MD HB1365

Amends Maryland's Online Data Privacy Act (Chapter 454 of 2024) to change the standard for personal data collection by data controllers

Replaces the requirement that data collection be "reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer" with a broader standard requiring collection be "adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed, as disclosed to the consumer"

Maintains existing requirements for controllers to implement reasonable data security practices and provide easy mechanisms for consumers to revoke consent

Effective date is October 1, 2025, tied to the effective dates of Chapters 424 and 425 of the 2024 Acts of the General Assembly