Maryland’s AI Toy Safety Act: State-Level Regulation Fills the Federal Void on AI in Children’s Products

Maryland’s AI Toy Safety Act: State-Level Regulation Fills the Federal Void on AI in Children’s Products

Maryland’s AI Toy Safety Act: State-Level Regulation Fills the Federal Void on AI in Children’s Products

https://www.crowell.com/en/insights/client-alerts/marylands-ai-toy-safety-act-state-level-regulation-fills-the-federal-void-on-ai-in-childrens-products

Publish Date: 2026-03-10 17:23:00

Source Domain: www.crowell.com

On February 12, 2026, a bipartisan group of legislators in Maryland proposed the Maryland Artificial Intelligence Toy Safety Act. This proposed legislation would amend the Maryland Consumer Protection Act to establish a sweeping regulatory framework for AI-enabled toys sold in the state, covering any device that uses machine learning, conversational AI, behavioral modeling, or similar computational processes and is marketed to or primarily used by children. This proposed legislation adds to a growing trend of increasing efforts, at both the federal and state levels, to regulate the use of AI in products and services used by children.  

The proposed act’s scope is intentionally broad, and would introduce pre-market compliance obligations requiring manufacturers to conduct child safety assessments before bringing new AI toys to Maryland consumers. Manufacturers of toys already on the market as of July 1, 2026, would be given until January 1, 2027, to complete their initial assessments. Violations of the act would be classified as unfair, abusive, or deceptive trade practices under the Maryland Consumer Protection Act, exposing non-compliant manufacturers to civil penalties of up to $50,000 per violation and mandatory product recalls.

The act would impose substantial data privacy requirements as well. Manufacturers would be limited to collecting only the minimum child user data necessary for core toy functionality, and all such data must be encrypted. The act flatly prohibits selling or transferring child user data to third parties, using it to train unrelated AI models, targeting children with advertising based on that data, or retaining it for more than 12 months without renewed parental consent. In the event of a data breach, manufacturers must notify affected parents or guardians within 48 hours of discovery, a tight notification window that underscores the legislature’s prioritization of child data security.

Toys containing AI would be required to include…

Source