Maryland to ICE: Get a Warrant or Get Out of Our Databases

The Data Privacy Act bans state agencies from handing MVA records, school enrollment data, and benefit applications to federal immigration enforcement. Data brokers can’t sell your info for deportation purposes either.

State of Surveillance Editorial Team

Close-up of hands typing on a laptop keyboard with a padlock icon overlay representing digital privacy
Photo via Unsplash

TL;DR: Maryland’s legislature passed HB 711, the Data Privacy Act, on April 13, 2026. It prohibits state and local agencies from sharing personal data (MVA records, school enrollment, public benefit applications) with federal immigration enforcement unless a court-issued warrant is presented. It also bars data brokers from selling personal information to any government entity engaged in civil immigration enforcement. The bill passed the House 94-35 and the Senate 28-8. It now awaits Governor Wes Moore’s signature and would take effect July 1, 2026.

What HB 711 Actually Blocks

ICE has a data problem, or rather, the people ICE is looking for have a data problem. Federal immigration agents don’t need to hack anything. They buy it. They request it. They browse it. State motor vehicle databases, school enrollment systems, utility records, public benefit applications. All of it has been fair game.[1]

Maryland’s Data Privacy Act attacks that pipeline in three places:

1. State and local agencies can’t share data for immigration enforcement. No handing over MVA records, school enrollment data, or benefit applications to ICE or CBP without a warrant signed by a state or federal judge. Not a detainer. Not an administrative subpoena. A warrant.[2]

2. Data brokers can’t sell personal data for deportation purposes. The bill prohibits any data controller from knowingly selling consumer personal data to a government entity that has “engaged in or supported civil immigration enforcement.” That’s a direct shot at the commercial surveillance pipeline that ICE has built through companies like Thomson Reuters, LexisNexis, and Babel Street.[3]

3. Public records custodians must screen for immigration-related access. Anyone managing public records is now required to take “reasonable steps” to determine whether records are being accessed for immigration enforcement purposes. Entities operating message switching systems (the databases that let agencies query each other’s records) must implement specific access safeguards.[2]

Why This Matters: ICE’s Data Broker Habit

This isn’t theoretical. ICE has spent years building a commercial surveillance infrastructure specifically designed to avoid the warrant requirement.

A 2022 Georgetown Law Center on Privacy & Technology report found that ICE had access to driver’s license data for roughly 74% of all adults in the United States through agreements with state DMVs and data brokers. The agency purchased detailed cell phone location data from Venntel and Babel Street. It bought utility connection records to find addresses. It used Thomson Reuters CLEAR and LexisNexis Accurint to build profiles on targets.[4]

NPR reported in March 2026 that ICE has “spun a massive surveillance web” using these commercial tools, spending millions on data broker contracts that let agents track people through their phone locations, utility bills, and financial transactions, all without ever going before a judge.[5]

Maryland’s bill doesn’t stop ICE from operating in the state. It stops Maryland from being a willing participant in that data supply chain.

How It Passed

The Data Privacy Act (HB 711, with companion bill SB 504) was introduced on February 2, 2026 by Delegates Lorig Charkoudian, Kris Fair Solomon, and Brian Wolek. The House Economic Matters Committee held hearings on February 24.[2]

The House passed it 94-35 on March 21. The Senate followed 28-8 on April 13, the final day of Maryland’s 2026 legislative session.[2]

The bill heads to Governor Wes Moore, who signed 146 bills after the session ended on April 15 and has shown consistent support for immigrant protections. Moore also signed the Community Trust Act (SB 791) during the same session, which restricts local law enforcement from cooperating with ICE and requires judicial warrants for ICE detainers.[6]

If signed, HB 711 takes effect July 1, 2026.

Who Pushed This Through

The bill was driven by a coalition of more than 200 advocates and organizations led by We Are CASA, one of the largest immigrant-serving organizations in the mid-Atlantic region. The ACLU of Maryland, Jews United for Justice, Progressive Maryland, 32BJ SEIU, and SEIU 500 were among the supporting groups.[7]

Cathryn Jackson, We Are CASA’s Policy Director, framed it bluntly: “Maryland is saying plainly: our schools, our courts, our law enforcement, and our local institutions should protect people, not serve as tools of harm.”[7]

On the other side, the Software & Information Industry Association (SIIA) opposed the bill, arguing it goes “far beyond its stated immigration-enforcement purpose” and creates “legal uncertainty, operational burdens, and compliance risks for lawful information services.”[8] Translation: data brokers don’t want states telling them who they can sell your data to.

Teeth in the Law

HB 711 isn’t just a suggestion. Civil penalties of up to $1,000 per violation can be imposed on agencies that share data in violation of the act. State employees who break the rules face disciplinary action, including termination.[3]

That’s not a massive fine by corporate standards, but it puts individual employees on notice. If you’re a DMV clerk or school administrator and ICE shows up asking for records without a warrant, you now have a legal obligation (and personal liability) to say no.

Maryland Isn’t Alone, But It’s Leading

Several states have moved to limit data sharing with immigration authorities, but Maryland’s approach is distinctive because it explicitly targets the data broker pipeline. Most sanctuary policies focus on law enforcement cooperation: telling local police not to honor ICE detainers or assist in raids. HB 711 goes after the commercial data infrastructure that ICE relies on when local cops won’t cooperate.

Virginia’s SB 338, signed in March 2026, bans the sale of geolocation data without consent and takes effect July 1, the same day as Maryland’s bill. Oregon passed similar protections in 2025. But Maryland’s law is one of the first to explicitly name immigration enforcement as a prohibited purpose for data sales.[9]

The combination of the Community Trust Act and the Data Privacy Act makes Maryland one of the most data-protected states for immigrant communities in the country. ICE can still operate there. But the state won’t help them find people.

What to Watch

The Trump administration has already clashed with states over immigration enforcement. Maryland’s 287(g) agreement ban, signed as emergency legislation in February 2026, eliminated eight existing local-federal immigration partnerships. The administration threatened to withhold federal funding. Moore didn’t blink.[6]

Expect HB 711 to face similar federal pushback. The question is whether other states follow Maryland’s lead and start cutting off the data broker pipeline, or whether Congress moves to preempt state laws that restrict federal access to commercial data.

Either way, Maryland just drew a line: if you want to use state data to deport people, get a warrant.

References

  1. NPR: Your Data Is Everywhere. The Government Is Buying It Without a Warrant (March 2026)
  2. Maryland General Assembly: HB 711 Legislative Details
  3. We Are CASA: Maryland House Committee Advances Data Privacy Act
  4. CNS Maryland: Maryland Braces for Increased Immigration Enforcement (April 2026)
  5. NPR: ICE Has Spun a Massive Surveillance Web (March 2026)
  6. CBS Baltimore: Maryland Lawmakers Pass Restrictions on ICE Cooperation (April 2026)
  7. We Are CASA: Celebrates Passage of Community Trust Act and Data Privacy Act
  8. SIIA: Opposes Maryland HB 711 in Senate Letter
  9. State of Surveillance: Virginia Bans Geolocation Data Sales