MD HB1089

Establishes a data broker registry requiring businesses that collect and sell personal consumer data to third parties to register annually with the Office of the Attorney General, beginning January 31, 2028

Registration requires disclosure of data categories collected, data sources, third-party recipients, consumer contact information, and opt-out methods, along with payment of a tiered fee based on annual revenue

Exempts financial institutions under Gramm-Leach-Bliley, HIPAA-covered health care entities, nonprofit organizations, governmental entities, and service providers processing data solely on behalf of a controller

Data brokers failing to register face civil fines up to $10,000 per violation, though first-time violators receive notice and a 6-month cure period before enforcement action

Office of the Attorney General must create a publicly searchable database of registered data brokers and report to the General Assembly by December 31, 2029 on registration numbers, compliance rates, and consumer complaints