MD SB616

Establishes a mandatory data broker registry administered by the Maryland Comptroller, requiring annual registration by January 31 for any business entity that collected, sold, or licensed personal data about Maryland residents during the previous calendar year

Data brokers must disclose whether they collect precise geolocation information or consumer health data, and must state whether residents can opt out of data collection and the method for doing so

Registration fees will be set by the Comptroller to cover program administration costs, with excess funds directed to the Attorney General's Office for enforcement of privacy and technology-related laws

Non-compliant data brokers face fines of $200 per day for failure to register, plus reimbursement of the Attorney General's investigation expenses

Exempts consumer reporting agencies regulated under the Fair Credit Reporting Act, financial institutions subject to Gramm-Leach-Bliley Act, and businesses that only broker data about individuals with whom they have a direct customer or employment relationship within the past 5 years; effective October 1, 2026