NEWS RELEASE: Act gives Marylanders some of country’s strongest data privacy protections

BALTIMORE – The Maryland Online Data Privacy Act went into effect on October 1, 2025, giving Marylanders some of the strongest data privacy protections in the country, including prohibiting companies from collecting more data than is necessary to deliver a service and stopping them from selling sensitive information–such as personal health data–to third parties. 

Maryland PIRG Foundation has released an accessible tips guide to help Maryland consumers take advantage of these new protections, including tips for setting privacy controls and how to ask data brokers to delete your data.

“For too long, companies have been collecting and selling our personal information without our knowledge or consent,” said Senator Sara Love, who sponsored the bill. “By passing this law, we gave back to consumers control over their own data. I am really proud of the work the General Assembly put into this bill and the way we stood firm to ensure people can protect their private information.”

The United States currently has no comprehensive federal privacy law and over 80% of Americans are concerned with how companies collect and use their data. In response, states are stepping in – Maryland is one of 19 that have passed comprehensive consumer data privacy legislation to date. Maryland’s Act is the second strongest law in the country, according to a report by U.S. PIRG Education Fund and EPIC.

While there were heavy lobbying efforts to weaken Maryland’s bill, these efforts failed to strip the core protections from the legislation.

“When we use our favorite websites and apps, the companies on the other side are often gathering far more data about us than they need and then selling that information to others,” said Ellen Hengesbach, campaign associate with Maryland PIRG Foundation’s Consumer Privacy Program. “These practices are all too common–and dangerous for consumers’ personal security. Maryland’s law finally gives consumers meaningful online privacy and security protections.”

When personal data is exposed, consumers are more likely to become the victim of identity theft or hyper-targeted scams, for example if a con artist gets access to details about a person’s life, such as their work address or names of family and friends.

“Limits on data collection and sales boost our personal security,” said Hengesbach. “The more data that companies collect, and the more other companies they sell it to, the more likely it is that consumers’ information will get exposed in a breach or a hack.”