MD SB904

Establishes a Privacy Protection and Enforcement Unit within the Attorney General's Office to protect individuals' digital privacy, enforce the Maryland Age-Appropriate Design Code Act, and address unfair practices involving AI, cybersecurity, and online privacy

Requires data brokers to register annually with the Comptroller by January 31, providing business information and disclosing whether they collect geolocation data, consumer health data, and whether consumers can opt out of data collection

Imposes a 6% gross income tax on data brokers, apportioned based on the percentage of Maryland addresses in the personal data sold or licensed

Distributes tax revenue to multiple funds: $2.5 million minimum (or 0.75%) each to the Privacy Protection Unit, Information Technology Investment Fund for AI projects, and Maryland Public Television for K-12 digital literacy; $120 million minimum (or 35%) to the Coordinated Community Supports Partnership Fund; remainder to the Blueprint for Maryland's Future Fund

Defines "data broker" as any business entity that collects, aggregates, analyzes, buys, sells, or shares personal data, excluding consumer reporting agencies regulated under federal law and financial institutions regulated under Gramm-Leach-Bliley Act