with the Maryland AG’s office.
Final Thoughts
Maryland has passed some of the strongest social media laws in the country. The MODPA protects your personal data and gives you real control over how companies use your information. The Kids Code adds extra protections for anyone under 18.
These laws matter. They exist because real families pushed for change after real harm. Now you know what they do and how they protect you.
Stay aware of your rights. Check your privacy settings. And if something feels wrong, report it. Now you have the tools to do exactly that.
References
- Maryland Online Data Privacy Act (MODPA) – Maryland General Assembly
- Maryland Age-Appropriate Design Code (Kids Code) – HB 603/SB 571
- Maryland Office of the Attorney General – Consumer Protection
- Maryland Matters: Social Media Companies Sue Over Kids Code (February 2025)
- The Daily Record: Big Tech Lawsuit Over MD Kids Code Moves Forward (December 2025)
- Manatt Law: Maryland Law Raises Bar on Children’s Privacy (2025)
