A buried provision in Maryland's consumer data privacy law creates a new compliance obligation for auto service businesses that sell or share customer information.
Most auto service owners in Maryland don't realize that a new state law—HB711, the Data Privacy Act—includes a provision that directly affects how they can handle and sell customer data. And unlike many privacy rules that apply only to tech companies, this one applies to small businesses too.
Under § 14–4707(a)(5) of Maryland's new Data Privacy Act, any business that qualifies as a "controller" of consumer personal data is now banned from selling that data when it knows—or should know—that the buyer intends to use it for immigration enforcement purposes.
In plain terms: if you sell, share, or transfer customer information (names, addresses, phone numbers, or other personal details), you cannot do so to a buyer who plans to use that data to support immigration enforcement activities.
Auto service shops that collect and maintain customer data—which is most of them—qualify as "controllers" under the law. This includes independent shops, regional chains, and franchise operations. If your business collects customer information as part of normal operations and has any ability to use, share, or sell that data, the restriction applies to you.
The provision is most relevant if your business has ever sold customer lists, shared data with third-party vendors, or transferred customer information to data brokers or marketing companies. Going forward, you'll need to vet those buyers before completing any transaction.
The law doesn't require you to stop selling data or sharing it with partners. It requires you to know your buyer's intended use. Before selling or transferring customer data, you should ask—and document—what the buyer plans to do with it. If they indicate the data will be used for immigration enforcement, you cannot proceed with the sale.
This creates a new compliance step in any data transaction. It's not burdensome, but it is mandatory. Violations can result in enforcement action by Maryland's Attorney General.
The restriction becomes effective July 1, 2026. That gives businesses time to review their data-sharing practices, update vendor agreements, and establish procedures for vetting purchasers before the deadline.
If your shop currently sells customer data or shares it with third parties, now is the time to audit those relationships and understand what your partners do with the information. If you don't currently sell data, the rule has minimal day-to-day impact—but it's worth understanding in case your business practices change.
Maryland's Data Privacy Act is complex, and HB711 contains several other provisions affecting how businesses handle consumer data. For a detailed, business-specific guide tailored to auto service operations, resources are available through trade associations and legal counsel familiar with Maryland's requirements.
Source: Maryland HB711, Data Privacy - Consumer Data, Public Records, and Message Switching System (Data Privacy Act), § 14–4707(a)(5), effective July 1, 2026.