Commercial Law - Online Data Privacy - Limits on Data Collection

EXPLANATION: CAPITALS INDICATE MATTER ADDED TO EXISTING LAW.
[Brackets] indicate matter deleted from existing law.
*sb0569*

SENATE BILL 569
I3 6lr3135

By: Senator Ellis
Introduced and read first time: February 4, 2026
Assigned to: Finance

A BILL ENTITLED

AN ACT concerning 1

Commercial Law – Online Data Privacy – Limits on Data Collection 2

FOR the purpose of altering certain requirements for a controller relating to the collection 3
of personal data; and generally relating to the collection and processing of person al 4
data. 5

BY repealing and reenacting, without amendments, 6
Article – Commercial Law 7
Section 14–4701(a) and (k) 8
Annotated Code of Maryland 9
(2025 Replacement Volume) 10

BY repealing and reenacting, with amendments, 11
Article – Commercial Law 12
Section 14–4701(y) and 14–4707(a) 13
Annotated Code of Maryland 14
(2025 Replacement Volume) 15

SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 16
That the Laws of Maryland read as follows: 17

Article – Commercial Law 18

14–4701. 19

(a) In this subtitle the following words have the meanings indicated. 20

(k) “Controller” means a person that, alone or jointly with others, determines the 21
purpose and means of processing personal data. 22

2 SENATE BILL 569

(y) (1) “Process” means an operation or set of operations performed by manual 1
or automated means on personal data. 2

(2) “Process” includes collecting, using, storing, disclosing, analyzing, 3
[deleting,] or modifying personal data. 4

(3) “PROCESS” DOES NOT INCLUDE DELETING PERSONAL DATA OR 5
EFFORTS MADE TO IDEN TIFY PERSONAL DATA S OLELY FOR THE PURPOS E OF 6
DELETION OR DATA MINIMIZATION. 7

14–4707. 8

(a) A controller may not: 9

(1) Except where the collection or processing is strictly necessary to provide 10
or maintain a specific product or service requested by the consumer to whom the personal 11
data pertains, collect, process, or share sensitive data concerning a consumer; 12

(2) Sell sensitive data; 13

(3) Process personal data in violation of State or federal laws that prohibit 14
unlawful discrimination; 15

(4) Process the personal data of a consumer for the purposes of targeted 16
advertising if the controller knew or should have known that the consumer is under the age 17
of 18 years; 18

(5) Sell the personal data of a consumer if the controller kn ew or should 19
have known that the consumer is under the age of 18 years; 20

(6) Discriminate against a consumer for exercising a consumer right 21
contained in this subtitle, including denying goods or services, charging different prices or 22
rates for goods or services, or providing a different level of quality of goods or services to 23
the consumer; 24

(7) Collect, process, or transfer personal data or publicly available data in 25
a manner that unlawfully discriminates in or otherwise unlawfully makes unavailable the 26
equal enjoyment of goods or services on the basis of race, color, religion, national origin, 27
sex, sexual orientation, gender identity, or disability, unless the collection, processing, or 28
transfer of personal data is for: 29

(i) The controller’s self –testing to prevent or mitigate unlawful 30
discrimination; 31

(ii) The controller’s diversifying of an applicant, participant, or 32
customer pool; or 33

SENATE BILL 569 3

(iii) A private club or group not open to the public, as described in § 1
201(e) of the Civil Rights Act of 1964; [or] 2

(8) Unless the controller obtains the consumer’s consent, process personal 3
data for a purpose that is neither reasonably necessary to, nor compatible with, the 4
disclosed purposes for which the personal data is processed, as disclosed to the co nsumer; 5
OR 6

(9) UNLESS THE CONTROLLER OBTAINS THE CONSUMER’S CONSENT, 7
COLLECT, PROCESS, SHARE, OR SELL PRECISE GEOL OCATION DATA FOR THE 8
PURPOSE OF TARGETED ADVERTISING. 9

SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect 10
October 1, 2026. 11