Consumer Protection - Data Broker Registry - Establishment

EXPLANATION: CAPITALS INDICATE MATTER ADDED TO EXISTING LAW.
[Brackets] indicate matter deleted from existing law.
*hb1089*

HOUSE BILL 1089
I3 6lr2873

By: Delegates Wu and Fair
Introduced and read first time: February 10, 2026
Assigned to: Economic Matters

A BILL ENTITLED

AN ACT concerning 1

Consumer Protection – Data Broker Registry – Establishment 2

FOR the purpose of establishing a data broker registry; requiring certain data brokers to 3
register each year with the Office of the Attorney General; requiring a data broker 4
to report certain material changes to the Office of the Attorney General; requiring 5
the Office of the Attorney General to establish a certain publicly accessibl e, 6
searchable database; and generally relating to data brokers. 7

BY adding to 8
Article – Commercial Law 9
Section 14–1330 10
Annotated Code of Maryland 11
(2025 Replacement Volume) 12

SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 13
That the Laws of Maryland read as follows: 14

Article – Commercial Law 15

14–1330. 16

(A) (1) IN THIS SECTION THE FOLLOWING WORDS HAVE THE MEANINGS 17
INDICATED. 18

(2) (I) “DATA BROKER ” MEANS A BUSINESS THA T KNOWINGLY 19
COLLECTS AND SELLS OR LICENSES PERSONAL CONSUMER DATA TO THIRD PARTIES 20
WITH WHOM THE CONSUMER DOES NOT HAVE A DIRECT RELATIONSHIP. 21

(II) “DATA BROKER” DOES NOT INCLUDE: 22

2 HOUSE BILL 1089

1. A FINANCIAL INSTITUTIO N UNDER THE 1
GRAMM–LEACH–BLILEY ACT, PUBLIC LAW 106–102; 2

2. A COVERED HEALTH CARE ENTITY SUBJECT TO TH E 3
HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996; 4

3. A NONPROFIT ORGANIZATION; 5

4. A GOVERNMENTAL ENTITY; OR 6

5. A SERVICE PROVIDER THAT PROCESSES DATA SOLELY 7
ON BEHALF OF A CONTROLLER, AS DEFINED IN § 14–4701 OF THIS TITLE. 8

(3) “MATERIAL CHANGE” MEANS A SIGNIFICANT UPDATE IN HOW A 9
DATA BROKER COLLECTS, USES, SHARES, OR SELLS PERSONAL INFORMATION, OR A 10
TRANSITION FROM SELLING TO SHARING DATA. 11

(B) THE GENERAL ASSEMBLY FINDS THAT: 12

(1) PERSONAL DATA CONCERN ING MARYLAND RESIDENTS IS 13
ROUTINELY COLLECTED, AGGREGATED, AND SOLD BY ENTITIES KNOWN AS DATA 14
BROKERS; 15

(2) MARYLAND RESIDENTS CU RRENTLY LACK A CLEAR , 16
CENTRALIZED MEANS TO IDENTIFY DATA BROKERS OR UNDERSTAND DATA BROKER 17
PRACTICES; AND 18

(3) REGISTRATION AND TRAN SPARENCY REQUIREMENT S ARE 19
NECESSARY TO PROTECT CONSUMERS, PREVENT FRAUD , AND MODERNIZE 20
CONSUMER PROTECTION LAW. 21

(C) THE PURPOSE OF THIS SECTION IS TO PROVIDE BASIC OVERSIGHT OF 22
DATA BROKER ACTIVITY BY THE STATE WITHOUT RESTRIC TING LAWFUL 23
COMMERCE. 24

(D) ON OR BEFORE JANUARY 31 EACH YEAR , BEGINNING JANUARY 31, 25
2028, A DATA BROKER OPERATING IN THE STATE OR COLLECTING DATA O N THE 26
RESIDENTS OF THE STATE SHALL REGISTER WITH THE OFFICE OF THE ATTORNEY 27
GENERAL BY: 28

(1) SUBMITTING THE FOLLOWING ON A FORM AND IN A F ORMAT 29
ESTABLISHED BY THE OFFICE OF THE ATTORNEY GENERAL: 30

HOUSE BILL 1089 3

(I) CATEGORIES OF PERSONAL DATA COLLECTED BY THE DATA 1
BROKER; 2

(II) SOURCES OF PERSONAL DATA COLLECTED; 3

(III) CATEGORIES OF THIRD PARTIES TO WHOM DATA IS SOLD OR 4
SHARED; 5

(IV) CONTACT INFORMATION T HAT CONSUMERS MAY US E TO 6
MAKE INQUIRIES; AND 7

(V) OPT–OUT METHODS OFFERED TO CONSUMERS, IF ANY; AND 8

(2) PAYING A FEE IN AN AMOUNT DETERMINED BY THE OFFICE OF 9
THE ATTORNEY GENERAL. 10

(E) THE OFFICE OF THE ATTORNEY GENERAL SHALL ESTABLISH THE FEE 11
REQUIRED UNDER SUBSECTION (D)(2) OF THIS SECTION: 12

(1) IN AN AMOUNT SUFFICIE NT TO PAY THE COSTS OF 13
ADMINISTERING THE RE GISTRATION PROGRAM E STABLISHED UNDER THI S 14
SECTION; AND 15

(2) AS A TIERED FEE STRUC TURE BASED ON THE ANNUAL REVENUE 16
OF A DATA BROKER. 17

(F) (1) A DATA BROKER SHALL REPORT TO THE OFFICE OF THE 18
ATTORNEY GENERAL ANY MATERIAL CHANGE IN THE BUSINESS PRACTICE OF THE 19
DATA BROKER DURING A REGISTRATION PERIOD. 20

(2) THE ATTORNEY GENERAL MAY NOT CHARG E A FEE FOR THE 21
REPORTING OF A MATERIAL CHANGE BY A DATA BROKER UNDER PARAGRAPH (1) OF 22
THIS SUBSECTION. 23

(G) (1) THE OFFICE OF THE ATTORNEY GENERAL SHALL DEVELOP AND 24
MAINTAIN A PUBLICLY ACCESSIBLE, SEARCHABLE DATABASE OF REGISTERED DATA 25
BROKERS ON THE WEBSITE OF THE OFFICE OF THE ATTORNEY GENERAL. 26

(2) THE DATABASE DESCRIBE D UNDER PARAGRAPH (1) OF THIS 27
SUBSECTION: 28

(I) EXCEPT AS PROVIDED UN DER ITEM (II) OF THIS 29
PARAGRAPH, SHALL CONTAIN INFORM ATION SUBMITTED TO T HE OFFICE OF THE 30
4 HOUSE BILL 1089

ATTORNEY GENERAL UNDER SUBSECTION (D) OF THIS SECTION; AND 1

(II) MAY NOT DISCLOSE ANY PROPRIETARY ALGORITH M OR 2
TRADE SECRET OF A DATA BROKER. 3

(H) (1) SUBJECT TO PARAGRAPH (2) OF THIS SUBSECTION , A DATA 4
BROKER THAT FAILS TO REGISTER WITH AND DI SCLOSE REQUIRED INFO RMATION 5
TO THE OFFICE OF THE ATTORNEY GENERAL IN ACCORDANCE WITH THIS SECTION 6
IS SUBJECT TO A CIVIL FINE UP TO $10,000 PER VIOLATION. 7

(2) (I) FOR A FIRST VIOLATION OF THIS SECTION, THE OFFICE OF 8
THE ATTORNEY GENERAL SHALL ISSUE NOTICE O F THE VIOLATION TO THE DAT A 9
BROKER BEFORE INITIATING ANY ACTION UNDER THIS SUBSECTION. 10

(II) IF THE OFFICE OF THE ATTORNEY GENERAL ISSUES A 11
NOTICE OF THE VIOLAT ION UNDER SUBPARAGRAPH (I) OF THIS PARAGRAPH, THE 12
DATA BROKER SHALL HAVE 6 MONTHS TO CURE THE VIOLATION AFTER RECEIPT OF 13
THE NOTICE. 14

(III) IF A DATA BROKER FAILS TO CURE A VIOLATION WITHIN THE 15
TIME PERIOD SPECIFIE D IN A NOTICE UNDER SUBPARAGRAPH (II) OF THIS 16
PARAGRAPH, THE OFFICE OF THE ATTORNEY GENERAL MAY BRING AN 17
ENFORCEMENT ACTION UNDER THIS SUBSECTION. 18

(I) THIS SECTION MAY NOT BE CONSTRUED TO CREA TE OR IMPLY A 19
PRIVATE CAUSE OF ACTION FOR A VIOLATION OF ITS PROVISIONS. 20

(J) THE OFFICE OF THE ATTORNEY GENERAL SHALL ADOPT REGULATIONS 21
TO CARRY OUT THIS SECTION. 22

SECTION 2. AND BE IT FURTHER ENACTED, That, on or before December 31, 23
2029, the Office of the Attorney General shall report to the General Assembly, in accordance 24
with § 2–1257 of the State Government Article: 25

(1) the number of registered data brokers in the State; 26

(2) the level of compliance rates among data brokers; 27

(3) the number of consumer complaints regarding data brokers received by 28
the Office of the Attorney General; and 29

(4) recommendations by the Office of the Attorney General for future 30
legislation to strengthen consumer protection in the State relating to data brokers. 31

HOUSE BILL 1089 5

SECTION 3. AND BE IT FURTHER ENACTED, That this Act shall take effect 1
October 1, 2026. 2