Business Regulation - Data Broker Registry

EXPLANATION: CAPITALS INDICATE MATTER ADDED TO EXISTING LAW.
[Brackets] indicate matter deleted from existing law.
*sb0616*

SENATE BILL 616
C2, P1, I3 6lr0731
CF 6lr1663
By: Senators Hester, Gile, Ferguson, Love, Hettleman, Lam, and King
Introduced and read first time: February 5, 2026
Assigned to: Finance

A BILL ENTITLED

AN ACT concerning 1

Business Regulation – Data Broker Registry 2

FOR the purpose of establishing a data broker registry; requiring certain data brokers to 3
register each year with the Comptroller; and generally relating to data brokers. 4

BY adding to 5
Article – Business Regulation 6
Section 19–1001 through 19 –1005 to be under the new subtitle “Subtitle 10. Data 7
Broker Registry” 8
Annotated Code of Maryland 9
(2024 Replacement Volume and 2025 Supplement) 10

SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND, 11
That the Laws of Maryland read as follows: 12

Article – Business Regulation 13

SUBTITLE 10. DATA BROKER REGISTRY. 14

19–1001. 15

(A) IN THIS SUBTITLE THE FOLLOWING WORDS HAVE THE MEANI NGS 16
INDICATED. 17

(B) (1) “BIOMETRIC INFORMATION” MEANS A RECORD OF ONE OR MORE 18
MEASURABLE BIOLOGICAL OR BEHAVIORAL CHARACTERISTICS THAT CAN BE USED 19
ALONE OR IN COMBINATION WITH EACH OTHER OR WITH OTHER INFORMATION FOR 20
AUTOMATED RECOGNITION OF A KNOWN OR UNKNOWN INDIVIDUAL. 21

2 SENATE BILL 616

(2) “BIOMETRIC INFORMATION” INCLUDES: 1

(I) FINGERPRINTS; 2

(II) RETINA AND IRIS PATTERNS; 3

(III) VOICEPRINTS; 4

(IV) DNA SEQUENCE; 5

(V) FACIAL CHARACTERISTICS; 6

(VI) GAIT; 7

(VII) HANDWRITING; 8

(VIII) KEYSTROKE DYNAMICS; AND 9

(IX) MOUSE MOVEMENTS. 10

(3) “BIOMETRIC INFORMATION” DOES NOT INCLUDE: 11

(I) WRITING SAMPLES; 12

(II) WRITTEN SIGNATURES; 13

(III) HUMAN BIOLOGICAL SAMPLES USED FOR VALID SCIENTIFIC 14
TESTING OR SCREENING; 15

(IV) DEMOGRAPHIC DATA; 16

(V) TATTOO DESCRIPTIONS; 17

(VI) PHYSICAL DESCRIPTIONS, SUCH AS HEIGHT, WEIGHT, HAIR 18
COLOR, OR EYE COLOR; OR 19

(VII) DONATED ORGANS , TISSUES, OR PARTS , OR BLOOD OR 20
SERUM STORED ON BEHALF OF RECIPIENTS OR POTENTIAL RECIPIENTS OF LIVING 21
OR CADAVERIC TRANSPL ANTS AND OBTAIN ED OR STORED BY A FE DERALLY 22
DESIGNATED ORGAN PROCUREMENT AGENCY. 23

SENATE BILL 616 3

(C) “BROKERED PERSONAL DAT A” MEANS ANY OF THE FOL LOWING 1
COMPUTERIZED DATA ELEMENTS ABOUT A RESIDENT INDIVIDUAL, IF CATEGORIZED 2
OR ORGANIZED FOR SALE OR LICENSING TO ANOTHER ENTITY: 3

(1) THE RESIDENT INDIVIDUAL’S NAME OR THE NAME O F A MEMBER 4
OF THE RESIDENT INDIVIDUAL’S IMMEDIATE FAMILY OR HOUSEHOLD; 5

(2) THE RESIDENT INDIVID UAL’S ADDRESS OR AN ADDR ESS FOR A 6
MEMBER OF THE RESIDENT INDIVIDUAL’S IMMEDIATE FAMILY OR HOUSEHOLD; 7

(3) THE RESIDENT INDIVIDUAL’S DATE OF BIRTH OR PLACE OF BIRTH; 8

(4) THE MAIDEN NAME OF THE RESIDENT INDIVIDUAL’S MOTHER; 9

(5) BIOMETRIC INFORMATION ABOUT THE RESIDENT INDIVIDUAL; 10

(6) PERSONAL DATA ABOUT THE RESIDENT INDIVIDUAL; 11

(7) THE RESIDENT INDIVIDUAL’S SOCIAL SECURITY NUMBER OR THE 12
NUMBER OF ANY OTHER GOVERNMENT–ISSUED IDENTIFICATIO N FOR THE 13
RESIDENT INDIVIDUAL; OR 14

(8) OTHER INFORMATION TH AT, ALONE OR IN COMBINAT ION WITH 15
OTHER INFORMATION TH AT IS SOLD OR LICENS ED, CAN REASONABLY BE 16
ASSOCIATED WITH THE RESIDENT INDIVIDUAL. 17

(D) (1) “BUSINESS ENTITY” MEANS: 18

(I) A RESIDENT INDIVIDUA L WHO REGULARLY ENGA GES IN 19
COMMERCIAL ACTIVITY FOR THE PURPOSE OF GENERATING INCOME; 20

(II) A CORPORATION OR NON PROFIT CORPORATION , LIMITED 21
LIABILITY COMPANY , PARTNERSHIP OR LIMITED LIABI LITY PARTNERSHIP , 22
BUSINESS TRUST , JOINT VENTURE , OR ANY OTHER FORM OF BUSINESS 23
ORGANIZATION THE CONSTITUENT PARTS OF WHICH SHARE A COMMON ECONOMIC 24
INTEREST; OR 25

(III) AN INDIVIDUAL THAT CONTROLS, IS CONTROLLED BY, OR IS 26
UNDER COMMON CONTROL WITH A PERSON DESCRIBED IN ITEM (I) OR (II) OF THIS 27
PARAGRAPH. 28

(2) “BUSINESS ENTITY” DOES NOT INCLUDE THE STATE OR A UNIT OF 29
THE STATE, A LOCAL GOVERNMENT , OR A BUSINESS ENTITY OR OTHER PERSON 30
4 SENATE BILL 616

DURING A PERIOD IN W HICH THE BUSINESS ENTITY OR PERSON IS ACTING SOLELY 1
ON BEHALF OF AND AT THE DIRECTION OF THE STATE, A UNIT OF THE STATE, OR A 2
LOCAL GOVERNMENT. 3

(E) (1) “DATA BROKER” MEANS ANY BUSINESS ENTITY THAT ENGAGES IN 4
DATA BROKERING. 5

(2) “DATA BROKER” DOES NOT INCLUDE: 6

(I) A CONSUMER REPORTING AGENCY , AS DEFINED IN 15 7
U.S.C. § 1681A, A PERSON THAT FURNIS HES INFORMATION TO A CONSUMER 8
REPORTING AGENCY , AS PROVIDED IN 15 U.S.C. § 1681S–2, OR A USER OF A 9
CONSUMER REPORT, AS DEFINED IN 15 U.S.C. § 1681A, TO THE EXTENT THAT T HE 10
CONSUMER REPORTING AGENCY, THE PERSON THAT FURNISHES INFORMATION TO 11
A CONSUMER REPORTING AGENCY, OR THE USER OF A CONSUMER REPORT ENGAGES 12
IN ACTIVITIES THAT A RE SUBJECT TO REGULA TION UNDER THE FEDER AL FAIR 13
CREDIT REPORTING ACT, 15 U.S.C. § 1681; 14

(II) A FINANCIAL INSTITUT ION, AN AFFILIATE , OR A 15
NONAFFILIATED THIRD PARTY, AS THOSE TERMS ARE DEFINED IN 15 U.S.C. § 6809, 16
TO THE EXTENT THAT THE FINANCIAL INSTITUTION, AFFILIATE, OR NONAFFILIATED 17
THIRD PARTY IS SUBJE CT TO REGULATION UND ER TITLE V OF THE 18
GRAMM–LEACH–BLILEY ACT, 15 U.S.C. §§ 6801 THROUGH 6809 AND REGULATIONS 19
ADOPTED UNDER TITLE V OF THE GRAMM–LEACH–BLILEY ACT; OR 20

(III) A NONPROFIT ORGANIZA TION THAT IS ORGANIZ ED FOR 21
PURPOSES OF ASSISTING: 22

1. LAW ENFORCEMENT AGEN CIES IN INVESTIGATIN G 23
CRIMINAL OR FRAUDULENT ACTS RELATING TO INSURANCE; OR 24

2. FIRST RESPONDERS IN RESPONDING TO 25
EMERGENCIES OR CATASTROPHIC EVENTS. 26

(F) (1) “DATA BROKERING” MEANS THE ACT OF COL LECTING, SELLING, 27
OR LICENSING BROKERED PERSONAL DATA. 28

(2) “DATA BROKERING ” DOES NOT INCLUDE A B USINESS ENTITY ’S 29
COLLECTION, SALE, OR LICENSING OF BROK ERED PERSONAL DATA F ROM A 30
CONSUMER WITH WHOM T HE BUSINESS ENTITY H AS A DIRECT RELATION SHIP 31
BECAUSE THE CONSUMER IS: 32

SENATE BILL 616 5

(I) A CUSTOMER, CLIENT, SUBSCRIBER, USER, OR REGISTERED 1
USER OF THE BUSINESS ENTITY’S GOODS OR SERVICES IN THE IMMEDIATELY 2
PRECEDING 5 CALENDAR YEARS; 3

(II) AN EMPLOYEE , A CONTRACTOR, OR AN AGENT OF THE 4
BUSINESS ENTITY; OR 5

(III) AN INVESTOR IN THE BUSINESS ENTITY. 6

(G) “DE–IDENTIFIED DATA” MEANS DATA THAT CANNO T REASONABLY BE 7
USED TO INFER INFORMATION ABOUT OR OTHERWISE BE LINKED TO AN IDENTIFIED 8
OR IDENTIFIABLE INDI VIDUAL OR A DEVICE L INKED TO THAT INDIVI DUAL, 9
PROVIDED THAT THE PERSON IN CONTROL OF THE DATA: 10

(1) TAKES REASONABLE MEA SURES TO ENSURE THAT THE D ATA 11
CANNOT BE ASSOCIATED WITH A NATURAL PERSON; 12

(2) PUBLICLY COMMITS TO MAINTAIN AND USE THE DATA ONLY IN A 13
DE–IDENTIFIED FASHION AND NOT ATTEMPT TO RE–IDENTIFY THE DATA; AND 14

(3) CONTRACTUALLY OBLIGA TES ANY RECIPIENTS O F THE 15
INFORMATION TO COMPLY WITH ALL PROVISIONS OF THIS SUBSECTION. 16

(H) (1) “PERSONAL DATA” MEANS ANY INFORMATION THAT IS LINKED OR 17
REASONABLY LINKED TO AN IDENTIFIED OR IDENTIFIABLE NATURAL PERSON. 18

(2) “PERSONAL DATA” DOES NOT INCLUDE DE–IDENTIFIED DATA OR 19
PUBLICLY AVAILABLE INFORMATION. 20

(I) “RESIDENT INDIVIDUAL” MEANS AN INDIVIDUAL WHO RESIDES IN THE 21
STATE. 22

19–1002. 23

(A) EXCEPT AS PROVIDED IN SUBSECTION (B) OF THIS SECTION , A DATA 24
BROKER SHALL REGISTER WITH THE COMPTROLLER AS PROVIDED IN § 19–1003 OF 25
THIS SUBTITLE. 26

(B) A DATA BROKER IS NOT R EQUIRED TO REGISTER WITH THE 27
COMPTROLLER IF THE ONLY BROKERED PERSONAL DATA INVOLVES: 28

(1) PROVIDING PUBLICLY A VAILABLE INFORMATION THAT IS 29
RELATED TO A RESIDENT INDIVIDUAL’S BUSINESS OR PROFESSION; 30
6 SENATE BILL 616

(2) PROVIDING PUBLICLY A VAILABLE INFORMATION AS PART OF A 1
SERVICE THAT PROVIDES ALERTS FOR HEALTH OR SAFETY PURPOSES; 2

(3) PROVIDING DIRECTORY ASSISTANCE OR DIRECT ORY 3
INFORMATION SERVICES AS OR ON BEHALF OF A TELECOMMUNICATIONS CARRIER; 4
OR 5

(4) SELLING THE ASSETS OF A BUSINESS ENTITY OR A PART OF A 6
BUSINESS ENTITY A SINGLE TIME OR ONLY OCCASIONALLY AS PART OF A TRANSFER 7
OF CONTROL OVER THE ASSETS THAT IS NOT PART OF THE ORDINARY CONDUCT OF 8
THE BUSINESS ENTITY OR THE PART OF THE BUSINESS ENTITY. 9

19–1003. 10

(A) (1) ON OR BEFORE JANUARY 31 EACH YEAR , A BUSINESS ENTITY 11
THAT ACTED AS A DATA BROKER DURING THE PREVIOUS CALENDAR YEAR SHALL: 12

(I) SUBMIT ON A FORM AND IN A FORMAT THE COMPTROLLER 13
SPECIFIES: 14

1. THE NAME OF THE DATA BROKER; 15

2. THE STREET AD DRESS AND TELEPHONE NUMBER OF 16
THE DATA BROKER; AND 17

3. THE DATA BROKER’S PRIMARY WEBSITE AN D E–MAIL 18
ADDRESS; 19

(II) PAY A FEE IN AN AMOU NT THAT THE COMPTROLLER 20
DETERMINES; AND 21

(III) INCLUDE WITH THE REG ISTRATION FORM A DEC LARATION 22
IN WHICH THE DATA BROKER: 23

1. STATES WHETHER A RES IDENT INDIVIDUAL ’S 24
PRECISE GEOLOCATION INFORMATION IS A PAR T OF THE DATA BROKER ’S DATA 25
BROKERING ACTIVITY; 26

2. STATES WHETHER A RESIDENT INDIVIDUAL ’S 27
CONSUMER HEALTH DATA IS A PART OF THE DAT A BROKER ’S DATA BROKERING 28
ACTIVITY; 29

SENATE BILL 616 7

3. STATES WHETHER RESID ENT INDIVIDUALS MAY OPT 1
OUT OF ALL OR A PORT ION OF THE DATA BROK ER’S USE OF THEIR BROKE RED 2
PERSONAL DATA; 3

4. A. IDENTIFIES WHICH OF THE DATA BROK ER’S 4
ACTIVITIES A RESIDENT INDIVIDUAL MAY OPT OUT OF; AND 5

B. IDENTIFIES WHICH POR TION OF A RESIDENT 6
INDIVIDUAL’S BROKERED PERSONAL DATA THE RESIDENT IN DIVIDUAL MAY OPT 7
OUT FROM PROVIDING OR PERMITTING THE DATA BROKER TO USE; 8

5. DESCRIBES THE METH OD BY WHICH A RESIDE NT 9
INDIVIDUAL MAY EXERC ISE THE CHOICES DESC RIBED IN ITEMS 3 AND 4 OF THIS 10
ITEM; AND 11

6. STATES WHETHER A RES IDENT INDIVIDUAL MAY 12
AUTHORIZE AN INDIVIDUAL TO EXERCISE THE OPTIONS DESCRIBED IN ITEMS 3 AND 13
4 OF THIS ITEM ON THE RESIDENT INDIVIDUAL’S BEHALF AND , IF SO , THE 14
APPROPRIATE PROCESS FOR THE AUTHORIZATION. 15

(2) (I) THE COMPTROLLER SHALL ESTABLISH THE FEE REQUIRED 16
UNDER PARAGRAPH (1)(II) OF THIS SUBSECTION IN AN AMOUNT THAT IS SUFFICIENT 17
TO PAY THE COSTS OF ADMINISTERING THE REGISTRATION PROGRAM ESTABLISHED 18
UNDER THIS SUBTITLE. 19

(II) 1. THE FEES COLLECTED UNDER THIS SUBSECTION 20
SHALL BE USED TO ADMINISTER THE REGISTRATION PROGRAM. 21

2. ANY FUNDS REMAINING AFTER THE EXPENDITURE OF 22
FUNDS UNDER SUBSUBPA RAGRAPH 1 OF THIS SUBPARAGRAPH SHALL B E 23
DISTRIBUTED BY THE COMPTROLLER TO THE OFFICE OF THE ATTORNEY GENERAL 24
TO BE USED FOR THE E NFORCEMENT OF THE MARYLAND AGE–APPROPRIATE 25
DESIGN CODE ACT, THE ONLINE DATA PRIVACY ACT, AND ANY STATE OR FEDERAL 26
LAWS INVOLVING TECHN OLOGY, ONLINE SERVICES AND PROD UCTS, 27
CYBERSECURITY, ARTIFICIAL INTELLIGENCE, AND DIGITAL PRIVACY. 28

(B) (1) IF A BUSINESS ENTITY COMPLIES WITH THE RE QUIREMENTS OF 29
THIS SECTION, THE COMPTROLLER SHALL APPROVE THE REGISTRATION. 30

(2) A REGISTRATION UNDER T HIS SECTION IS VALID UNTIL 31
DECEMBER 31 OF THE YEAR IN WHICH THE COMPTROLLER APPROVES THE 32
REGISTRATION. 33

8 SENATE BILL 616

19–1004. 1

(A) THE COMPTROLLER SHALL MAKE THE INFOR MATION THAT BUSINESS 2
ENTITIES SUBMIT FOR REGISTRATION UNDER THIS SUBTITLE PUBLICLY AVAILABLE 3
ON THE OFFICE’S WEBSITE. 4

(B) ON OR BEFORE DECEMBER 31, 2027, AND EACH DECEMBER 31 5
THEREAFTER, THE COMPTROLLER SHALL REPORT TO THE GOVERNOR AND , IN 6
ACCORDANCE WITH § 2–1257 OF THE STATE GOVERNMENT ARTICLE, TO THE 7
GENERAL ASSEMBLY ON THE FOLLOWING: 8

(1) HOW MANY BUSINESS EN TITIES REGISTERED WI TH THE 9
COMPTROLLER AS DATA BROKERS IN THAT YEAR; 10

(2) THE FEE CHARGED FOR REGISTRATION PER DAT A BROKER AND 11
THE TOTAL REVENUE COLLECTED; 12

(3) HOW MANY BUSINESS EN TITIES WERE FINED FO R 13
NONCOMPLIANCE WITH THIS SUBTITLE; AND 14

(4) ANY OTHER INFORMATIO N THE COMPTROLLER DETERMINES IS 15
RELEVANT. 16

19–1005. 17

(A) A BUSINESS ENTITY THAT FAILS TO REGISTER WITH THE OFFICE OF THE 18
ATTORNEY GENERAL IN ACCORDANCE WITH THIS SUBTITLE SHALL BE LIABLE FOR: 19

(1) A FINE OF $200 FOR EACH DAY THE BUSINESS ENTITY FAILS TO 20
REGISTER; AND 21

(2) THE EXPENSES INCURRE D BY THE OFFICE OF THE ATTORNEY 22
GENERAL IN INVESTIGATING THE DATA BROKER’S FAILURE TO REGISTER. 23

(B) FINES COLLECTED UNDER THIS SECTION SHALL BE USED FOR TH E 24
ENFORCEMENT BY THE OFFICE OF THE ATTORNEY GENERAL OF THE MARYLAND 25
AGE–APPROPRIATE DESIGN CODE ACT, THE ONLINE DATA PRIVACY ACT, AND ANY 26
STATE OR FEDERAL LAWS INVOLVING TECHNOLOGY , ONLINE SERVICES AND 27
PRODUCTS, CYBERSECURITY, ARTIFICIAL INTELLIGENCE, AND DIGITAL PRIVACY. 28

SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect 29
October 1, 2026. 30