SB 504 Maryland Senate · 2026 Regular Session

Data Privacy - Consumer Data, Public Records, and Message Switching System (Data Privacy Act)

SB 504 prohibits businesses from selling consumer personal data to buyers who intend to use it for immigration enforcement. It defines "sensitive data" to include immigration status, racial origin, health information, and sexual orientation, requiring businesses to handle such data more carefully. The bill also mandates public record custodians to prevent unauthorized disclosure - especially for immigration enforcement - and requires message switching systems to implement access controls. These changes aim to strengthen privacy protections for Maryland residents while modifying existing data privacy laws in the state code.

Bill status passed 3 of 5 stages cleared

Introduction

Feb 2026

Committee Review

Apr 2026

Senate Passage

Apr 2026

House of Delegates Passage

Governor

Introduced Feb 2, 2026 Last action Apr 13, 2026

Maddy AI version diff · 1 comparison

What changed between versions

First - Data Privacy - Consumer Data, Public Records, and Message Switching System (Data Privacy Act) → Third - Data Privacy - Consumer Data, Public Records, and Message Switching System (Data Privacy Act) · 4 edits

MODERATE

The bill was amended to strengthen data privacy protections by explicitly prohibiting the sale of consumer data to governmental units engaged in civil immigration enforcement and clarifying the definition of sensitive personal data. These changes ensure that data brokers cannot monetize consumer information for immigration purposes and that specific categories of sensitive data are clearly defined to prevent misuse.

Scope change

The bill's scope was expanded to explicitly include restrictions on selling data to governmental units that have engaged in or supported civil immigration enforcement under certain circumstances.

REQUIREMENT

Added language prohibiting the sale of personal data to governmental units that have engaged in or supported civil immigration enforcement under certain circumstances.

Added a new subsection (P-1) to the Commercial Law article defining 'Division' as having the meaning stated in a specific section of the same article.

DEFINITION

Revised the definition of 'Sensitive Attribute' to use a numbered list format and explicitly include 'Citizenship or immigration status' as a protected sensitive attribute.

Updated the definition of 'Publicly available information' to clarify that it does not include information obtained from government records unless the recipient complies with all restrictions and terms of use imposed by the government entity.

Floor votes · Senate Mar 25, 2026

How they voted

37–10

Passed · 2 other

Total votes 49

Mar 25, 2026

D Democratic36

35 Yea 1

97% Yea

R Republican13

2 Yea 10 Nay 1

76% Nay

Vote distribution

All Yea All Nay Mixed No data

Full legislative history

Actions timeline

Total actions

Key actions

Committee

Apr 13, 2026

Committee

Referred Rules and Executive Nominations

lower

Apr 13, 2026

Upper · Passed

Third Reading Passed

upper

Apr 10, 2026

Upper · Passed

Favorable with Amendments {

upper

Apr 10, 2026

Upper · Passed

Favorable with Amendments Report by Finance

upper

Mar 25, 2026

Senate · Passed

Senate Vote: pass (37-10-2)

senate

Feb 2, 2026

Committee

First Reading Finance

upper

1 primary · 0 co-sponsors