MD HB908

Commercial entities that knowingly distribute sexual material harmful to minors online must implement age verification methods (government ID, transactional data verification, or digital identification) when more than one-third of their website content is such material

Entities performing age verification are prohibited from retaining any identifying information about users after access has been granted or denied

Parents or legal guardians may sue commercial entities that fail to verify age, and any person may sue for improper retention of identifying information, with courts authorized to award damages, attorney's fees, and costs

Internet service providers, search engines, and cloud service providers are exempt from liability when merely providing access to content they did not create

News organizations and their employees are exempt from the requirements; effective date is October 1, 2026