Maryland HB 711 (2026) MODPA Amendments

Expands the Maryland Online Data Privacy Act definition of sensitive data to inferred data and restricts sales to immigration enforcement entities.

JurisdictionMaryland
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Maryland HB 711 (2026) modifies the Maryland Online Data Privacy Act (MODPA) to broaden “sensitive data” to include inferred sensitive attributes and to restrict the sale and disclosure of personal data for immigration enforcement purposes, with an effective date of July 1, 2026. According to the official bill file and related fiscal/policy notes, HB 711 is now Chapter 874 of the 2026 Regular Session and directly amends MODPA’s definitions and government‑sale restrictions.Maryland General Assembly HB 711 bill file Maryland General Assembly HB 711 first reader PDF Maryland General Assembly HB 711 legislation page

Key Requirements

Expanded “Sensitive Data” – Including Inferred Attributes

  • MODPA’s definition of “sensitive data” is expanded to include inferred data indicating sensitive attributes (e.g., inferred race, religion, health status, sexual orientation, immigration status, and similar protected characteristics).
  • The fiscal and policy note for HB 711 explains that the bill “modifies the Online Data Privacy Act” and creates a new category of sensitive attributes, indicating that inferred attributes are treated as sensitive.Fiscal and Policy Note – HB 711
  • Committee testimony submitted to the Economic Matters Committee describes HB 711 as amending MODPA to create a new category of sensitive attributes and prohibiting sale and certain uses of sensitive data for immigration enforcement, confirming the explicit treatment of sensitive attributes and associated data.Economic Matters Committee Testimony – HB 711 (K. Valderrama)
  • Public advocacy testimony notes that Maryland Online Data Privacy Act (MODPA) already provided protections and that HB 711 extends those protections by defining and limiting use of sensitive attributes and data.CASA Testimony on HB 711
  • Controllers must treat inferred sensitive attributes as “sensitive data” for all MODPA purposes, including heightened consent requirements, use restrictions, and data minimization.
  • MODPA’s base framework treats “sensitive data” as subject to stricter rules (e.g., specific consent for certain processing), and HB 711’s expansion of the definition ensures that inferred attributes fall into that regime.Maryland Online Data Privacy Act overview – Enzuzo
  • Industry analyses of HB 711 confirm that inferred sensitive attributes (race, health, sexual orientation, immigration status, etc.) now carry full sensitive‑data protections under amended MODPA.Maryland Data Privacy Laws – MODPA Consumer Rights Guide

Restrictions on Sales for Immigration Enforcement

  • Prohibition on selling personal data to government units involved in civil immigration enforcement.
  • HB 711 bars a controller from knowingly selling a consumer’s personal data to any federal, state, or local governmental unit that, within the preceding six months, has engaged in or supported civil immigration enforcement through personnel or material resources.Maryland General Assembly HB 711 third reader bill text
  • The fiscal and policy note explains that HB 711 modifies law governing access to law enforcement databases and public records to enhance protection of personal data when used for immigration enforcement, confirming the focus on immigration‑related restrictions.Fiscal and Policy Note – HB 711
  • Detailed statutory analysis indicates that amended § 14‑4707 of MODPA prohibits such sales where the purchaser is known to have supported civil immigration enforcement in the prior six months.Maryland Data Privacy Laws – MODPA Consumer Rights Guide
  • Prohibition on selling personal data when the controller knows or should know the data will be used for immigration enforcement.
  • HB 711 prevents controllers from selling personal data to any purchaser the controller knows or reasonably should know intends to use the data for immigration enforcement, regardless of the purchaser’s status as a government entity.Maryland Data Privacy Laws – MODPA Consumer Rights Guide
  • Implementation guides for MODPA compliance emphasize that a controller must evaluate the intended use of data by buyers and cannot sell when the purpose is immigration enforcement, except where a valid, particularized court warrant applies.Maryland Online Data Privacy Act compliance guide – Enzuzo
  • Narrowed law‑enforcement and subpoena exceptions; warrant carve‑out remains.
  • HB 711 narrows MODPA’s exception that previously allowed disclosures to law enforcement, in response to subpoenas or summonses, by restricting these if the requesting entity has engaged in or supported civil immigration enforcement.House Bill 711 Third Reader – Sam Castic summary
  • The amendment preserves an exception for valid court‑issued warrants that “particularly describe the personal data to be accessed”, meaning controllers may disclose data in response to such warrants even when immigration enforcement is involved.House Bill 711 Third Reader – Sam Castic summary
  • Industry commentary confirms that this warrant carve‑out is the main statutory exception to HB 711’s sale restrictions.Maryland Bars Data Sales to ICE Under HB 711

Government Entity Procedures and Redisclosure Controls

  • Government entities must develop and publish procedures to prevent harmful sale and redisclosure of personal records and sensitive data.
  • HB 711 (Chapter 874) requires each governmental entity to develop and publish procedures to prevent the sale and redisclosure of personal records and “sensitive data containing sensitive attributes” in ways that harm Maryland residents’ privacy, by its effective date.Global Compliance Map – Maryland HB 711 overview
  • The fiscal note confirms that the bill imposes a local government mandate by requiring governmental entities to strengthen procedures on personal records and access to law enforcement databases.Legislation – HB 0711, Effective Date and Local Government Mandate
  • Commentary on Chapter 874 highlights that these procedures are part of broader efforts to ensure that government‑held data is not misused for immigration enforcement beyond explicit legal processes.Minnesota & Maryland Privacy Law 2026 Changes – HB 711 overview

Compliance Challenges

Identifying “Inferred” Sensitive Data

  • Challenge: distinguishing ordinary analytics from “inferred sensitive attributes.”
  • Organizations that perform profiling or analytics (e.g., marketing segmentation, risk scoring) often struggle to determine when a model output constitutes an inference about race, religion, health, sexual orientation, or immigration status under MODPA.Maryland Online Data Privacy Act compliance guide – Enzuzo
  • Industry guidance notes that Maryland’s expanded definition means even indirectly deduced attributes, such as inferring immigration status from language, location, or document patterns, must be treated as sensitive.Maryland Data Privacy Laws – MODPA Consumer Rights Guide
  • Comparative analyses of HB 711 point out that Maryland’s approach to inferred data is more expansive than most other state privacy laws, causing confusion in cross‑jurisdictional programs.Global Compliance Map – Maryland HB 711 (MODPA Amendments)

Mapping Data Flows to Immigration Enforcement

  • Challenge: understanding whether data buyers or recipients are engaged in or support civil immigration enforcement.
  • HB 711 focuses on buyers that have engaged in or supported civil immigration enforcement within the last six months, a factual determination that can be difficult for private companies.Maryland General Assembly HB 711 third reader bill text
  • Legal practitioners analyzing HB 711 warn that controllers must implement due diligence processes to identify government entities and third‑party purchasers with immigration enforcement roles, especially in complex vendor ecosystems.House Bill 711 Third Reader – Sam Castic summary
  • Policy analysis of the bill emphasises that message‑switching systems, law enforcement databases, and public records are specifically implicated, increasing complexity for entities that route or host government data.Fiscal and Policy Note – HB 711

Updating Contracts and Law‑Enforcement Response Playbooks

  • Challenge: revising law‑enforcement response procedures to comply with narrowed exceptions.
  • Organizations must ensure internal subpoena/warrant response processes distinguish between requests that qualify under HB 711’s warrant carve‑out and those from entities engaged in immigration enforcement.House Bill 711 Third Reader – Sam Castic summary
  • MODPA compliance guides show that many organizations already found it difficult to implement consent, access, and deletion rights; HB 711 adds another layer by constraining government disclosures and sales, intensifying operational burdens.Maryland Online Data Privacy Act compliance guide – Enzuzo
  • Analyses of Maryland privacy laws indicate that contracts with data brokers, resellers, and government agencies must be reviewed to avoid prohibited immigration‑related data sales and redisclosures.Maryland Data Privacy Laws – MODPA Consumer Rights Guide

Real‑World Examples and Emerging Practice

  • Example: banning sales to immigration enforcement agencies and data brokers serving them.
  • Reporting on HB 711 explains that the law bars businesses from knowingly selling personal data to government units supporting civil immigration enforcement, including agencies that provide personnel or material resources to immigration authorities.Maryland Bars Data Sales to ICE Under HB 711
  • Cross‑state comparison pieces note that Maryland’s law uniquely targets immigration enforcement data pipelines, citing concerns over data brokers selling location and personal data for immigration enforcement activities.Minnesota & Maryland Privacy Law 2026 Changes – HB 711 overview
  • Public advocacy testimony on HB 711 references prior use of government and private databases for immigration enforcement, illustrating the risk scenarios the law is designed to prevent.CASA Testimony on HB 711

Implementation Best Practices

1. Build a Sensitive‑Data and Inference Inventory

2. Implement Immigration‑Use Screening for Data Sales and Disclosures

  • Actionable step: introduce buyer and recipient screening controls.
  • Controllers should implement procedures to determine whether potential data buyers or government recipients have recently engaged in or supported civil immigration enforcement, leveraging public information and contract disclosures.Maryland General Assembly HB 711 third reader bill text
  • Legal practice commentary recommends updating due diligence questionnaires and contract clauses to prohibit use of purchased data for immigration enforcement and to require notification if the buyer begins supporting such activities.House Bill 711 Third Reader – Sam Castic summary
  • Industry overviews of HB 711 highlight the need for monitoring and auditing mechanisms to ensure ongoing compliance with the six‑month “engaged or supported” test.Maryland Bars Data Sales to ICE Under HB 711

3. Update Law‑Enforcement Response Policies and Training

  • Actionable step: re‑design law‑enforcement request procedures to incorporate HB 711 warrant rules.
  • Organizations should require that any data disclosure for immigration enforcement be supported by a valid court‑issued warrant that particularly describes the data, and explicitly reject subpoenas or summonses from entities engaged in civil immigration enforcement where no such warrant exists.House Bill 711 Third Reader – Sam Castic summary
  • MODPA implementation guides encourage standardized playbooks for responding to government requests, incorporating state‑specific requirements like HB 711.Maryland Online Data Privacy Act compliance guide – Enzuzo
  • Policy analyses of HB 711 recommend training legal, compliance, and customer‑data teams on immigration‑related restrictions to avoid accidental non‑compliance.Fiscal and Policy Note – HB 711

4. Align with Recognized Privacy Frameworks and Tools

Recent Updates

  • HB 711 status and effective date.
  • The official Maryland General Assembly legislation page lists HB 711 with an effective date of July 1, 2026, confirming when MODPA amendments take effect.[Maryland General Assembly Legislation – HB0711](https://

Recent developments

  • — Overview of Maryland data protection and privacy regulation noting that a **2026 amendment to MODPA (HB 711)** strengthened sensitive‑data and immigration‑related protections effective **2026-07-01**, positioning Maryland as a leading state on privacy limits tied to immigration enforcement.[15] (source)
  • — Analysis explaining that **HB 711 took effect on 2026-07-01** and explicitly **bars controllers from knowingly selling personal data to any governmental unit that has engaged in or supported civil immigration enforcement in the preceding six months**, making Maryland’s approach unusually direct compared with other state privacy laws.[6] (source)
  • — Same article describes operational impact on businesses subject to MODPA: controllers must build processes to identify government purchasers linked to immigration enforcement and apply a six‑month look‑back, increasing due‑diligence and contract‑review burdens for data brokers and SaaS providers.[6] (source)
  • — Chapter 874 text confirming that **HB 711 (MODPA amendments) took effect on 2026-07-01** and requires each governmental entity, by that date, to **develop and publish procedures to prevent the sale and redisclosure of personal records and “sensitive data containing sensitive attributes”** in ways that harm Maryland residents’ privacy.[8] (source)
  • — Policy note: governmental entities must submit these privacy‑protective procedures to the General Assembly, signaling tighter internal controls on how state agencies share data externally, including with law enforcement and immigration authorities.[8] (source)
  • — Legislative history page showing **HB 711** as enacted MODPA amendments in the 2026 Regular Session, detailing subject matter around consumer data, public records, and law‑enforcement “message switching systems,” and reflecting updates posted through mid‑August 2026.[1] (source)
  • — Industry overview noting that HB 711 **expands the definition of sensitive data to include inferred sensitive data** (e.g., inferred race, religion, health, sexual orientation, immigration status) and **restricts sales of personal data to government entities that have recently engaged in or supported immigration enforcement**, creating broader consent and data‑minimization obligations for covered businesses.[14] (source)
  • — Practitioner commentary outlining that HB 711 **narrows law‑enforcement and government exceptions under MODPA**: disclosures based on subpoenas or cooperation are limited when agencies are known to engage in civil immigration enforcement, and sales of personal data to such agencies are prohibited, prompting compliance teams to revisit government‑data‑sharing workflows.[3] (source)
  • — Testimony from the Maryland Division of Consumer Protection indicating concern that HB 711’s new “sensitive attributes” category adds complexity to MODPA’s framework, foreshadowing implementation challenges for regulators and businesses that must map and treat these attributes differently across systems.[11] (source)
  • — Report on Economic Matters Committee action describing HB 711 as tightening Maryland’s data‑privacy and driver‑privacy rules to **restrict sharing with federal immigration enforcement absent a warrant**, add a **six‑month look‑back standard** for agencies involved in immigration enforcement, and drive procurement and systems changes at DPSCS and MVA worth about **$4.3 million**, highlighting significant operational and budget impacts.[12] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates