MD SB504

Controllers are prohibited from selling personal data if they knew or should have known the purchaser intends to use it for immigration enforcement

Public record custodians must take reasonable steps to determine if someone seeking access is doing so for immigration enforcement purposes, and must deny access to personal information, photographs, or facial recognition searches unless presented with a valid warrant clearly identifying the record

The definition of "precise geolocation data" is expanded to include tracking of mobile devices and vehicles within a 1,750-foot radius, not just consumers

Law enforcement message switching systems must deny access to anyone seeking information for immigration enforcement without a valid warrant, and users must provide contact information and a sworn statement that they are not accessing for immigration purposes

Government entities must develop procedures by July 1, 2026 to prevent sale and redisclosure of personal records and data containing sensitive attributes (including citizenship/immigration status, racial/ethnic origin, and religious beliefs)