On April 6, the Maryland legislature passed the Maryland Online Data Privacy Act of 2024, sending the bill to the state’s governor for signing. The bill comes on the heels of the Kentucky Consumer Data Protection Act, which was signed into law on April 4. If the Act is signed into law, it will bring the number of states with comprehensive privacy laws to 16.
The Act would take effect in October 2025.
Maryland is diverging from the typical approach taken in the majority of state privacy laws. In short, the Act is broader, stricter, and more easily triggered. Thus, it warrants careful scrutiny from covered businesses.
Here are some of the ways the Act would be stricter and broader in scope:
- Lower threshold for coverage. The Act would apply to any business that (1) controls or processes personal data of at least 35,000 consumers or (2) controls or processes the personal data of at least 10,000 consumers and derives more than 20 percent of its gross revenue from the sale of personal data.
- Bans on sales of personal data. The Act would ban the sale of “Sensitive Personal Data” without exception. “Sensitive Personal Data” would include data related to an individual's race, religious beliefs, sex life or orientation, genetic or biometric data, Consumer Health Data, or precise (within 1,750 feet) geolocation. The Act would also ban the sale of any personal data about individuals who are under the age of 18.
- Consumer health data. The Act would impose strict data access controls for personnel or subcontractors who access Consumer Health Data. “Consumer Health Data” would be personal data that identifies a consumer’s physical or mental health status, gender-related treatment, or reproductive or sexual health care.
- Children’s data. The Act would prohibit businesses from selling Personal Data without consent if the business knows or “should have known” the individual at issue is under age 18. This language is similar to that found in the Children’s Online Privacy Protection Act, which requires businesses to more proactively monitor whether children under the age of 13 may be using a website. The Act’s requirement may prompt businesses to adopt similar monitoring or age-verification requirements in Maryland (or stop processing such data altogether).
- Universal opt-out mechanisms. The Act’s language with respect to universal opt-out mechanisms, or "UOOMs,” is one area where the Act appears to be more lenient than many other state laws. A UOOM is a signal set at the user’s browser level that tells a site not to collect information like cookies. The Act would appear to make adoption of an UOOM Most state privacy laws make UOOMs mandatory after a certain date. Notably, the Act states that if a business recognizes UOOMs approved by other states, the UOOM will be deemed compliant with the Act.
The Act allows the Maryland Attorney General discretion over when to permit a 60-day cure period for violations. The cure period under the Act is available through April 1, 2027.
If the Act becomes law, covered businesses should review their privacy practices moving into 2025. The Act may require more fine-tuning of compliance processes than other state privacy laws taking effect in the next two years. In particular, businesses covered by the Act should continue carefully evaluating the data they collect, share, and sell in light of the stricter requirements found in this Act.
The Constangy Cybersecurity & Data Privacy Team assists entities of all sizes with their information security and privacy needs – from proactive efforts to comply with applicable regulations or guidance to support with a breach. We are here to help! The Constangy Cyber Team is available 24/7. Contact us at breachresponse@constangy.com or by phone at 877-DTA-BRCH.
- Senior Counsel
Allison is a member of the Constangy Cyber Team and specializes in data privacy and contractual security requirements, and represents clients in high-stakes technology transactions involving intricate regulatory and business ...
The Constangy Cyber Advisor posts regular updates on legislative developments, data privacy, and information security trends. Our blog posts are informed through the Constangy Cyber Team's experience managing thousands of data breaches, providing robust compliance advisory services, and consultation on complex data privacy and security litigation.
Subscribe
Contributors
- Suzie Allen
- John Babione
- Jason Cherry
- Maria Efaplomatidis
- Sebastian Fischer
- Laura Funk
- Lauren Godfrey
- Amir Goodarzi
- Taren N. Greenidge
- Chasity Henry
- Julie Hess
- Sean Hoar
- Donna Maddux
- David McMillan
- Ashley L. Orler
- Allison Prout
- Todd Rowe
- Melissa J. Sachs
- Allen Sattler
- Alyssa Watzman
- Aubrey Weaver
- Xuan Zhou