Law / United States / 
Maryland
Maryland Pen Register and Trap and Trace Device Act
Md. Code Ann., Cts. & Jud. Proc. § 10-4B-02
In force.
A device storage and tracking consent rule binding public and private bodies.
- Enforcement body
- Criminal prosecution by the State.
- Obligation class
- Consent, Prohibition
What it requires
- Do not install or use a pen register or a trap and trace device, a device or process that records the dialing, routing, addressing, or signaling information of a wire or electronic communication without capturing its contents, without first obtaining a court order, unless you are a provider of the communication service using it to operate, maintain, or test the service, to protect the provider or its users from abuse, fraud, or unlawful use, or with the consent of the user of that service.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A person who violates the installation prohibition, upon conviction, is subject to a fine not exceeding $5,000 or imprisonment not exceeding 1 year, or both.
What this law does
Maryland bars any person, not only an investigative or law enforcement officer, from installing or using a pen register or a trap and trace device without first obtaining a court order.
A pen register is a device or process that records and decodes the dialing, routing, addressing, or signaling information transmitted from an instrument or facility that sends a wire or electronic communication, and a trap and trace device captures the incoming impulses that identify the source of a communication; neither term includes a device used to obtain a communication's content.
The pen register definition also excludes a device a provider or customer of a communication service uses for billing, or for cost accounting in the ordinary course of its business.
The prohibition does not reach a communication service provider's own use of such a device to operate, maintain, or test the service, to protect its rights or property or its users from abuse or unlawful use, or to record that a communication was initiated or completed in order to protect against fraudulent, unlawful, or abusive use, or its use with the consent of the user of that service.
The subtitle, sections 10-4B-01 to 10-4B-05, gives a person harmed by a violation no civil action; a violation is punishable on conviction by a fine of up to $5,000, imprisonment of up to 1 year, or both. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app tracks devices.
Back to the example · Lint your app
Page updated .