Maryland

Maryland's child pornography statute defines an image indistinguishable from an actual and identifiable child to include a computer-generated image created, adapted, or modified to appear as an actual and identifiable child, reaching AI-generated child sexual abuse material on the same terms as a real photograph.

A person may not knowingly possess and retain, or knowingly access and view, such a visual representation of a child under 16 engaged in sadomasochistic abuse, sexual conduct, or a state of sexual excitement. A first violation is a misdemeanor and a second or later violation is a felony.

Enacted April 28, 2026 as Chapter 154 and taking effect October 1, 2026, this law bars a food retailer (a business establishment of at least 15,000 square feet that sells food exempt from the state sales and use tax) and a third-party food delivery service provider from engaging in dynamic pricing, offering a price personalized to a consumer based on the consumer's personal data, including through artificial intelligence or models that retrain or recalibrate in near real time, or from using surveillance personal data to set a higher price for that food for a specific consumer or group of consumers.

Separately, any other merchant that sets the price of a consumer good or service using dynamic pricing or personal data and then advertises, labels, or otherwise communicates that price must include a clear and conspicuous disclosure stating that the price was set by an algorithm or by using the consumer's personal data; this broader disclosure duty exempts conduct regulated under the Insurance Article, a financial institution subject to the Gramm-Leach-Bliley Act, a food retailer already covered by the dynamic-pricing ban, and a lower price offered to a merchant's own employee.

Neither provision creates a private right of action. Before bringing an enforcement action, the Division of Consumer Protection must give 45 days' written notice and an opportunity to cure. A violation is subject to a civil fine of up to $10,000 per violation, rising to $25,000 for a repeat violation.

Effective June 1, 2026, a person may not knowingly or with reckless disregard create, use, or disseminate a deepfake, defined as an image, audio recording, or video recording intentionally created or manipulated with generative artificial intelligence or other digital technology to produce a realistic but false depiction an ordinary person would conclude is authentic, where the person intends the deepfake to impede or influence a voter's decision, misrepresent voter-registration or election facts, or induce or deter a ballot-question petition signature, and the act results in or is intended to result in harm to a voter or petition.

The prohibition exempts satire or parody and exempts a broadcaster, website, or periodical that carries a clear and conspicuous disclosure that content may be deceptive. A violation is a misdemeanor.

Maryland's nonconsensual intimate imagery statute defines a prohibited visual representation to include a computer-generated image that is indistinguishable from the depicted person, reaching an AI-generated deepfake on the same terms as an unaltered photograph.

A person may not knowingly distribute such an image showing another identifiable person with intimate parts exposed or engaged in sexual activity, with intent to harm, harass, intimidate, threaten, or coerce, or with knowledge or reckless disregard that the person did not consent, where that person had a reasonable expectation the image would remain private. Violation is a misdemeanor, and the depicted person also has a civil cause of action for defamation per se or invasion of privacy.

Enacted May 12, 2026 as Chapter 445 and taking effect October 1, 2026, this law extends Maryland's identity-fraud statute to bar knowingly, willfully, and with fraudulent intent using artificial intelligence or a deepfake representation to impersonate, falsely depict, or claim to represent another person with intent to defraud, mislead, or cause harm. A victim of that conduct may bring a civil action and seek an injunction and other appropriate relief.

A first-tier violation involving one victim is a felony, and a violation involving two or more victims carries a higher penalty tier.

Effective October 1, 2025, a carrier, pharmacy benefits manager, or private review agent that uses artificial intelligence, an algorithm, or other software tool to conduct utilization review must base its determinations on the enrollee's own medical or clinical history and individual clinical circumstances rather than a group dataset alone, keep a health care provider in the determination process, ensure fair and non-discriminatory application, and make the tool available for audit by the Insurance Commissioner.

The tool may not directly or indirectly cause harm to an enrollee, and it may not itself deny, delay, or modify health care services. A companion reporting section requires carriers to disclose to the Commissioner, case by case, whether AI, an algorithm, or other software tool was used in each adverse coverage decision.

The Maryland Personal Information Protection Act, a separate chapter untouched by MODPA's enactment or later recodification, requires a business that owns, licenses, or maintains computerized data including personal information to notify each affected Maryland individual once it determines a likelihood the breach caused or will cause misuse, as soon as reasonably practicable and no later than 45 days after discovering or being notified of the breach, extended by 7 days after a law-enforcement delay is cleared where that falls later than the original 45-day deadline.

'Personal information' includes biometric data generated by automatic measurement of an individual's biological characteristics, such as a fingerprint, voiceprint, genetic print, or retina or iris image, used to uniquely authenticate identity when accessing a system or account, alongside the more familiar Social Security, driver's license, or financial account number data elements.

MPIPA's own enforcement section, § 14-3508, makes a violation an unfair or deceptive trade practice subject to Title 13's enforcement and penalty provisions, and unlike MODPA's § 14-4713, it does not exclude § 13-408, the Maryland Consumer Protection Act's private-action-for-damages provision, so a MPIPA violation is privately actionable through that route.

MODPA governs private-sector processing of Maryland residents' personal data.

It applies to a person that conducts business in Maryland or targets products or services to Maryland residents and, in the preceding calendar year, either controlled or processed at least 35,000 consumers' personal data (excluding data processed solely to complete a payment transaction) or controlled or processed at least 10,000 consumers' personal data while deriving more than 20% of gross revenue from selling personal data.

MODPA carries no independent revenue threshold, and its 35,000-consumer floor is materially lower than many peer states' 100,000-consumer floor. A controller determines the purpose and means of processing; a processor processes on a controller's behalf.

MODPA gives a Maryland consumer the right, exercisable against a controller, to confirm processing, access their personal data, correct inaccuracies, delete data, obtain a portable copy for automated-processing data, obtain a list of categories of third parties their data was disclosed to, and opt out of targeted advertising, sale, or profiling in furtherance of solely automated decisions with legal or similarly significant effects.

A controller must respond within 45 days of receipt, with one 45-day extension available if the controller informs the consumer of the extension and its reason within the initial period, and must establish a conspicuous process to appeal a refusal.

A MODPA violation is an unfair, abusive, or deceptive trade practice enforced under the Maryland Consumer Protection Act's (Title 13) machinery, except that MODPA expressly excludes section 13-408, the Consumer Protection Act's private-action-for-damages provision, from its enforcement scheme, so a MODPA violation is not independently privately actionable through that route.

Section 14-4713(b) preserves any other remedy provided by law as a savings clause, not a grant of a private cause of action. Before initiating an enforcement action for a violation occurring on or before April 1, 2027, the Division of Consumer Protection may, in its discretion, issue a notice of violation where it determines a cure is possible, giving the controller or processor at least 60 days to cure; there is no unconditional right to cure, and this mechanism itself sunsets.

MODPA classifies genetic or biometric data, alongside racial or ethnic origin, religious belief, health data, sexuality, transgender or nonbinary status, national origin, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data.

A controller may not collect, process, or share sensitive data unless strictly necessary to provide a product or service the consumer requested, may never sell sensitive data, and may not process or sell a consumer's personal data for targeted advertising if it knew or should have known the consumer is under 18.

'Biometric data' means data from automatic measurement of a consumer's biological characteristics used to uniquely authenticate identity, including a fingerprint, voiceprint, or eye retina or iris image, and excludes a bare photograph or an audio or video recording, but claws that exclusion back the moment data generated from one is generated to identify a specific consumer.

Section 7-302(c)(1) provides that a person may not intentionally, willfully, and without authorization access, attempt to access, cause to be accessed, or exceed the person's authorized access to all or part of a computer network, computer control language, computer, computer software, computer system, computer service, or computer database, or copy, attempt to copy, possess, or attempt to possess the contents of a computer database accessed in violation of that clause.

Reading the section end to end, only access is defined (to instruct, communicate with, store data in, retrieve or intercept data from, or otherwise use the resources of a computer program, system, or network); authorization and without authorization are never defined anywhere in the section, and it carries no publicly-available-data exception and no notice-based revocation clause of any kind, so there is no textual hook either way for how a Maryland court would treat a public, unauthenticated page.

Section 7-302(g) separately creates a civil private right of action: a person who has suffered a specific and direct injury because of a violation of this section may bring a civil action, recover actual damages and reasonable attorney's fees and court costs, and a prior criminal conviction is not a prerequisite to suit.

This civil right of action is independent of MODPA's own Attorney-General-only enforcement scheme and expands a scraper's exposure in Maryland beyond the criminal penalties in subsection (d).

MODPA excludes publicly available information from personal data, defined to mean information lawfully made available through government records or that a controller reasonably believes the consumer lawfully made available to the public through widely distributed media.

Unusually among the comprehensive state privacy acts researched, the definition carries an express carve-back: publicly available information does not include biometric data collected by a business about a consumer without the consumer's knowledge, so a scraper harvesting public biometric identifiers, such as faces from public photos for facial-recognition purposes, cannot rely on the publicly-available exemption in Maryland even though the same photos would fall outside personal data entirely if they were merely names or contact details.

MODPA also carries the strictest data-minimization rule among the comprehensive state privacy acts, requiring a controller to limit the collection of personal data to what is reasonably necessary and proportionate to provide or maintain a specific product or service the consumer requested, with no separate or compatible disclosed purpose alternative of the kind most peer statutes carry.

The Act applies to a controller conducting business in Maryland, or targeting Maryland residents, that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers (excluding payment-only data), or of at least 10,000 consumers while deriving more than 20% of gross revenue from personal-data sales. As enacted, the chapter was codified at Com. Law section 14-4601 et seq.

The 2025 Replacement Volume recodification to section 14-4701 et seq. is confirmed directly against the state's own statute lookup (mgaleg.maryland.gov): section 14-4601 now returns an unrelated Forensic Nurse Examiner Training Grant Program provision, while section 14-4701 carries this Act's own definitions and cross-references its consumer-rights section at section 14-4705, so section 14-4701 et seq. is the current citation.

The Act's own enactment clause states it shall take effect October 1, 2025, correcting an earlier drafting date. Enforcement runs through the penalty provisions of Title 13 of the Commercial Law Article (the Maryland Consumer Protection Act) except for section 13-408, that article's own private-right-of-action section, so there is no private right of action and enforcement is by the Maryland Attorney General.

A business that owns, maintains, or licenses the personal information of a Maryland resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information and the nature and size of the business, to protect it from unauthorized access, use, modification, or disclosure.

When destroying a customer's, an employee's, or a former employee's records containing personal information, the business must take reasonable steps to protect against unauthorized access to or use of that information, weighing the sensitivity of the records, the size of the business, the cost of different destruction methods, and available technology.

Where the business discloses personal information to a nonaffiliated third-party service provider under a written contract entered into on or after January 1, 2009, it must require the provider by that contract to implement and maintain the same kind of reasonable security procedures and practices.

A business already complying with the security, notification, or destruction rules of its own primary or functional federal or State regulator, or already subject to and in compliance with the Gramm-Leach-Bliley Act, the Fair and Accurate Credit Transactions Act's Red Flags Rule, the federal Interagency Guidelines Establishing Information Security Standards, or Health Insurance Portability and Accountability Act (HIPAA), is deemed to be in compliance with this subtitle.

A violation is an unfair or deceptive trade practice under Title 13 of the Commercial Law Article, enforceable by the Attorney General for injunctive relief and a civil penalty of up to $10,000 per violation, $25,000 for a repeat violation, under Commercial Law section 13-410, and Commercial Law section 13-408 also lets any person bring a private action to recover for injury or loss the violation caused.

Requires online products reasonably likely to be accessed by children under 18 to set high default privacy settings, complete data protection impact assessments, and avoid data practices harmful to children. A First Amendment and federal preemption challenge by NetChoice survived a motion to dismiss in November 2025 and is proceeding without an injunction.