This bill establishes standards and requirements for fully autonomous vehicles operating on Maryland highways without a human driver. It defines key terms such as fully autonomous vehicles, automated driving systems, and operational design domains to clarify what qualifies under the law. The legislation requires these vehicles to safely reach a minimal risk condition if the system fails and ensures that data collected by them is subject to Maryland's Online Data Privacy Act. Additionally, the bill updates existing commercial and transportation laws to include specific provisions for autonomous vehicle operations and data handling.
SB 632 creates a new Office of State Elected Officials Information Privacy within Maryland’s Department of Legislative Services. It allows state elected officials (the "protected individuals") to request that their personal details - such as addresses, phone numbers, and email - be removed from public online sources like government websites, social media, or social networks. The bill also establishes criminal penalties for intentionally posting an official’s personal information online under certain circumstances. This replaces the existing Address Confidentiality Program for domestic violence survivors with a dedicated system specifically for protecting state elected officials’ privacy.
SB 564 creates a new Division of Data Protection within Maryland’s Office of the Attorney General. This division will investigate and enforce civil actions for violations of existing data privacy laws affecting businesses and consumers. It also establishes a Maryland Data Privacy Implementation and Innovation Workgroup, composed of state officials, consumer advocates, business representatives, and industry experts, to study implementation challenges and recommend improvements. The Workgroup must report its findings to the governor and legislature by January 1, 2027, and the bill’s provisions take effect on July 1, 2026, with the Workgroup structure expiring June 30, 2027.
SB 569 limits how businesses (called "controllers") in Maryland can collect, process, or share personal data. It specifically prohibits selling or collecting sensitive data unless strictly necessary for a requested service, bans using precise geolocation data for targeted ads without consent, and forbids processing data for targeted advertising or selling data of consumers under 18. The bill also prohibits discrimination based on protected characteristics when handling data and bans denying services to consumers who exercise privacy rights. These changes directly affect businesses that collect personal data in Maryland, requiring them to adjust data practices to comply with the new restrictions starting October 1, 2026.
SB 616 creates a Maryland registry requiring businesses that collect and sell personal data (like names, addresses, biometric information, or Social Security numbers) to register annually with the state Comptroller. It defines "data brokers" as entities selling "brokered personal data" but excludes credit bureaus, banks under federal law, and nonprofits assisting law enforcement. The law mandates registration for qualifying businesses to operate, focusing on transparency around how personal data is collected and sold. It specifically covers sensitive data types (e.g., facial recognition, DNA sequences) while clarifying exclusions to avoid overlapping with federal regulations.
SB 827 regulates chatbot design, operation, and safety in Maryland, directly affecting chatbot developers, operators (like companies offering AI assistants), and all users - including minors. Key provisions require clear warnings before use, enhanced privacy protections for minors, strict rules for handling user data (including de-identifying personal information), and treating chatbots as "products" for liability claims. Violations are enforced as unfair trade practices under Maryland’s Consumer Protection Act, with additional penalties. The bill also mandates the Behavioral Health Administration to create educational materials about behavioral health services.
SB 504 prohibits businesses from selling consumer personal data to buyers who intend to use it for immigration enforcement. It defines "sensitive data" to include immigration status, racial origin, health information, and sexual orientation, requiring businesses to handle such data more carefully. The bill also mandates public record custodians to prevent unauthorized disclosure - especially for immigration enforcement - and requires message switching systems to implement access controls. These changes aim to strengthen privacy protections for Maryland residents while modifying existing data privacy laws in the state code.
HB 1261, the Artificial Intelligence Toy Safety Act, requires manufacturers of AI toys marketed to children in Maryland to include specific safety features and data privacy protections. It mandates parental consent mechanisms, age-appropriate content filters to block harmful or inappropriate material (like violence or emotional manipulation), automatic "safe mode" that disables the toy during risky interactions, and prohibitions on using child data for marketing. The law directly affects toy manufacturers selling AI toys in Maryland, requiring them to conduct safety assessments and update software for vulnerabilities. Violations are treated as unfair trade practices under Maryland's Consumer Protection Act, with enforcement handled by a new Review Panel under the Attorney General's office.
SB 659 requires all public and nonpublic primary and secondary schools to adopt written policies protecting student record privacy, including parent access rights and restrictions on sharing personal information without consent. Nonpublic prekindergarten and K-12 schools must annually report the number of alleged discrimination incidents based on protected categories like race, religion, sexual orientation, and disability. The reports must include incidents against students and be submitted starting September 1, 2027. Policies must comply with existing federal and state privacy laws and cannot override those protections. This bill directly affects nonpublic schools through new reporting requirements while expanding privacy safeguards for all schools.
HB 1317 requires Maryland state and local governments to annually report to the Attorney General on all data-sharing agreements with the federal government, starting January 1, 2027. The report must identify all agreements, check if they comply with privacy laws, and suggest fixes for non-compliant ones. The bill also prohibits state/local agencies from sharing specific personal information (including immigration status, religious beliefs, and biometric data) with federal entities unless required by law or court order. Additionally, it bans state/local governments from helping create or maintain federal registries based on race, national origin, or religious affiliation. The law takes effect October 1, 2026.
