Maryland Online Data Privacy Act of 2024 (S.B. 541 / H.B. 567, Chapter 455 of 2024): profiling opt-out and data protection assessments for each algorithm

Summary

Maryland's comprehensive consumer privacy law (S.B. 541, Chapter 455 of 2024, cross-filed with H.B. 567) took effect on October 1, 2025, and its controller and processor duties apply only to processing on or after April 1, 2026. It applies to persons doing business in Maryland or targeting its residents that, in the preceding year, controlled or processed personal data of at least 35,000 consumers (excluding payment-only data), or of at least 10,000 consumers while deriving more than 20 percent of gross revenue from selling personal data. Financial institutions, their affiliates and data subject to Title V of the Gramm-Leach-Bliley Act are excluded. Consumers may opt out of processing for targeted advertising, sale, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects. Controllers must conduct and document, on a regular basis, a data protection assessment for each processing activity that presents a heightened risk of harm, which includes profiling with a reasonably foreseeable risk of unfair, abusive or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury, and the assessment must cover each algorithm used. Violations are unfair, abusive or deceptive trade practices under the Maryland Consumer Protection Act, enforced by the Attorney General's Consumer Protection Division, without the Act's private damages action; for violations through April 1, 2027, the Division may give at least 60 days to cure.

Key dates

1. May 9, 2024Enacted
2. October 16, 2026Checked against sources
3. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. Maryland Online Data Privacy Act of 2024

   Supports: Name

   PROFILING IN FURTHERANCE OF SOLELY AUTOMATED DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING THE CONSUMER.

   Supports: Profiling opt-out (solely automated decisions)

   A CONTROLLER SHALL CONDUCT AND DOCUMENT, ON A REGULAR BASIS, A DATA PROTECTION ASSESSMENT FOR EACH OF THE CONTROLLER’S PROCESSING ACTIVITIES THAT PRESENT A HEIGHTENED RISK OF HARM TO A CONSUMER, INCLUDING AN ASSESSMENT FOR EACH ALGORITHM THAT IS USED.

   Supports: Assessment duty, including each algorithm

   HAVING AN UNLAWFUL DISPARATE IMPACT ON A CONSUMER;

   Supports: Profiling risk that triggers an assessment

   SUBJECT TO THE ENFORCEMENT AND PENALTY PROVISIONS CONTAINED IN TITLE 13 OF THIS ARTICLE, EXCEPT FOR § 13–408 OF THIS ARTICLE.

   Supports: Enforcement under the Consumer Protection Act

   AT LEAST 60 DAYS TO CURE THE VIOLATION AFTER RECEIPT OF THE NOTICE.

   Supports: Cure period

   Approved by the Governor, May 9, 2024.

   Supports: Approval date

   Chapter 455 of 2024 (S.B. 541), Maryland Online Data Privacy Act of 2024 Maryland General Assembly Primary source

2. Effective Date(s): October 1, 2025

   Supports: Effective date

   SB0541 (2024 Regular Session) Maryland General Assembly Primary source

3. may not be applied or interpreted to have any effect on (or application to) any personal data processing activities before April 1, 2026.

   Supports: Prospective application from April 1, 2026

   controlled or processed the personal data of at least 35,000 consumers (excluding personal data controlled or processed solely for the purpose of completing a payment transaction)

   Supports: Threshold

   Fiscal and Policy Note (Revised), Senate Bill 541 (2024) Maryland Department of Legislative Services Primary source

4. Enacted under Article II, Section 17(c) of the Maryland Constitution – Chapter 874

   Supports: 2026 amendment enacted

   HB0711 (2026 Regular Session), Data Privacy Act Maryland General Assembly Primary source