Data Brokers - Registry and Gross Income Tax (Building Information Guardrails Data Act of 2025)
SB 904 creates a new regulatory and tax framework for data brokers in Maryland. It establishes a Privacy Protection and Enforcement Unit within the Office of the Attorney General’s Division of Consumer Protection, with responsibility for enforcing Maryland’s age-appropriate design law and other state and federal laws involving technology, cybersecurity, artificial intelligence, and digital privacy. The bill also creates a statewide data broker registry administered by the Comptroller, requiring covered data brokers to register annually and disclose basic business information and certain details about whether they handle precise geolocation data, consumer health data, and opt-out rights for residents.
In addition to registration, the bill imposes a 6% gross income tax on a data broker’s apportioned income from data brokering activities. The bill defines key terms broadly, including “data broker,” “brokered personal data,” “biometric information,” and “data brokering,” while carving out certain entities and activities such as consumer reporting agencies and some financial institutions. It also sets out apportionment rules, filing and payment requirements, recordkeeping obligations, and enforcement provisions, including penalties for failure to file or filing false returns. The tax applies to taxable years beginning on or after December 31, 2026.
The bill directs revenue from the new tax first to administrative costs, then to several special funds: the Attorney General’s privacy enforcement unit, the Information Technology Investment Fund for AI-related projects, Maryland Public Television for K-12 digital literacy support, and the Coordinated Community Supports Partnership Fund, with remaining revenue going to the Blueprint for Maryland’s Future Fund. It also makes conforming changes to tax administration statutes so the Comptroller can administer, assess, and enforce the new tax like other state taxes. Separate amendments clarify that the privacy unit also enforces the Online Data Privacy Act.
Because there were no committee transcripts or recorded votes provided, there is no documented floor or committee sentiment in the materials beyond the bill’s structure and sponsors. The bill’s overall framing suggests a strong consumer-protection and privacy-policy orientation, with an emphasis on regulating data brokerage, funding enforcement, and supporting digital literacy and AI-related state capacity. The absence of recorded opposition or amendments in the provided context limits any conclusion about legislative support or resistance.
The main points of potential contention are likely to be the creation of a new tax on data brokers, the breadth of the definition of data brokering and brokered personal data, and the compliance burden of annual registration and reporting. Data brokers and related business entities may object to the 6% gross income tax, public disclosure of registration information, and the scope of the unit’s enforcement authority, while supporters are likely to view the bill as a privacy, consumer protection, and revenue measure aimed at addressing modern digital data practices.
SB 904 would add a new Title 7.3 to the Tax-General Article establishing a data broker registry and gross income tax, and it would amend multiple tax administration provisions so the Comptroller can collect, assess, and enforce that tax. It also creates a new special fund for a Privacy Protection and Enforcement Unit in the Commercial Law Article, and it directs portions of tax revenue to education and technology-related funds. The bill would therefore affect data brokers, the Attorney General’s consumer protection division, the Comptroller, and several state funds tied to privacy enforcement, AI, digital literacy, and education finance.
The bill appears generally favorable toward stronger privacy regulation, consumer protection, and new public funding streams, based on its sponsors and policy design. No committee testimony or vote record was provided, so there is no direct evidence of opposition or support in the legislative history supplied. On its face, the bill reflects a proactive regulatory approach to data brokers and digital privacy, with an emphasis on enforcement and revenue generation for public purposes.
The most likely areas of contention are the new 6% gross income tax, the annual registration requirement, and the breadth of the bill’s definitions and disclosure obligations. Data brokers and other affected business entities may argue that the tax is burdensome, that the registry and reporting requirements are intrusive, and that the law could sweep in legitimate data-related activities. Supporters are likely to emphasize privacy protection, transparency, and funding for enforcement and digital literacy. The bill also raises possible debate over whether revenue should be dedicated to privacy enforcement, AI projects, education, and the Blueprint fund rather than returned to the general fund.