WeVote
Log In

Bill

Bill

SB 904

Data Brokers - Registry and Gross Income Tax (Building Information Guardrails Data Act of 2025)

2025 Regular Session Introduced by Bill Ferguson and 4 co-sponsors

Imposes a 6% Maryland gross-income tax on data brokers to fund a new Privacy Protection and Enforcement Unit in the Attorney General’s Office and related privacy programs.

Hearing 3/05 at 1:00 p.m. (Budget and Taxation)
0
WeVote Research Nonpartisan
Bill Summary · SB 904

SB 904 — Building Information Guardrails Data Act of 2025

Summary prepared from bill text, fiscal note, and legislative history

Purpose

SB 904 creates a regulatory and enforcement framework for “data brokers,” establishes a new privacy enforcement unit in the Maryland Attorney General’s Office, and imposes a 6% gross‑income tax on data brokering activity. Revenues are directed to several special funds intended to support privacy enforcement, AI projects, digital literacy, community supports, and education.

Key provisions

Privacy Protection and Enforcement Unit (OAG)

  • Establishes a Privacy Protection and Enforcement Unit within the Division of Consumer Protection, Office of the Attorney General.
  • Unit duties: enforce the Maryland Age‑Appropriate Design Code Act and other state/federal laws on technology, AI, cybersecurity, and digital privacy; provide consumer education; coordinate with other agencies.
  • A continuing, nonlapsing special fund is created to support the unit; it receives a dedicated share of data broker tax revenues.

Data Broker Gross Income Tax

  • Imposes a 6% tax on a data broker’s annual gross income from “data brokering,” apportioned to Maryland via an apportionment formula (formula details not in the fiscal note).
  • “Gross income” means revenue from collecting, aggregating, analyzing, buying, selling, and sharing brokered personal data, without deductions for costs or expenses.
  • Exclusions: entities covered by the Fair Credit Reporting Act (consumer reporting agencies) and certain financial institutions under Gramm‑Leach‑Bliley provisions.
  • Tax returns due April 15 following the calendar year; required to be filed under oath and records retained.
  • Willful failure to file is a misdemeanor: up to $5,000 fine and/or up to five years imprisonment.

Revenue distribution (after Comptroller administrative deduction)

  • Greater of 0.75% or $2.5 million → Privacy Protection and Enforcement Unit special fund.
  • Greater of 0.75% or $2.5 million → Information Technology Investment Fund (for expedited AI projects).
  • Greater of 0.75% or $2.5 million → Maryland Public Television special fund for K–12 digital literacy.
  • Greater of 35% or $120 million → Coordinated Community Supports Partnership Fund.
  • Remainder → Blueprint for Maryland’s Future Fund (BMFF).

Data Broker Registry and Reporting

  • Requires annual registration with the Comptroller for data brokers (registrations valid one year). Registrations must include specified business and data‑type information.
  • Certain activities (publicly available business/professional info, health/safety alerts, directory assistance, occasional asset sales) are exempt.
  • Comptroller publishes registrant information online and must report annually by Dec 31 on registrations, fees collected, enforcement actions, and other relevant data.
  • Comptroller sets a registration fee sufficient to cover administration; fee revenue deposited to the general fund.

Fiscal impact (from fiscal note)

  • Significant special fund revenue beginning FY2027. One scenario estimates $90 million in the first full year of tax collection and over $100 million by year four.
  • State expenditures: Comptroller implementation ~$1.6 million (FY2027) and $0.3 million (FY2030); OAG unit ~$1.3 million (FY2026) and ~$1.8 million (FY2030).

Timeline / Effective dates & status

  • Introduced: January 24, 2025.
  • Governor signed: June 20, 2025. Effective date reported as September 1, 2025.
  • Data broker gross income tax applies to taxable years beginning after December 31, 2026 (i.e., first tax year generally 2027).
  • Companion: HB 1089.

Who is affected

  • Primary: businesses that meet the bill’s definition of “data broker” (companies whose revenue derives from collecting/aggregating/analyzing/buying/selling/sharing brokered personal data), except FCRA/GLBA‑regulated entities.
  • Secondary: state agencies and programs that will receive new funding (privacy enforcement, AI projects, digital literacy, community supports, and education).

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.