SB 387 prohibits large food retailers (15,000+ sq ft) in Maryland from using dynamic pricing (real-time price changes based on demand or AI) or consumer surveillance data (like location or biometric tracking) to set prices for individual customers. It also bans using protected class data (e.g., race, gender) to deny accommodations or advantages to consumers. The bill further prevents retailers from reducing union-guaranteed employee benefits without negotiating with union representatives. These provisions aim to regulate pricing practices, prevent discriminatory data use, and protect collective bargaining agreements, with violations subject to enforcement under Maryland’s consumer protection laws.
SB 216 updates Maryland's unemployment insurance confidentiality rules to align with federal requirements. It clarifies that claim details (including benefit amounts, address, and work refusal history), wage information, and other personal data are protected as "confidential unemployment insurance information." The bill allows limited disclosure to child support enforcement agencies when permitted under federal law, while adding penalties for unauthorized leaks by current or former Maryland Department of Labor employees. These changes directly affect unemployment claimants, employers, and child support agencies by defining how personal financial data may be shared.
HB 184 prohibits using personal identifying information (like Social Security numbers or bank details) or artificial intelligence/deepfake representations to cause harm, such as physical injury, emotional distress, or financial loss. It specifically bans maliciously sharing personal data online to harass someone or using AI-generated content that mimics real people to deceive others for fraud, health care access, or other benefits. Victims can file civil lawsuits against those who cause harm through these actions. The bill defines "deepfakes" as computer-generated images indistinguishable from real people (excluding cartoons or sculptures) and clarifies that harm includes emotional or economic damage. It updates Maryland’s criminal law to address identity fraud involving AI, without restricting legitimate uses of technology.
HB 693 creates a legal pathway for minors or their parents to sue commercial websites that knowingly distribute obscene material online to minors. It requires these entities to use reasonable age verification methods (like government ID or commercial systems) to confirm users are 18+ before accessing such content and prohibits retaining any user identifying information after verification. The bill excludes news organizations and internet service providers from these requirements. If a commercial entity violates these rules, affected individuals can seek damages for minors accessing obscene material or for improper retention of personal data. This law directly impacts websites hosting adult content and aims to protect minors from exposure to obscene material online.
HB 264, the Maryland Data Privacy and Protection Act of 2026, sets new rules for how Maryland state government agencies collect, store, and handle personal information. It requires agencies to only collect personal data that is necessary for a legitimate government purpose, delete or remove identifying details when no longer needed, and post clear privacy notices on their websites. The bill specifically defines "sensitive data" (like racial origin, health information, biometric data, and location tracking) and mandates that agencies designate a Privacy Officer to oversee compliance. This law directly affects all Maryland state government units, including departments and agencies, by requiring them to update their data practices to protect residents' privacy.
HB 711, the Data Privacy Act, prohibits businesses from selling consumer data they know or should know will be used for immigration enforcement. It requires public record custodians to prevent unauthorized access to records, especially for immigration purposes, and mandates reasonable rules to block such access. The bill also defines "sensitive data" to include immigration status, health information, racial background, and biometric data, requiring entities to handle this data carefully. Additionally, it sets new rules for message switching systems (like messaging apps) to prevent misuse of user data. These changes directly affect businesses handling consumer data, government record keepers, and digital service providers in Maryland.
HB 566 prohibits distributing a student's personal details - such as name, address, Social Security number, or school address - without their explicit consent (or a parent/guardian's consent if the student is under 18). It specifically targets situations where the distribution is done with intent to cause harm (like physical injury, serious emotional distress, or economic damage) or with reckless disregard for that risk. The law applies to students in secondary schools (grades 6-12) or postsecondary institutions and carries misdemeanor penalties of up to one year in jail or a $5,000 fine for violations. Exceptions include journalistic reporting, academic activities, and disclosures required for campus safety or legal compliance.
SB 8 prohibits using personal identifying information (like Social Security numbers or bank details) or AI-generated deepfakes - defined as computer images indistinguishable from real people - to cause harm, such as physical injury, emotional distress, or financial loss. It bans maliciously disclosing personal details via online services, assuming another’s identity for fraud (e.g., accessing healthcare or avoiding debt), and using devices that copy payment card data without consent. The law directly affects individuals or entities exploiting personal data or deepfakes for fraudulent gain, harassment, or harm. Victims may pursue civil lawsuits against violators, and the bill updates Maryland’s criminal law to address emerging threats from AI and deepfake technology.
SB 121 would create a program allowing specific public servants and their immediate family members (including prosecutors, law enforcement officers, elected officials, and their spouses/children) to request that government entities or individuals remove their personal information - including home addresses, phone numbers, Social Security numbers, and license plate details - from public online platforms like government websites or social media. The bill requires government entities to remove such information within 72 hours of a written request and establishes legal remedies, including injunctions and attorney fees, for violations. It also imposes criminal penalties for knowingly publishing protected individuals' personal information. This bill, currently pre-filed and awaiting committee hearings, does not yet apply as law.
SB 107 prohibits individuals from intentionally sharing students' personal identifying information (like names, addresses, Social Security numbers, or school details) without the student's or parent's consent if the information could cause harm. It directly affects students in secondary schools (grades 6-12) and postsecondary institutions (colleges offering associate/bachelor's degrees). The law allows exceptions for journalists, academic activities, legal disclosures, and safety-related sharing with campus officials. Violations are misdemeanors punishable by up to one year in jail or a $5,000 fine.
