Maryland

Maryland's child pornography statute defines an image indistinguishable from an actual and identifiable child to include a computer-generated image created, adapted, or modified to appear as an actual and identifiable child, reaching AI-generated child sexual abuse material on the same terms as a real photograph.

A person may not knowingly possess and retain, or knowingly access and view, such a visual representation of a child under 16 engaged in sadomasochistic abuse, sexual conduct, or a state of sexual excitement. A first violation is a misdemeanor and a second or later violation is a felony.

Effective June 1, 2026, a person may not knowingly or with reckless disregard create, use, or disseminate a deepfake, defined as an image, audio recording, or video recording intentionally created or manipulated with generative artificial intelligence or other digital technology to produce a realistic but false depiction an ordinary person would conclude is authentic, where the person intends the deepfake to impede or influence a voter's decision, misrepresent voter-registration or election facts, or induce or deter a ballot-question petition signature, and the act results in or is intended to result in harm to a voter or petition.

The prohibition exempts satire or parody and exempts a broadcaster, website, or periodical that carries a clear and conspicuous disclosure that content may be deceptive. A violation is a misdemeanor.

Maryland's nonconsensual intimate imagery statute defines a prohibited visual representation to include a computer-generated image that is indistinguishable from the depicted person, reaching an AI-generated deepfake on the same terms as an unaltered photograph.

A person may not knowingly distribute such an image showing another identifiable person with intimate parts exposed or engaged in sexual activity, with intent to harm, harass, intimidate, threaten, or coerce, or with knowledge or reckless disregard that the person did not consent, where that person had a reasonable expectation the image would remain private. Violation is a misdemeanor, and the depicted person also has a civil cause of action for defamation per se or invasion of privacy.

Effective October 1, 2025, a carrier, pharmacy benefits manager, or private review agent that uses artificial intelligence, an algorithm, or other software tool to conduct utilization review must base its determinations on the enrollee's own medical or clinical history and individual clinical circumstances rather than a group dataset alone, keep a health care provider in the determination process, ensure fair and non-discriminatory application, and make the tool available for audit by the Insurance Commissioner.

The tool may not directly or indirectly cause harm to an enrollee, and it may not itself deny, delay, or modify health care services. A companion reporting section requires carriers to disclose to the Commissioner, case by case, whether AI, an algorithm, or other software tool was used in each adverse coverage decision.

A facial recognition service is technology that analyzes facial features and is used for recognition or persistent tracking of individuals in still or video images. A facial template is the machine-interpretable pattern of facial features that is extracted from one or more images of an individual by a facial recognition service.

An employer may not use a facial recognition service for the purpose of creating a facial template during an applicant's interview for employment unless the applicant consents. An applicant may consent by signing a waiver that states in plain language the applicant's name, the date of the interview, that the applicant consents to the use of facial recognition during the interview, and whether the applicant read the consent waiver.

The Department of Legislative Services' fiscal note for House Bill 720 (2023) states that the Act does not apply to State or local governments as employers. Chapter 446 of the Acts of 2020, which added section 3-717, took effect on October 1, 2020.

Title 33 of the Insurance Article sets standards for data security and for the investigation of and notification to the Commissioner of a cybersecurity event applicable to carriers. A carrier is an authorized insurer, nonprofit health service plan, health maintenance organization, dental organization, managed general agent or third-party administrator. A carrier that learns a cybersecurity event has or may have occurred must conduct a prompt investigation.

A carrier must keep records of all cybersecurity events for at least 5 years from the date of the event and produce them on the Commissioner's demand. A carrier must notify the Commissioner as promptly as possible and no later than 3 business days after a determination that a cybersecurity event has occurred when either of the criteria in section 33-105(a) has been met.

The first criterion is that Maryland is the carrier's state of domicile and the event has a reasonable likelihood of harming a consumer residing in the State or a material part of the carrier's normal operations, and the second is that the carrier reasonably believes the nonpublic information of 250 or more consumers residing in the State is involved and notice is owed to another government or supervisory body or the event is reasonably likely to cause material harm.

A carrier must comply with section 14-3504 of the Commercial Law Article, as applicable, and provide the Commissioner a copy of the notice sent to consumers under that section.

A carrier that is subject to, governed by and compliant with the federal health privacy, security and breach notification rules, and that maintains nonpublic information in the same manner as protected health information, is deemed in compliance with sections 33-103 and 33-104 but must still comply with section 33-105(a) through (d).

A carrier that violates a provision of Title 33 is subject to a penalty of not less than $100 and not more than $125,000 for each violation, in addition to any other sanction to which it may be subject. Title 33 may not be construed to create or imply a private cause of action for violation of its provisions. The Act that enacted Title 33 took effect on October 1, 2022.

The Maryland Personal Information Protection Act, a separate chapter untouched by MODPA's enactment or later recodification, requires a business that owns, licenses, or maintains computerized data including personal information to notify each affected Maryland individual once it determines a likelihood the breach caused or will cause misuse, as soon as reasonably practicable and no later than 45 days after discovering or being notified of the breach, extended by 7 days after a law-enforcement delay is cleared where that falls later than the original 45-day deadline.

'Personal information' includes biometric data generated by automatic measurement of an individual's biological characteristics, such as a fingerprint, voiceprint, genetic print, or retina or iris image, used to uniquely authenticate identity when accessing a system or account, alongside the more familiar Social Security, driver's license, or financial account number data elements.

MPIPA's own enforcement section, § 14-3508, makes a violation an unfair or deceptive trade practice subject to Title 13's enforcement and penalty provisions, and unlike MODPA's § 14-4713, it does not exclude § 13-408, the Maryland Consumer Protection Act's private-action-for-damages provision, so a MPIPA violation is privately actionable through that route. The provisions this entry describes came into force on different days.

MODPA requires a controller to conduct and document, on a regular basis, a data protection assessment for each of its processing activities that present a heightened risk of harm to a consumer, including an assessment for each algorithm that is used.

The activities that present a heightened risk of harm are targeted advertising, the sale of personal data, the processing of sensitive data, and profiling that presents a reasonably foreseeable risk of unfair, abusive or deceptive treatment, an unlawful disparate impact, injury, an offensive intrusion or other substantial injury to a consumer.

Each assessment must identify and weigh the benefits of the processing to the controller, the consumer, other interested parties and the public against the potential risks to the rights of the consumer and the necessity and proportionality of the processing in relation to its stated purpose.

The Division may require a controller to make available to the Division an assessment that is relevant to an investigation, may evaluate it for compliance, and the controller's assessment may be used in an action to enforce the subtitle. An assessment is confidential and exempt from disclosure under the federal Freedom of Information Act or the Public Information Act. The section applies to processing activities that occur on or after October 1, 2025.

MODPA governs private-sector processing of Maryland residents' personal data.

It applies to a person that conducts business in Maryland or targets products or services to Maryland residents and, in the preceding calendar year, either controlled or processed at least 35,000 consumers' personal data (excluding data processed solely to complete a payment transaction) or controlled or processed at least 10,000 consumers' personal data while deriving more than 20% of gross revenue from selling personal data.

MODPA carries no independent revenue threshold, and its 35,000-consumer floor is materially lower than many peer states' 100,000-consumer floor. A controller determines the purpose and means of processing; a processor processes on a controller's behalf.

COMAR 31.16.08 applies to all licensees of the Maryland Insurance Administration who possess nonpublic personal financial information or nonpublic personal health information about consumers. The chapter does not apply to information about persons who obtain products or services for business, commercial, or agricultural purposes.

A licensee is a person licensed or required to be licensed, registered or required to be registered, or otherwise authorized or required to be authorized by the Commissioner.

A licensee must give an individual who becomes its customer a clear and conspicuous notice that accurately reflects its privacy policies and practices for nonpublic financial information not later than when it establishes the customer relationship, and must give a consumer such a notice before it discloses any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as the chapter's exceptions authorize.

A licensee must give its customers such a notice at least once in each annual notice period during the continuation of the customer relationship. A licensee need not give a current customer an annual notice if it has not changed its policies and practices on disclosing nonpublic personal information from those disclosed in the most recent disclosure sent to consumers.

An opt out notice must state that the licensee discloses or reserves the right to disclose nonpublic personal financial information about its consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means by which the consumer may exercise the opt out right.

A licensee must comply with a consumer's opt out direction as soon as reasonably practicable after it receives the direction, and a consumer may exercise the right to opt out at any time.

A licensee may not, directly or through an affiliate, disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has provided the initial notice and the opt out notice, has given the consumer a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out. A licensee that mails the notices gives a reasonable opportunity to opt out if the consumer may opt out within 30 days from the date the licensee mailed the notices.

A licensee may not, directly or through an affiliate, disclose a policy number or similar form of access number or access code for a consumer's policy or transaction account, other than to a consumer reporting agency, to a nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer.

A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed.

The authorization requirement does not prohibit, restrict, or require an authorization for disclosure of nonpublic personal health information for listed insurance functions performed by or on behalf of the licensee, such as claims administration, fraud detection and underwriting.

A valid authorization must be in written or electronic form and must contain the identity of the consumer or customer, a general description of the types of information to be disclosed, general descriptions of the parties to whom it is disclosed, the purpose and how the information will be used, the signature and date, and notice of how long the authorization is valid and that it may be revoked at any time.

An authorization must specify a length of time for which it remains valid, which may not be for more than 24 months. A licensee must retain the authorization or a copy of it in the record of the individual who is the subject of the nonpublic personal health information.

A licensee may not unfairly discriminate against a consumer or customer because the person has opted out of the disclosure of nonpublic personal financial information or has not granted authorization for the disclosure of nonpublic personal health information. The chapter does not preempt or supersede existing State law related to medical records, health information privacy, or insurance information privacy. The chapter took effect on January 21, 2002, and Regulation .06 was amended effective February 27, 2017.

A protected individual is a current or retired justice or judge of a Maryland court, a current or retired justice or judge of a federal court domiciled in the State, a current or retired magistrate or commissioner, or a spouse, child or dependent who resides in the same household as one of them.

Personal information means items such as a home address, home or mobile telephone number, personal email address and Social Security number, and does not include information publicly disclosed with the protected individual's consent or displayed as part of speech on matters of public concern. To publish means to post or otherwise make available to the general public on the Internet, social media or social networks.

A governmental entity that receives a request must promptly acknowledge it in writing and either take the steps reasonably necessary to ensure the personal information is not published or, if it is already published, remove it within 72 hours after receipt of the request. A protected individual, or the Office of Information Privacy on behalf of a protected individual, may request that a person who has published the protected individual's personal information remove it from publication.

The person to whom the request is made must provide for removal of the personal information within 72 hours after receipt of the request and notify the protected individual or the Office of Information Privacy of the removal by certified mail or email.

A protected individual or the Office of Information Privacy may bring an action against a person for a violation of the section for declaratory relief, injunctive relief, damages incurred as the result of the violation, and reasonable attorney's fees. A court may award punitive damages if it finds that a person willfully refused to provide for removal knowing that the individual on whose behalf the request was made was a protected individual.

An individual may not knowingly publish the personal information of a protected individual if the individual knows or reasonably should know that publishing it poses an imminent and serious threat to the protected individual and the publishing results in an assault, harassment, trespass or malicious destruction of property.

An individual who violates section 3-2304 is guilty of a misdemeanor and on conviction is subject to imprisonment not exceeding 18 months or a fine not exceeding $5,000 or both. Section 1 of Chapter 415 of the Acts of 2024, which added Subtitle 23, took effect on October 1, 2024.

MODPA gives a Maryland consumer the right, exercisable against a controller, to confirm processing, access their personal data, correct inaccuracies, delete data, obtain a portable copy for automated-processing data, obtain a list of categories of third parties their data was disclosed to, and opt out of targeted advertising, sale, or profiling in furtherance of solely automated decisions with legal or similarly significant effects.

A controller must respond within 45 days of receipt, with one 45-day extension available if the controller informs the consumer of the extension and its reason within the initial period, and must establish a conspicuous process to appeal a refusal.

A MODPA violation is an unfair, abusive, or deceptive trade practice enforced under the Maryland Consumer Protection Act's (Title 13) machinery, except that MODPA expressly excludes section 13-408, the Consumer Protection Act's private-action-for-damages provision, from its enforcement scheme, so a MODPA violation is not independently privately actionable through that route.

Section 14-4713(b) preserves any other remedy provided by law as a savings clause, not a grant of a private cause of action. Before initiating an enforcement action for a violation occurring on or before April 1, 2027, the Division of Consumer Protection may, in its discretion, issue a notice of violation where it determines a cure is possible, giving the controller or processor at least 60 days to cure; there is no unconditional right to cure, and this mechanism itself sunsets.

Chapter 480 of the Acts of 1990 enacted Subtitle 3, Confidentiality of Medical Records, of Title 4 of the Health-General Article.

A health care provider is a person licensed, certified or otherwise authorized under the Health Occupations Article or section 13-516 of the Education Article to provide health care in the ordinary course of business or practice, or a facility where health care is provided, and includes the agents, employees, officers and directors of a facility and the agents and employees of a health care provider.

A medical record is any oral, written or other transmission in any form or medium of information that is entered in the record of a patient or recipient, identifies or can readily be associated with the identity of the patient or recipient, and relates to the health care of the patient or recipient. A health care provider must keep the medical record of a patient or recipient confidential and disclose it only as Subtitle 3 or other law provides.

Subtitle 3 does not apply to information not kept in the medical record that relates to the administration of a health care facility, such as risk management and quality assurance, or to information governed by the federal confidentiality of alcohol and drug abuse patient records regulations or the developmental disability confidentiality provisions in sections 7-1008 through 7-1011 of the Health-General Article.

A person to whom a medical record is disclosed may not redisclose it unless the redisclosure is authorized by the person in interest, otherwise permitted by Subtitle 3, permitted under section 1-202(b) or (c) of the Human Services Article, or directory information. Except for transfers relating to the transfer of ownership of a health care practice or facility, a person may not disclose a medical record by sale, rental or barter.

A health care provider must disclose a medical record on the authorization of a person in interest, and the authorization must be in writing, dated and signed by the person in interest, state the name of the health care provider, identify to whom the information is to be disclosed, and state a validity period that may not exceed 1 year, with stated exceptions.

A health care provider must comply within a reasonable time after a person in interest requests in writing to receive a copy of a medical record or to see and copy it. A health care provider must establish procedures for a person in interest to request an addition to or correction of a medical record, and a person in interest may not have any information deleted from a medical record.

A health care provider may disclose a medical record without the authorization of a person in interest to the provider's authorized employees, agents, medical staff, medical students or consultants for the sole purpose of offering, providing, evaluating or seeking payment for health care to patients or recipients by the provider.

A health care provider must disclose a medical record without the authorization of a person in interest to a unit of State or local government, or a member of a multidisciplinary team assisting the unit, for purposes of investigation or treatment in a case of suspected abuse or neglect of a child or an adult, subject to stated conditions.

A health care provider that knowingly refuses to disclose a medical record within a reasonable time, but no more than 21 working days after the date a person in interest requests the disclosure, is liable for actual damages. A health care provider or any other person who knowingly violates any provision of Subtitle 3 is liable for actual damages.

A health care provider or any other person, including an officer or employee of a governmental unit, who knowingly and willfully violates a provision of Subtitle 3 is guilty of a misdemeanor and on conviction is subject to a fine not exceeding $1,000 for the first offense and not exceeding $5,000 for each subsequent conviction, except where subsection (e) applies.

Knowingly and willfully requesting or obtaining a medical record under false pretenses or through deception, or knowingly and willfully disclosing a medical record in violation of Subtitle 3, is a misdemeanor punishable by a fine not exceeding $50,000, imprisonment for not more than 1 year, or both, with higher penalties if the offense is committed under false pretenses or with intent to sell, transfer or use individually identifiable health information for commercial advantage, personal gain or malicious harm. No day on which the provisions this entry describes came into force has been located.

Insurance Article section 27-909.1 applies only to life insurance and disability insurance policies or contracts. Insurance Article section 27-909.1 does not prohibit an insurance carrier from accessing an applicant's medical record as part of the application process or from considering a medical diagnosis included in an individual's medical record, even if the diagnosis was based on the results of a genetic test.

An insurance carrier may not unfairly discriminate against an individual by conditioning insurance rates, the provision or renewal of coverage, or other conditions of insurance on medical information, including genetic test results, for which there is no relationship between the information and the cost of the insurance risk the insurer would assume. In demonstrating that relationship, an insurer may rely on actuarially sound principles or actual or reasonably anticipated experience.

An insurance carrier may not access sensitive medical information, including an individual's genetic data, without first obtaining the individual's signed, written consent. An insurance carrier may not mandate existing or new genetic testing or full genome sequencing as a prerequisite for life insurance or disability insurance eligibility or coverage, and neither the carrier, the applicant nor the policy holder may waive that prohibition.

The Insurance Commissioner may issue an order under sections 4-113 and 4-114 or sections 27-501 and 27-505 of the Insurance Article if the Commissioner finds a violation of section 27-909.1. Chapter 394 of the Acts of 2025, which added section 27-909.1, took effect on October 1, 2025.

Insurance Article section 4-113 lets the Commissioner, instead of or in addition to suspending or revoking a certificate of authority, impose on the holder a penalty of not less than $100 but not more than $125,000 for each violation of the article.

An employer is generally a person engaged in an industry or business with 15 or more employees for each working day in each of 20 or more calendar weeks in the current or preceding calendar year, or with one or more employees where an employee has filed a complaint alleging harassment, and includes an agent of that person and, to the extent the title provides, the State. Genetic information and genetic test have the meanings stated in section 27-909(a)(3) and (5) of the Insurance Article.

An employer may not fail or refuse to hire, discharge or otherwise discriminate against an individual with respect to compensation, terms, conditions or privileges of employment because of the individual's genetic information, or because of the individual's refusal to submit to a genetic test or make available the results of a genetic test.

An employer may not limit, segregate or classify its employees or applicants in any way that would deprive or tend to deprive an individual of employment opportunities or adversely affect the individual's status as an employee because of genetic information or the individual's refusal to submit to a genetic test or make available the results of a genetic test. An employer may not request or require genetic tests or genetic information as a condition of hiring or determining benefits.

Any person claiming to be aggrieved by an alleged discriminatory act may file a complaint with the Commission on Civil Rights. A complainant may bring a civil action alleging an unlawful employment practice if the complainant filed a timely administrative charge, at least 180 days have elapsed since the filing, and the action is filed within 2 years after the practice occurred, or within 3 years for harassment.

Compensatory damages for future pecuniary losses and nonpecuniary losses may not exceed $50,000 for an employer with 15 to 100 employees, $100,000 for 101 to 200 employees, $200,000 for 201 to 500 employees and $300,000 for 501 or more employees. A court may also award punitive damages if the respondent is not a governmental unit or political subdivision and the court finds actual malice, and compensatory and punitive damages together may not exceed the same limit.

Senate Bill 2 of 2001 added a prohibition on requesting or requiring genetic tests or genetic information as a condition of hiring or determining benefits. Senate Bill 2 of 2001 provided that it would take effect on October 1, 2001. Senate Bill 2 of 2001 was signed by the Governor as Chapter 11.

Insurance Article section 27-909 does not apply to life insurance policies, annuity contracts, long-term care insurance policies or disability insurance policies.

An insurer, nonprofit health service plan or health maintenance organization may not use a genetic test, the results of a genetic test, genetic information or a request for genetic services to reject, deny, limit, cancel, refuse to renew, increase the rates of, affect the terms or conditions of, or otherwise affect a health insurance policy or contract.

An insurer, nonprofit health service plan or health maintenance organization may not request or require a genetic test, the results of a genetic test or genetic information for the purpose of determining whether to issue or renew health benefits coverage.

An insurer, nonprofit health service plan or health maintenance organization may not release identifiable genetic information or the results of a genetic test to anyone other than its employees or a participating health care provider who provides medical services to its insureds or enrollees without the prior written authorization of the individual.

Disclosure of identifiable genetic information to an authorized employee or health care provider may be made only for providing medical care to patients or conducting research approved by an institutional review board. Each authorization under Insurance Article section 27-909 must describe the individual or entities making the disclosure, to whom the disclosure is to be made, and the information to be disclosed.

The Insurance Commissioner may issue an order under sections 4-113 and 4-114 and sections 27-501 and 27-505 of the Insurance Article if the Commissioner finds a violation of section 27-909. Insurance Article section 4-113 lets the Commissioner, instead of or in addition to suspending or revoking a certificate of authority, impose on the holder a penalty of not less than $100 but not more than $125,000 for each violation of the article. No day on which the provisions this entry describes came into force has been located.

An insurer, or an insurance service organization whose functions include the collection of medical data, may not disclose the contents of an insured's medical or claims records, except as subsection (b), (c) or (d) of Insurance Article section 4-403 provides.

An insurer may disclose specific medical information or medical data contained in an insured's medical or claims records to the insured, the insured's agent or representative, or, on request of the insured, a physician of the insured's choice. An insurer, or an insurance service organization whose functions include the collection of medical data, may disclose specific medical information or medical data contained in an insured's medical or claims records if the insured authorizes the disclosure.

Subsection (c) of Insurance Article section 4-403 lets an insurer or insurance service organization disclose specific medical information without the insured's authorization in twelve listed cases, including legal process, investigating possible insurance fraud, reinsurance purposes, underwriting through an insurer information exchange, evaluating an application or a claim, and disclosure to the insured's treating providers for care coordination.

A disclosure to the insured's treating providers under item (12) of subsection (c) is subject to the additional limits in section 4-307 of the Health-General Article on mental health records, may be made only in accordance with the federal Health Insurance Portability and Accountability Act (HIPAA) privacy rules, and requires a notice that gives the insured an opportunity to opt out of the sharing.

Insurance Article section 4-403 does not prohibit the use of medical records, data or statistics if the use does not disclose the identity of a particular insured or covered person. An insurer that knowingly violates Insurance Article section 4-403 is liable to a plaintiff for any damages recoverable in a civil action, including reasonable attorney's fees.

Insurance Article section 4-113 lets the Commissioner, instead of or in addition to suspending or revoking a certificate of authority, impose on the holder a penalty of not less than $100 but not more than $125,000 for each violation of the article. No day on which the provisions this entry describes came into force has been located.

Binds a direct-to-consumer genetic testing company, meaning an entity that offers genetic testing products or services directly to a consumer, or that collects, uses or analyzes genetic data that resulted from a direct-to-consumer genetic testing product or service provided to the company by a consumer.

A direct-to-consumer genetic testing company must provide a high-level overview of its privacy policy and a privacy notice covering its data collection, consent, use, access, disclosure, transfer, security, and retention and deletion practices, made publicly available and placed in a prominent area of its website.

A direct-to-consumer genetic testing company must obtain a consumer's express consent before collecting, using or disclosing genetic data, with separate express consent for transfer to anyone other than its vendors and service providers, for use beyond the primary purpose of the product or service, for keeping a biological sample after the initial testing, and for marketing.

A direct-to-consumer genetic testing company must also obtain informed consent that complies with the federal policy for the protection of human research subjects before transferring or disclosing genetic data to third parties for research.

A direct-to-consumer genetic testing company must establish legal policies and processes for disclosing genetic data to law enforcement or another government agency without a consumer's express written consent, and must develop, implement and maintain a comprehensive security program to protect consumers' genetic data against unauthorized access, use or disclosure.

A direct-to-consumer genetic testing company must establish a process for a consumer to access the consumer's genetic data, delete the consumer's account and genetic data, and request destruction of the consumer's biological sample. Without the consumer's written consent, a direct-to-consumer genetic testing company may not disclose a consumer's genetic data to an entity offering health, life, disability or long-term care insurance, or to an employer of the consumer.

Subtitle 44 of Title 14 does not apply to protected health information collected by a covered entity or business associate, or to genetic data or biological samples collected for research conducted under the federal human-subjects policy, the Good Clinical Practice Guidelines of the International Council for Harmonisation, or the human-subject rules of the Food and Drug Administration.

Title 13 of the Commercial Law Article lists a violation of Title 14, Subtitle 44 among its unfair, abusive or deceptive trade practices. Section 14-4406 makes a violation of that section an unfair, abusive or deceptive trade practice subject to the enforcement and penalty provisions of Title 13, and leaves an individual free to pursue any other remedy provided by law. The Maryland Genetic Information Privacy Act took effect on October 1, 2022.

MODPA classifies genetic or biometric data, alongside racial or ethnic origin, religious belief, health data, sexuality, transgender or nonbinary status, national origin, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data.

A controller may not collect, process, or share sensitive data unless strictly necessary to provide a product or service the consumer requested, may never sell sensitive data, and may not process or sell a consumer's personal data for targeted advertising if it knew or should have known the consumer is under 18.

'Biometric data' means data from automatic measurement of a consumer's biological characteristics used to uniquely authenticate identity, including a fingerprint, voiceprint, or eye retina or iris image, and excludes a bare photograph or an audio or video recording, but claws that exclusion back the moment data generated from one is generated to identify a specific consumer.

Since July 1, 2026, sensitive data also includes data a controller infers from personal data when that inferred data indicates a sensitive attribute, and it means personal data that includes a sensitive attribute or any other personal data processed to identify one.

A controller also may not sell a consumer's personal data if it knew or should have known that the purchaser seeks to use it for immigration enforcement, and may not knowingly sell it to a federal, State, or local governmental unit that, within the preceding six months, engaged in or supported civil immigration enforcement through personnel or material resources. These changes were made by Chapter 874 of the Acts of 2026 (House Bill 711), which took effect July 1, 2026.

A person includes an individual, corporation, business trust, statutory trust, estate, trust, partnership, association, two or more persons having a joint or common interest, or any other commercial entity, and does not include a unit of State or local government. A person may not publicly post or display an individual's Social Security number. A person may not print an individual's Social Security number on a card required for the individual to access products or services the person provides.

A person may not require an individual to transmit, or initiate the transmission of, the individual's Social Security number over the Internet unless the connection is secure or the number is encrypted. A person may not require an individual to use the individual's Social Security number to access an Internet website unless a password, unique personal identification number or other authentication device is also required.

Unless State or federal law requires it, a person may not print an individual's Social Security number on material mailed to the individual, include it in electronically transmitted material unless the connection is secure or the number is encrypted, or include it in material transmitted to the individual by facsimile.

Section 14-3402 does not apply to the collection, release or use of a number as required by State or federal law, to its inclusion in an application, form or document sent as part of an application or enrollment process, to establish, amend or terminate an account, contract or policy, or to confirm its accuracy, or to its use for internal verification or administrative purposes.

An interactive computer service provider's or telecommunications provider's transmission, routing, or intermediate temporary storage or caching of a number is outside section 14-3402, and section 14-3402 imposes no duty on such a provider to monitor its service or seek evidence of the transmission of numbers. Title 13 of the Commercial Law Article lists a violation of Title 14, Subtitle 34, the Social Security Number Privacy Act, among its unfair, abusive or deceptive trade practices. The Social Security Number Privacy Act took effect on January 1, 2006.

An operator is an individual or entity that engages with institutions under the school official exception of the federal Family Educational Rights and Privacy Act and operates under a contract or agreement with a public school or local school system in the State to provide a website, online service, online application or mobile application that processes covered information and is used for a PreK-12 school purpose or issued at the direction of a public school, a teacher or another school employee.

Covered information is information that, alone or in combination with other information, is linked or could be linked to a student in a manner that would allow an employee or a student of the student's school to identify the student with reasonable certainty.

Education Article section 4-131 does not apply to a general audience Internet website, online service, online application or mobile application, even if log-in credentials created for an operator's site, service or application may be used to access the general audience site, service or application.

An operator must protect covered information from unauthorized access, destruction, use, modification or disclosure, and implement and maintain reasonable security procedures and practices to protect it. If covered information is under the authority of a public school or local school system in accordance with a contract or agreement, an operator must delete it within a reasonable time if the school or school system requests deletion.

An operator may not knowingly engage in targeted advertising based on information, including covered information and persistent unique identifiers, that it acquired because of the use of its site, service or application. Except in furtherance of a PreK-12 school purpose, an operator may not knowingly use information created or gathered by its site, service or application to make a profile about a student.

An operator may not knowingly sell a student's information, subject to the exceptions in the section, or disclose covered information except as subsection (e) allows. An operator may disclose covered information in furtherance of the PreK-12 school purpose if the recipient does not further disclose it and is legally required to comply with the operator's security and prohibition duties.

An operator may also use or disclose covered information, except by sale, if it provided clear and conspicuous notice to the student or the student's parent or guardian and obtained the affirmative consent of the student, if at least 18 years old, or of the parent or guardian. House Bill 298 of 2015 was approved by the Governor as Chapter 413. House Bill 298 of 2015 carried an effective date of July 1, 2015.

Chapter 164 of the Acts of 2022 (House Bill 769) altered certain definitions in Education Article section 4-131 to provide increased protections for certain student data.

Section 7-302(c)(1) provides that a person may not intentionally, willfully, and without authorization access, attempt to access, cause to be accessed, or exceed the person's authorized access to all or part of a computer network, computer control language, computer, computer software, computer system, computer service, or computer database, or copy, attempt to copy, possess, or attempt to possess the contents of a computer database accessed in violation of that clause.

Reading the section end to end, among its definitions access is defined (to instruct, communicate with, store data in, retrieve or intercept data from, or otherwise use the resources of a computer program, system, or network); authorization and without authorization are never defined anywhere in the section, and it carries no publicly-available-data exception and no notice-based revocation clause of any kind, so there is no textual hook either way for how a Maryland court would treat a public, unauthenticated page.

Section 7-302(g) separately creates a civil private right of action: a person who has suffered a specific and direct injury because of a violation of this section may bring a civil action, recover actual damages and reasonable attorney's fees and court costs, and a prior criminal conviction is not a prerequisite to suit. This civil right of action expands a scraper's exposure in Maryland beyond the criminal penalties in subsection (d), because a conviction is not a prerequisite to suit.

MODPA excludes publicly available information from personal data, defined to mean information that a person lawfully obtains from a record of a governmental entity, reasonably believes a consumer or widely distributed media have lawfully made available to the general public, or, if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed it.

The definition carries an express carve-back: publicly available information does not include biometric data collected by a business about a consumer without the consumer's knowledge, so a scraper harvesting public biometric identifiers, such as faces from public photos for facial-recognition purposes, cannot rely on the publicly-available exemption in Maryland, although a photograph is not itself biometric data.

MODPA also requires a controller to limit the collection of personal data to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer to whom the data pertains.

The Act applies to a controller conducting business in Maryland, or targeting Maryland residents, that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers (excluding payment-only data), or of at least 10,000 consumers while deriving more than 20% of gross revenue from personal-data sales. As enacted, the chapter was codified at Com. Law section 14-4601 et seq.

Section 14-4601 is now an unrelated Forensic Nurse Examiner Training Grant Program provision. Section 14-4701 carries this Act's own definitions and cross-references its consumer-rights section at section 14-4705, so section 14-4701 et seq. is the current citation of the Act. The Act's own enactment clause states it shall take effect October 1, 2025, correcting an earlier drafting date.

Enforcement runs through the enforcement and penalty provisions of Title 13 of the Commercial Law Article (the Maryland Consumer Protection Act), except for section 13-408. Section 13-408, which the Act excludes, is the Consumer Protection Act's section allowing any person to bring an action to recover for injury or loss.

Each carrier must develop, implement, and maintain a comprehensive written information security program based on the carrier's risk assessment. A carrier is an authorized insurer, a nonprofit health service plan, a health maintenance organization, a dental organization, a managed general agent, or a third-party administrator.

Each carrier must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, its information systems, or the continuing functionality of any aspect of its business or operations.

A carrier must require a third-party service provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to or held by the provider. On or before April 15 each year, each carrier must submit to the Commissioner a written statement certifying that it complies with section 33-103, except a carrier not domiciled in Maryland that meets the conditions of subsection (k).

A carrier subject to and compliant with the Health Insurance Portability and Accountability Act (HIPAA) privacy, security, and breach notification rules that maintains nonpublic information in the same manner as protected health information is deemed to comply with sections 33-103 and 33-104. A carrier subject to and in compliance with section 33-103 is deemed to be in compliance with sections 14-3502 and 14-3503 of the Commercial Law Article. A carrier had until October 1, 2023 to implement section 33-103 of the Insurance Article.

A carrier had until October 1, 2024 to implement subsection (h) of section 33-103, on third-party service providers. A carrier that violates a provision of Title 33 is subject to a penalty of not less than $100 but not more than $125,000 for each violation, in addition to any other sanction to which it may be subject.

A public service company must adopt and implement cybersecurity standards that are equal to or exceed standards adopted by the Commission. A public service company must adopt a zero-trust cybersecurity approach for on-premises services and cloud-based services. A public service company must establish minimum security standards for each operational technology and information technology device based on the level of security risk for each device, including supply chain risks.

On or before July 1, 2024, and every other July 1 after that, a public service company must engage a third party to assess its operational technology and information technology devices and submit to the Commission certification of its compliance with the standards used in the assessments. Section 5-306 does not apply to a public service company that is a common carrier or a telephone company.

A public service company means a common carrier company, electric company, gas company, sewage disposal company, telegraph company, telephone company, water company, or any combination of public service companies. The Act that added section 5-306, Chapter 499 of the Acts of 2023 (House Bill 969), has an effective date of July 1, 2023.

A business that owns, maintains, or licenses the personal information of a Maryland resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information and the nature and size of the business, to protect it from unauthorized access, use, modification, or disclosure.

When destroying a customer's, an employee's, or a former employee's records containing personal information, the business must take reasonable steps to protect against unauthorized access to or use of that information, weighing the sensitivity of the records, the size of the business, the cost of different destruction methods, and available technology.

Where the business discloses personal information to a nonaffiliated third-party service provider under a written contract entered into on or after January 1, 2009, it must require the provider by that contract to implement and maintain the same kind of reasonable security procedures and practices.

A business already complying with the security, notification, or destruction rules of its own primary or functional federal or State regulator, or already subject to and in compliance with the Gramm-Leach-Bliley Act, the Fair and Accurate Credit Transactions Act's Red Flags Rule, the federal Interagency Guidelines Establishing Information Security Standards, or Health Insurance Portability and Accountability Act (HIPAA), is deemed to be in compliance with this subtitle.

A violation is an unfair or deceptive trade practice under Title 13 of the Commercial Law Article, enforceable by the Attorney General for injunctive relief and a civil penalty of up to $10,000 per violation, $25,000 for a repeat violation, under Commercial Law section 13-410, and Commercial Law section 13-408 also lets any person bring a private action to recover for injury or loss the violation caused.

Each public service company must report a cybersecurity incident, including an attack on a system it uses, to the State Security Operations Center in the Department of Information Technology. The State Chief Information Security Officer, in consultation with the Commission, establishes the process, including the criteria, the manner and the time period for reporting.

The Department of Information Technology's reporting requirements for public utilities state that reports to the Maryland Security Operations Center must be made as soon as practicable, but not later than twenty four (24) hours after confirmation of a detected cybersecurity incident. An organization that is unsure whether an event is a reportable cybersecurity incident and is investigating may make a preliminary report while it determines whether one occurred.

Each unit of State government must report a cybersecurity incident to the State Chief Information Security Officer. The State Chief Information Security Officer determines the criteria for when an incident must be reported, the manner in which to report, and the time period within which a report must be made.

Each local government must report a cybersecurity incident, including an attack on a State system it uses, to the appropriate local emergency manager and the State Security Operations Center in the Department. Section 3.5-406 does not apply to municipal governments. Senate Bill 812 of 2022 has an effective date of July 1, 2022.

Maryland's Commercial Electronic Mail Act imposes no consent duty on sending commercial email; instead a person may not initiate, conspire to initiate, or assist in transmitting commercial electronic mail that is sent from a computer in Maryland, or to an address the sender knows or should know is held by a Maryland resident, and that uses a third party's Internet domain name or email address without permission, carries false or misleading information about the message's origin or transmission path, or carries false or misleading information in the subject line that has the capacity, tendency, or effect of deceiving the recipient.

Commercial electronic mail is email that advertises real property, goods, or services for sale or lease, not counting an advertisement an interactive computer service provider attaches in exchange for free use of an email account. A sender is presumed to know that a recipient is a Maryland resident if that information is available on request from the registrant of the domain name in the recipient's address.

The prohibition does not apply to an interactive computer service provider or a telecommunication utility that merely handles, retransmits, or carries the message. Each prohibition is framed as a rule against falsity or deception in the message, the kind of state email rule the CAN-SPAM Act's preemption clause leaves in force.

An interactive computer service provider may block mail it reasonably believes is or will be sent in violation of the Act, without liability for a good-faith blocking decision.

A person who violates the Act is liable for reasonable attorney's fees and for damages of at least $500 to the recipient, at least $500 to a third party whose domain name or email address was used without permission, and at least $1,000 to an interactive computer service provider, or the affected party's actual damages if greater.

Maryland bars any person, not only an investigative or law enforcement officer, from installing or using a pen register or a trap and trace device without first obtaining a court order.

A pen register is a device or process that records and decodes the dialing, routing, addressing, or signaling information transmitted from an instrument or facility that sends a wire or electronic communication, and a trap and trace device captures the incoming impulses that identify the source of a communication; neither term includes a device used to obtain a communication's content.

The pen register definition also excludes a device a provider or customer of a communication service uses for billing, or for cost accounting in the ordinary course of its business.

The prohibition does not reach a communication service provider's own use of such a device to operate, maintain, or test the service, to protect its rights or property or its users from abuse or unlawful use, or to record that a communication was initiated or completed in order to protect against fraudulent, unlawful, or abusive use, or its use with the consent of the user of that service.

The subtitle, sections 10-4B-01 to 10-4B-05, gives a person harmed by a violation no civil action; a violation is punishable on conviction by a fine of up to $5,000, imprisonment of up to 1 year, or both. The provisions this entry describes came into force on different days.

It is unlawful for any person to willfully intercept, disclose, or use the contents of a wire, oral, or electronic communication, except as this subtitle specifically provides. A person who is a party to the communication may intercept it only where all of the parties, not merely that person, have given prior consent, unless the interception is for the purpose of committing a criminal or tortious act.

The subtitle's other exceptions cover chiefly a communication service provider's own staff acting in the normal course of the service, law enforcement, and an electronic communication made through a system configured so that it is readily accessible to the general public.

The rule reaches a wire communication, a transfer containing the human voice made over a wire or cable connection, and an electronic communication, any transfer of signs, signals, writing, images, sounds or data by wire, radio or a similar system; it reaches an oral communication only where the words are spoken in private conversation.

A provider of an electronic communication service to the public may not intentionally divulge the contents of a communication while in transmission on that service to anyone other than an addressee or intended recipient or their agent, except as federal or State law authorizes, to a person whose facilities forward it to its destination, or, where the provider obtained it inadvertently and it appears to pertain to a crime, to a law enforcement agency.

A person whose communication is intercepted, disclosed, or used in violation of the subtitle has a civil action for actual damages, but not less than liquidated damages computed at $100 a day for each day of violation or $1,000, whichever is higher, plus punitive damages and a reasonable attorney's fee. Good faith reliance on a court order or legislative authorization is a complete defense to a civil or criminal action.

A person who violates the interception, disclosure, or use prohibition is guilty of a felony punishable by up to 5 years' imprisonment or a $10,000 fine, or both. The provisions this entry describes came into force on different days.

Without the called party's prior express written consent, a person may not make or cause to be made a telephone solicitation that uses an automated system for the selection or dialing of telephone numbers, or that plays a recorded message when a connection is completed to the number called.

A telephone solicitation is an organized activity, program, or campaign to communicate by telephone with Maryland residents in order to sell, lease, or rent goods or services, offer a gift or prize, conduct a poll, or request survey information that will be used directly to solicit purchases. A telephone solicitation made to any area code in the State is presumed to be made to a person who resides or has a place of business in Maryland, a presumption the caller may rebut.

Prior express written consent is a written agreement bearing the called party's signature, which may be an electronic signature valid under federal or State law, that names the number to be called and clearly and conspicuously discloses that signing authorizes solicitations by an automated dialing system or a recorded message.

The disclosure must also tell the called party that they are not required to sign the agreement, or to agree to it as a condition of purchasing any property, goods, or services.

The consent duty does not apply to an isolated telephone solicitation outside a pattern of repeated transactions, a business-to-business sale by a solicitor lawfully operating continuously for at least 3 years under the same business name, a solicitation of a contract to maintain or repair goods previously bought from the person soliciting, a single solicitation made in response to the customer's own inquiry or request, a communication between a business and a customer with an existing contract or relationship that begins as informational and becomes a solicitation on the customer's further inquiry, a noncommercial solicitation for public opinion research, or a noncommercial solicitation for religious, charitable, political, or educational purposes.

A person soliciting for a noncommercial religious, charitable, political, or educational purpose is exempt only where the solicitation is for a nonprofit entity that is registered with the Secretary of State and exempt from taxation under section 501(c)(3), (4), or (6) of the Internal Revenue Code. Those exemptions reach only the consent duty; the caller-identification, calling-hours and call-frequency duties below apply to every telephone solicitation.

A telephone solicitor must transmit its originating telephone number, and its name where its carrier makes that available, to the called party's caller identification service, may not intentionally prevent that transmission, and may not use technology that displays a different caller identification number to conceal its identity. The solicitor may display instead the name of the seller for whom the call is placed and the seller's customer service number.

A telephone solicitor may not place a solicitation call, including one made through automated dialing or a recorded message, between 8 p.m. and 8 a.m. in the called party's time zone, more than three times to the same person in a 24-hour period on the same subject matter regardless of the telephone numbers used, or while intentionally altering its voice to disguise its identity in order to defraud, confuse, or injure the called party or to obtain personal information from them.

A called party aggrieved by a violation may sue under section 13-408 to enjoin it and recover damages of up to $500 or actual damages, whichever is greater, which the court may treble on finding the violation willful or knowing, and a violation is also an unfair, abusive, or deceptive trade practice enforceable under Title 13.

A person may not violate the federal Telemarketing and Consumer Fraud and Abuse Prevention Act, as implemented by the Federal Trade Commission's Telemarketing Sales Rule, or the federal Telephone Consumer Protection Act, as implemented by the Federal Communications Commission's telemarketing and telephone solicitation rules.

A violation of either federal law is also an unfair or deceptive trade practice under Title 13 of the Commercial Law Article and is subject to that title's enforcement and penalty provisions. An individual affected by a violation may separately sue to recover reasonable attorney's fees and damages of $500 for each violation or actual damages, whichever is greater, with each prohibited telephone solicitation and each prohibited practice during one treated as its own separate violation.

A person may not use an automated dialing, push-button, or tone-activated address signaling system with a prerecorded message to solicit the purchase, lease, or rental of goods or services, offer a gift or prize, conduct a poll, or request survey information that will be used directly to solicit purchases.

The prohibition does not apply to a person who has a preexisting business relationship with, or the consent of, the person called, or to a government unit using such a machine for emergency purposes. The sender of such a call must disconnect the prerecorded message machine from the recipient's line within 5 seconds after either party ends the call.

Separately, a person engaged in telephone solicitation whose service or equipment lets it choose to restrict or display its number may not intentionally block, or otherwise act to prevent or control, the transmission of its telephone number to the recipient. A violation of either section is a misdemeanor punishable on conviction by a fine of up to $1,000 for a first offense and up to $5,000 for each subsequent offense; neither section provides a private civil action.

The Stop the Spam Calls Act of 2023 states that it does not preclude these sections from applying to a telephone solicitation it also covers. The sections this entry groups came into force on different days.

Requires online products reasonably likely to be accessed by children under 18 to set high default privacy settings, complete data protection impact assessments, and avoid data practices harmful to children. A First Amendment and federal preemption challenge by NetChoice survived a motion to dismiss in November 2025 and is proceeding without an injunction.