Maryland Nonconsensual Pornography Deepfake Expansion (SB 360)
Effective date
Penalty
Criminal: up to 2 years imprisonment and/or $5,000 fine. Civil damages also available.
Obligations mapped
Tracked
Overview
Expands Maryland's revenge porn statute to cover AI-generated and computer-generated sexual imagery. Strengthens civil remedies for victims of synthetic intimate images.
This is an AI-specific state law.
See if this regulation applies to your company with the free exposure scan.
Who this applies to
This regulation applies to the following roles:
- Developers of covered AI systems
- Deployers and users of covered AI systems
- Organizations operating in Maryland
This regulation applies to both companies that build AI products and companies that use AI tools from other vendors.
SB 360
AI categories covered
- Consumer-facing AI
Specific AI use cases:
- Content generation
- synthetic media manipulation
- voice likeness synthesis
- political synthetic media
What this requires you to do
Detailed obligation packs are not yet mapped for this entry in XIRA. Obligation areas from the catalog are listed below.
What this requires you to do
Prohibited practices
Avoid conduct the statute bans, including harmful manipulation and intentional discrimination.
Consent required
Obtain consent. Get explicit permission from individuals before collecting or using their data with AI.
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.
Enforcement and penalties
Criminal: up to 2 years imprisonment and/or $5,000 fine. Civil damages also available.
Private right of action: plaintiffs may bring direct claims in addition to government enforcement.
Penalty amounts are based on statutory text and may be subject to adjustment, judicial interpretation, or enforcement discretion.
Legislative history
effective
Takes effect
signed
Signed by Governor Moore
Related regulations
- In EffectFederal
TAKE IT DOWN Act (S. 146)
Requires covered online platforms to remove reported nonconsensual intimate imagery, including AI-generated deepfakes, within a short deadline after a valid notice. Dual effective dates: criminal provisions effective May 19, 2025 (date signed into law). Platform compliance deadline: May 19, 2026 (one year after signing). First federal law limiting the use of AI in ways harmful to individuals. Covers both authentic NCII and AI-generated deepfakes. Does not preempt state laws. FTC jurisdiction extended to nonprofit entities. First and only enacted federal AI-specific law signed by the Trump administration. Bipartisan 409-2 House vote, unanimous Senate passage.
Effective
- In EffectAI-Specific
Maryland HB 1202 (Facial Recognition in Hiring)
Prohibits creating facial templates of job applicants during interviews without signed consent. Where applicable, the waiver may need to include the applicant's name, interview date, consent to facial recognition use, and whether the applicant read the waiver. Scope is narrower than Illinois BIPA: it only covers facial recognition during interviews, not biometric data collection generally.
Effective
- In EffectPrivacy ADM
Maryland Online Data Privacy Act (MODPA), ADM and profiling provisions
Statute effective October 1, 2025, but enforcement does not begin until April 1, 2026. The law does not apply to processing activities before April 1, 2026. Considered one of the strongest state privacy laws due to strict data minimization and a complete ban on selling sensitive data (not only opt-in consent). The threshold of 35,000 consumers is lower than most states. Controllers must handle profiling and automated decision-making with strong consumer protections, including documented risk assessments and opt-out rights. Impact assessments required per algorithm used in high-risk processing. Nonprofits are largely included. Universal opt-out signals required from day one. 60-day cure period with no sunset date in the current statute.
Effective
- In EffectAI-Specific
Maryland AI Governance Act of 2024 (SB 818)
Requires Maryland state agencies to inventory AI systems, conduct impact assessments, and follow DoIT policies for AI procurement and use. Applies to state government agencies only, not the private sector.
Effective
- In EffectSector-Specific
Maryland Healthcare AI Utilization Review (HB 820)
May apply to AI tools used in healthcare coverage decisions, calling for determinations based on individual patient data rather than group datasets. Where applicable, final utilization review decisions may need to be made by a physician in the same specialty. Where applicable, carriers may need to report whether AI was used in adverse decisions. Does not ban AI in healthcare: where applicable it may require AI to use individual patient data and may mandate human physician final decisions.
Effective
Maryland AI regulation guide lists every tracked rule for this jurisdiction with timelines and obligation tallies.
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.