Commercial Law - Online Data Privacy - Limits on Data Collection
Summary
SB 569 would amend Maryland’s Online Data Privacy subtitle to place additional limits on how a controller may collect, process, share, or sell personal data. The bill keeps the existing framework for consumer privacy protections but adds a new restriction on the use of precise geolocation data: unless the controller obtains the consumer’s consent, it could not collect, process, share, or sell precise geolocation data for targeted advertising. The bill also clarifies the definition of “process” by stating that deleting personal data, or efforts made solely to identify data for deletion or data minimization, are not included in that term.
More broadly, the bill reinforces existing prohibitions on sensitive data collection, sale of sensitive data, discriminatory data practices, and targeted advertising or sale of data involving minors. It preserves the rule that controllers may not process personal data in ways that are not reasonably necessary or compatible with the disclosed purposes, unless the consumer consents. The bill is scheduled to take effect October 1, 2026.
Impact
If enacted, SB 569 would amend Title 14, Subtitle 47 of the Commercial Law Article, Maryland’s consumer data privacy law, by narrowing permissible data practices for controllers and adding a specific consent requirement for precise geolocation data used in targeted advertising. It would also update the statutory definition of “process” to exclude deletion-related activity and data-minimization efforts, which may affect compliance obligations, internal data handling, and privacy program design for businesses subject to the law. Consumers would gain an additional safeguard against location-based advertising, while controllers would need to review consent flows and data-use policies.
Sentiment
Based on the bill text alone and the absence of recorded committee testimony or votes, the bill appears to reflect a generally privacy-protective approach rather than a controversial policy shift. Its changes are incremental and consistent with existing consumer data protection themes in Maryland law, suggesting the measure is aimed at strengthening consumer control over personal information. No formal vote history or hearing record is provided here, so there is no documented opposition or support to characterize beyond the bill’s protective intent.
Contention
The main likely point of contention is the new restriction on precise geolocation data for targeted advertising, which could be viewed by privacy advocates as a necessary consumer safeguard but by advertisers, ad-tech firms, and some data brokers as a limitation on digital marketing practices. Another possible area of discussion is the consent requirement for broader processing beyond disclosed purposes, though that provision largely tracks existing privacy-law concepts. The deletion/data-minimization clarification is less likely to be controversial and appears intended to reduce ambiguity in compliance obligations.