United States of America: Implemented Maryland Online Data Privacy Act (HB 0567 / SB 0641)

On 1 October 2025, the Maryland Online Data Privacy Act (HB 0567 / SB 0641) came into effect. The Act outlines consumer rights regarding the deletion and opt-out of personal data processing, imposing responsibilities on data controllers to establish secure methods for exercising these rights free of charge and providing timely responses to consumer requests. Additionally, it establishes rules and procedures governing data collection, processing, and disclosure, including prohibitions on discrimination and requirements for transparent privacy notices. Specifically, data collection must be limited to what is necessary for requested services and mechanisms for consent revocation must be provided. Contracts between controllers and processors must meet specified requirements, and stricter procedures apply to processing activities posing higher risks to consumers. Furthermore, the Act designates the Office of the Attorney General to oversee compliance and assess data protection practices, ensuring adherence to its provisions while maintaining confidentiality.