New Data Privacy Law Will Give Marylanders New Rights

ANNAPOLIS, Md. — Maryland residents will soon gain new protections over how their personal data is collected and used. Senate Bill 541 and its cross-filed companion House Bill 567, known as the Maryland Online Data Privacy Act of 2024, take effect on October 1, 2025.

The measure was originally sponsored in the Senate by several Democratic senators, including Brian Feldman [D-Montgomery], and in the House by Delegate Sara Love [D-Montgomery] with 16 co-sponsors. It was signed into law last spring by Governor Wes Moore[D] after a series of debates over consumer protections and business obligations. Lawmakers described it as one of the strongest state-level privacy statutes in the country.

“It puts guardrails up on the amount of data that companies can collect on people online and also what they do with that data, and it gives consumers more control over their own data,” Love told AP News.

The House approved the measure on a 92–42 vote, and the Senate later passed it 31–14. Support fell largely along party lines, with Democrats in favor and a small number of Republicans joining them.

Under the new statute, covered businesses must disclose the types of data they collect and how they use it. Maryland residents gain the right to access their personal information, request corrections, demand deletion in many cases, and opt out of targeted advertising or the sale of their information.

The law applies to companies that process the personal data of at least 35,000 Marylanders each year, or 10,000 if more than 20 percent of revenue is derived from selling personal data. State and local agencies, courts, and entities already covered by federal privacy frameworks are exempt, along with certain categories of health and financial records.

Although the law becomes effective in October, many requirements for businesses apply only to data processing activities after April 1, 2026.

Enforcement of this new law falls to the Attorney General’s Consumer Protection Division.

Violations are treated as unfair or deceptive trade practices under the Maryland Consumer Protection Act, carrying civil penalties of up to $10,000 per violation and $25,000 for repeat violations. Criminal misdemeanor penalties could include fines of up to $1,000 and one year in jail.

The Attorney General may first issue a notice of violation and allow at least 60 days to cure the problem, a provision that will remain in effect for alleged violations through April 1, 2027. Regulators may also require companies to produce confidential data protection assessments when their practices present heightened risks, such as processing sensitive information or selling data to third parties.

The Maryland Chamber of Commerce and TechNet, a national network of technology executives, were among the groups that opposed the measure, warning that compliance costs could burden mid-sized businesses and that Maryland’s framework might conflict with federal rules. Privacy advocates, including the Electronic Privacy Information Center, argued the protections were long overdue as residents face growing threats of data breaches and misuse.

Maryland becomes one of more than a dozen states, including California, Colorado, Virginia, and Connecticut, that have passed comprehensive consumer data privacy laws in recent years.

As the Oct. 1 effective date approaches, the Attorney General’s office is preparing guidance for companies, while consumer advocates stress that Marylanders should be ready to exercise their new rights from day one.

The Maryland Online Privacy Act is only one of several new Maryland laws scheduled to take effect in October. Check out The BayNet roundup highlights other changes in criminal justice, family law, and landlord–tenant rules.

---

Got a tip or photo? Text us at 888-871-NEWS (6397) or email news@thebaynet.com. 

Join The BayNet Membership for exclusive perks and zero ads. 

Don’t miss a story—sign up for our newsletter!