Maryland (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Maryland Online Data Privacy Act | Md. Code, Com. Law 14-4701 to 14-4714 (2024 Md. Laws chs. 454 and 455) | In force | 1 October 2025 |
| Maryland Personal Information Protection Act | Md. Code, Com. Law 14-3501 to 14-3508 (2007 Md. Laws ch. 531) | In force | 1 January 2008 |
| Maryland Age-Appropriate Design Code Act (Maryland Kids Code) | Md. Code, Com. Law 14-4801 to 14-4813 (2024 Md. Laws chs. 460 and 461) | In force | 1 October 2024 |
- Maryland Online Data Privacy Act: Amended by 2026 Md. Laws ch. 874 (HB 711) from 1 July 2026.
- Maryland Age-Appropriate Design Code Act (Maryland Kids Code): Challenged in NetChoice v. Brown (D. Md. No. 1:25-cv-00322), filed on 3 February 2025. The court refused to dismiss the case on 24 November 2025, and it was in discovery in September 2026, with no injunction against the law.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Applies to businesses active in Maryland or targeting its residents that in the previous year handled data of 35,000+ Maryland consumers (not counting payment-only data), or 10,000+ while earning over 20% of gross revenue from selling data. Non-profits are covered. Government, GLBA financial institutions and insurance-business data are exempt, and HIPAA-protected health information is excluded. Employees and B2B contacts aren’t consumers.
Sources: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · oag.maryland.gov/resources-info/Pages/data-privacy.aspx
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases, but strict minimisation. Collect only what’s reasonably necessary and proportionate to provide a product or service the consumer asked for. Collect or use sensitive data only when strictly necessary for that product or service, and never sell it, even with consent; since 1 July 2026 this includes data used to infer a sensitive trait. Consumers can access, correct, delete and port data and opt out of targeted advertising, sale and profiling, with replies due within 45 days (extendable by 45).
Sources: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/2026RS/Chapters_noln/CH_874_hb0711t.pdf · oag.maryland.gov/resources-info/Pages/data-privacy.aspx
Consent age for online services
Section titled “Consent age for online services”A child is under 13 (as in COPPA), and a child’s data is sensitive data. A controller must not sell personal data of anyone under 18, or use it for targeted advertising, if it knew or should have known their age. This ban has no consent exception. The Kids Code treats everyone under 18 as a child.
Sources: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText
Children
Section titled “Children”The Kids Code covers for-profit online services likely to be used by under-18s, if they have $25 million+ revenue, buy, receive, sell or share data of 50,000+ people a year, or earn half their revenue from selling data. They must act in children’s best interests, set high-privacy defaults, avoid profiling and precise geolocation by default, and do an impact assessment for each such product (existing ones by 1 April 2026). NetChoice’s challenge to it was in discovery in September 2026, and no court had blocked it.
Sources: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · govinfo.gov/content/pkg/USCOURTS-mdd-1_25-cv-00322/pdf/USCOURTS-mdd-1… · govinfo.gov/content/pkg/USCOURTS-mdd-1_25-cv-00322/pdf/USCOURTS-mdd-1…
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. Controllers must disclose targeted advertising and sale prominently and offer a secure way to opt out. The law lists a clear opt-out link and, from 1 October 2025, an opt-out preference signal such as Global Privacy Control as ways to do this; it doesn’t plainly say signals must be honoured, but recognising signals approved by other states counts as compliance. Geofences within 1,750 feet of mental health or reproductive health facilities, used to track or message people about their health, are banned.
Sources: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText
Electronic marketing
Section titled “Electronic marketing”Under the Stop the Spam Calls Act, automated or prerecorded sales calls and texts need the recipient’s prior express written consent. Sales calls are banned between 8 p.m. and 8 a.m. and limited to three a day on the same subject, and caller ID must not be hidden; recipients can sue for up to $500 or their actual damages. Commercial email must not use false origin details or misleading subject lines.
Sources: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText
Breach notification
Section titled “Breach notification”Investigate promptly. Unless misuse is unlikely, notify affected Maryland residents as soon as reasonably practicable and within 45 days of discovering the breach, and notify the Attorney General before telling them, whatever the number affected. If 1,000 or more people are notified, also tell the national consumer reporting agencies. A service provider must tell the data owner within 10 days. Keep records of a no-notice decision for 3 years.
Sources: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText
Registration and fees
Section titled “Registration and fees”No registration or fee. Bills to create a Maryland data broker registry did not pass in 2025 or 2026.
Sources: mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0904 · mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0616 · mgaleg.maryland.gov/mgawebsite/Legislation/Details/hb1220
Data protection officer
Section titled “Data protection officer”No duty to appoint a data protection officer.
Sources: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText
International transfers
Section titled “International transfers”No cross-border transfer rules (federal rules are in us-federal). Processors need a binding contract. Since 1 July 2026, a controller must not knowingly sell personal data to a government unit that supported civil immigration enforcement in the previous 6 months, and the exceptions for answering subpoenas or helping law enforcement don’t cover such units unless they bring a valid court warrant.
Sources: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/2026RS/Chapters_noln/CH_874_hb0711t.pdf · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText
Impact assessments
Section titled “Impact assessments”Controllers must regularly conduct and document an assessment of each processing activity with a heightened risk of harm (targeted advertising, sale, sensitive data or risky profiling), including one for each algorithm used, weighing necessity and proportionality. This applies to processing from 1 October 2025. The Attorney General’s Division can require assessments.
Sources: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText
Automated decisions and AI
Section titled “Automated decisions and AI”Consumers can opt out of profiling for solely automated decisions with legal or similarly significant effects, and profiling with foreseeable risks needs an assessment covering each algorithm. Controllers must not process data in ways that unlawfully discriminate. We found no Maryland AI law with duties for private businesses generally.
Sources: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText
Penalties
Section titled “Penalties”The Attorney General’s Consumer Protection Division enforces under the Consumer Protection Act, with civil penalties up to $10,000 per violation and $25,000 for repeats. For violations on or before 1 April 2027 it may offer at least 60 days to cure. Consumers can’t sue under the privacy act. Kids Code penalties are up to $2,500 per affected child for negligent and $7,500 for intentional violations.
Sources: mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText · mgaleg.maryland.gov/mgawebsite/Laws/StatuteText
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-md.yaml.