Maryland Online Data Privacy Act, controller prohibitions (sensitive data) (Md. Code, Com. Law 14-4707(a)(1)-(2))
Maryland goes beyond consent: sensitive data may be used only when strictly necessary for the service the consumer asked for, and selling it is banned outright, so it cannot be licensed for AI training even with consent.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“(a) A controller may not: ... (1) Except where the collection or processing is strictly necessary to provide or maintain a specific product or service requested by the consumer to whom the personal data pertains, collect, process, or share sensitive data concerning a consumer; ... (2) Sell sensitive data;”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide