Maryland School Internet Safety Laws: the Phone-Free Schools Act, Student Data and CIPA
Maryland's 2026 Phone-Free Schools Act does something few device laws do: it requires local policies that stop students reaching social media during the school day. That puts school-issued devices and their filters at the center.
This guide covers what CIPA requires, what Maryland adds, and how county school systems can show they are ready.
The academic school day
- Instructional periods, lunch and recess
- Passing and other transitional periods
- Structured and unstructured learning in between
Federal floorWhat CIPA requires of Maryland schools
The Children's Internet Protection Act applies to schools and libraries that take E-Rate discounts for internet access or internal connections. Maryland does not replace it, so every E-Rate school system starts here.
Filter
Blocks obscene, child pornography and harmful to minors visual content.
Policy
Covers inappropriate matter, messaging, hacking and personal information.
Meeting
Public notice and at least one public hearing or meeting.
Monitor
Monitoring of minors, without a duty to track named users.
Teach
Online behavior, social networking and cyberbullying lessons.
Certify
FCC Form 486, or Form 479 for consortium members.
For the full background, read what CIPA is, and for how certification connects to funding, see E-Rate and CIPA funding.
Make the Maryland school-day social media rule hold on the devices the school issues
The Phone-Free Schools Act leaves school-issued devices outside its device definition, so the filter is what carries the social media rule there. Our hosted CIPA filter is a DNS filter that we run, with a Social Networking switch for each school.
- The CIPA preset also blocks VPN/Proxy/Anonymizers, so proxy sites do not reopen the door
- A county can keep different settings for each school in one console
- Reports and a policy record help with the instructional use protocols due in 2027
State law, 2026What Maryland adds: the Phone-Free Schools Act
The Joanne C. Benson Maryland Phone-Free Schools Act was enacted as House Bill 525, cross-filed as Senate Bill 928. Reports say Governor Moore approved it on May 26, 2026, and it took effect July 1, 2026. The summary below follows the legislature's fiscal and policy note.
What each local policy must do
- Prohibit student use of electronic communication devices during the academic school day.
- Require students to store devices, in a way the local board decides.
- Prohibit students from accessing or using a social media platform during the school day.
- Require administrator approval for personal devices used for learning when a school-issued device is not available.
- Set tiered discipline, enforced by an administrator, without suspension or expulsion solely for a violation.
- Engage families and publicize the policy.
What a policy may not prohibit
- Device use for any purpose documented in a student's IEP or Section 504 Plan.
- Use to monitor or address a documented health issue.
- Language translation tools for multilingual students when school-issued devices are not available or not enough.
- Use for caregiving responsibilities, as approved by a principal.
ScopeWhich devices the Maryland law covers
The definition matters for filtering. The law aims at devices students bring, and it leaves out devices the school system provides for instruction.
| Device | Covered by the device rule? | What it means for filtering |
|---|---|---|
| Personal cell phone | Yes, stored during the school day | Off the network and out of reach, except for listed exceptions |
| Personal tablet or laptop | Yes | Learning use needs administrator approval if no school device is available |
| Smart watch, wireless earbuds or headphones | Yes | Rarely a filtering issue, but part of storage rules |
| Geolocation and other devices with communication functions | Yes | Covered by storage rules |
| School-issued device for instruction | No, excluded from the definition | Stays in use all day, so it carries the social media rule through your filter |
These categories come from the legislature's description of the bill as passed. Read the final enacted text and any MSDE regulations for the exact definitions your policy should use.
Filtering impactThe social media rule and your filter
A policy that prohibits social media during the school day needs a way to make that real on school-issued devices, which are excluded from the device rule. Category filtering is the most direct tool.
How the law describes social media
The fiscal note describes a social media platform as an internet-based application, website or service that lets users create, share or view content, or interact through profiles, feeds, messaging, comments or reactions, and that is mainly designed for social interaction or broad content sharing.
That is wide. It can reach video sharing, forums and some messaging services, not only the best-known networks. Your policy should say how the school system reads it.
1. Block Social Networking on student devices
Apply the category to school-issued devices for the school day, on and off the school network.
2. Decide on neighboring categories
Forums / Message Boards, Community Sites, Streaming Media and Email and Messaging may fit the law's wording. Decide each in writing.
3. Allow learning tools on purpose
Classroom platforms with comments or feeds may meet the definition. List approved tools so teachers are not caught out.
4. Close the bypass routes
Block VPN / Proxy / Anonymizers, or students will reach social media through proxy sites.
5. Schedule by time
The rule covers the school day. Some systems relax social categories after the last bell on take-home devices.
For category choices and grade band options, see social media filtering in schools. For take-home devices, see 1:1 device filtering.
Messaging, forum and classroom tools that may fit the law's social media wording
The guide suggests deciding each neighboring category in writing. These lookups show what our data lists for a few examples teachers and students use.
| Tool | Categories in our data |
|---|---|
| quora.com | Forums / Message Boards, Community Sites |
| messenger.com | Email and Messaging, Social Networking |
| slack.com | Email and Messaging |
| padlet.com | Education/Reference, Web-based Applications |
| nearpod.com | Education/Reference, Webinars/E-learning |
| stackoverflow.com | Developer Tools / Code Hosting, Education/Reference, Forums / Message Boards |
ReportingPhone-Free Schools Act dates to plan around
The law sets reporting duties for local boards and MSDE. These are the dates in the legislature's summary. Confirm them against the final text and MSDE regulations.
The law takes effect. MSDE adopts regulations to implement it.
Each local board submits its device policy to MSDE, with storage, security and discipline details, instructional use protocols, emergency communication plans and evidence of stakeholder engagement.
Local policies must be developed and in place.
MSDE publishes a report compiling each local board's submitted policy.
Each local board reports yearly on impacts, including enforcement data by student subgroup and the number and types of exemptions granted.
The September 2027 submission asks for "instructional use protocols". Your filter settings for school-issued devices are a natural part of that section, so document them now.
A school-issued device keeps the day's rules when it leaves the building
Maryland expects the social media rule to reach school devices on and off the network. In our hosted CIPA filter a private encrypted link keeps the same rules on laptops and phones away from the network, and nothing is installed on the computer.
Student dataMaryland laws on student data and online services
Filtering and monitoring tools handle data about named students. Maryland has its own student data law, and federal FERPA and COPPA apply alongside it.
Maryland Student Data Privacy Act
Sets duties for operators of online services used primarily for PreK-12 school purposes, including limits on targeted advertising and selling student data, and a duty to protect it.
Maryland Kids Code
An age-appropriate design law aimed at online products likely to be used by children. It places duties on platforms, not on school systems. Check its current status.
Vendor agreements
Sign data agreements with every filtering and monitoring vendor that limit use, set deletion and bar advertising use of student data.
Category filtering that blocks by site type needs very little personal data. For the federal side, see our guide to student data privacy, FERPA and filtering.
ConfigurationA filtering plan for Maryland school systems
We did not find a Maryland statute that sets its own filter category list. Combine the CIPA core with the social media rule and your board's local choices.
| Category | Basis | Suggested scope |
|---|---|---|
| Adult | CIPA core | All users, all devices, all hours |
| Lingerie/Swimsuits/Intimate Apparel | CIPA harmful to minors | Students |
| Social Networking | Phone-Free Schools Act social media rule | Students, school day |
| Forums / Message Boards, Community Sites | May meet the social media definition | Decide in policy |
| VPN / Proxy / Anonymizers | Keeps both rules effective | Students |
| Gambling, Weapons, Illegal Drugs | Local choice | Students |
| Violence, Hate/Discrimination | Local choice | By grade band, with a research path |
| AI / LLM Tools | Local choice | See the AI tools blocklist for schools |
Dots show the basis: navy for CIPA, teal for the state social media rule and bypass control, green for local choices. You can see how any site is classed with the domain category checker.
Real situationsCommon Maryland situations and how the rules settle them
Most questions arrive as a request from a teacher, a parent or a principal. The answer depends on whether the device rule, the social media rule or CIPA owns the decision.
A class platform has comments and feeds
It may fit the broad social media definition. Name approved learning platforms in your policy, so the block on social media does not stop planned lessons.
A student's 504 plan allows a phone
The law protects that use. On school Wi-Fi the phone is filtered like any device; on cellular data it is not, so the plan should define what the phone is for.
A multilingual student needs a translator
Policies may not block translation tools when school devices are not enough. Make sure translation sites are allowed on school-issued devices first.
Take-home device use at night
The social media rule covers the school day. Your board decides whether social categories stay blocked at home, and the policy should say which.
A parent asks why a site is blocked
Point to the category and the board decision. The domain category checker shows how a single site is classed.
A teacher needs a blocked site
CIPA lets an authorized person disable the filter for an adult doing bona fide research. For students, approve specific sites for a set time.
RolloutLining up the device policy and the filter before 2027-28
Device policy usually sits with student services, and filtering with the technology office. Running both on one plan avoids a policy that promises a social media block the filter does not deliver.
Now: inventory
List the categories blocked today on school-issued devices, and which learning platforms have social features.
Next term: pilot
Turn on the school-day social media block in a few schools, collect unblock requests and adjust the approved tool list.
Before adoption: align the words
Make the device policy, the internet safety policy and the acceptable use policy describe the same school day and the same social media scope.
By September 2027: document
Write the filter settings into the instructional use protocols that go to MSDE, with a configuration export as backup.
Our guide to the acceptable use policy for schools covers the student and staff rules that sit alongside the device policy.
ChecklistMaryland compliance checklist
Use this with our general CIPA compliance checklist. It groups the federal and state items by who usually owns them.
Local board
- Internet safety policy covers each CIPA topic
- Public notice and a hearing or meeting held
- Device policy drafted to the Phone-Free Schools Act
- Social media rule and its scope written down
- Tiered discipline without suspension solely for a violation
- Family engagement held and recorded
Technology office
- CIPA categories blocked on every student device and network
- Social Networking blocked on school-issued devices in the school day
- VPN, proxy and anonymizer services blocked
- Approved learning platforms allowed by name
- Take-home devices filtered off campus
- Configuration exported each term
Schools and central office
- Storage method in place in every school
- Exception process for IEP, 504, health, translation and caregiving
- Online safety lessons scheduled, including cyberbullying
- Data agreements signed with filtering vendors
- Policy ready for MSDE by September 1, 2027
- Form 486 or Form 479 filed each funding year
RecordsEvidence to keep
E-Rate rules require records to be kept for at least 10 years after the last date of service. The Phone-Free Schools Act adds its own reporting, so keep both sets in one folder per year.
Internet safety policy
Adopted text, date and board vote.
Meeting records
Notice and minutes of the public meeting.
Device policy
Final text, storage method and family outreach.
MSDE submission
The September 2027 package and later updates.
Filter exports
Category settings, including the social media block.
Exception log
Exemptions granted, needed for annual impact reports.
Lesson records
Online safety curriculum by grade band.
Form 486
Certification for each funding year.
Licence holders of our category data receive validation reports with the measured accuracy of the CIPA categories, which fit into the same evidence folder alongside configuration exports.
The Maryland five-step social media plan and what the hosted filter does for each step
The steps below come from the filtering impact section of this page.
| Step in the plan | Hosted CIPA filter |
|---|---|
| 1. Block Social Networking on student devices | One category switch per school, applied through a single DNS setting |
| 2. Decide on neighboring categories | Streaming Media is its own switch, and forums, community and messaging sites go on the always-block list |
| 3. Allow learning tools on purpose | Always-allow lists per site, applied in seconds |
| 4. Close the bypass routes | VPN/Proxy blocked, even with the staff PIN, and encrypted DNS settings that skip the filter blocked by default |
| 5. Cover devices away from school | A private encrypted link keeps the rules on devices off the network |
| Documenting it for MSDE | Activity reports, a policy record and log export |
FAQMaryland school internet safety FAQ
Does Maryland have a school internet filtering law?
We did not find a Maryland statute that sets its own filter category list. CIPA is the filtering standard for E-Rate schools. The Phone-Free Schools Act does require policies that stop students reaching social media during the school day.
What is the Phone-Free Schools Act?
HB 525, cross-filed as SB 928, effective July 1, 2026. Local boards must have a policy in place by 2027-28 that bans student device use from first to last bell, requires storage and bars social media access.
Are school-issued devices covered?
No. The definition excludes devices a local board provides for instruction. That is why their filtering carries the social media rule.
Can students be suspended for using a phone?
Discipline must be tiered and enforced by an administrator, and may not include suspension or expulsion solely for a device policy violation.
Which exceptions must policies allow?
Uses documented in an IEP or 504 Plan, health needs, translation tools when school devices are not enough, and caregiving approved by a principal.
Which data law covers our filter vendor?
The Maryland Student Data Privacy Act of 2015 for operators of PreK-12 online services, plus FERPA and COPPA. Sign a data agreement with each vendor.
Can a teacher unblock a site for a lesson?
CIPA lets an authorized person disable the filter for adults doing bona fide research. For students, approve specific sites for a set time and record who approved them.
Does the law tell us which sites count as social media?
No list is given. The law uses a broad definition based on features such as profiles, feeds, messaging and sharing. Your policy should name the categories you block and the learning platforms you allow.
Do charter schools and private schools follow it?
The duty sits with each county board of education, so it reaches the public schools that board runs. Private schools are not covered by the device rule, though CIPA applies to any school that takes the covered E-Rate discounts.
How long should we keep records?
At least 10 years after the last date of service for E-Rate records, and long enough to cover the Phone-Free Schools Act reports through 2033.
More statesCompare other state school internet laws
For every state guide in one place, visit our school internet safety laws by state page.
Related guides
- What Is CIPA? Children's Internet Protection Act Requirements
- CIPA Compliance Checklist for Schools and Districts (8 Steps)
- Presenting Web Filtering to the School Board: Budget, Risk, Metrics
- Delaware School Internet Safety Laws: CIPA, SB 106 and Privacy
- Virginia School Internet Safety Laws: 22.1-70.2 and CIPA
The quote follows how many Maryland schools and devices your system has, and we send it within one business day. A pilot on one school lets you watch the social media blocks and the reports before you commit.
Talk to us about your district
The social media rule runs through your school-issued devices. We will show how our CIPA category data and the hosted CIPA filter pilot can enforce it by the school day, with exports you can file with MSDE.