Commercial Law - Online Data Privacy - Limits on Data Collection

HB 1365 amends Maryland's Commercial Law to limit how businesses (referred to as "controllers") can collect personal data online. It requires businesses to collect only data that is "adequate, relevant, and reasonably necessary" for the specific purpose disclosed to consumers, and to establish easy consumer opt-out mechanisms for data consent. The bill also mandates businesses to implement reasonable security practices to protect collected data. These changes apply to businesses processing personal data in Maryland and take effect October 1, 2025.