Shown verbatim: the complete text as captured from the official PDF posted by the Maryland General Assembly, fetched 2026-09-25. Page and line markers are part of the official record; nothing is edited or removed. This is the chaptered version. The official bill page.
WES MOORE, Governor Ch. 445
Chapter 445
(Senate Bill 8)
AN ACT concerning
Criminal Law – Identity Fraud – Artificial Intelligence and Deepfake
Representations
FOR the purpose of prohibiting a person from utilizing certain personal identifying
information or engaging in certain conduct in order to cause certain harm;
prohibiting a person from using certain artificial intelligence or certain deepfake
representations for certain purposes; providing that a person who is the victim of
certain conduct may bring a civil action against a certain person; and generally
relating to identity fraud and artificial intelligence and deepfake representations.
BY repealing and reenacting, with amendments,
Article – Criminal Law
Section 8–301
Annotated Code of Maryland
(2021 Replacement Volume and 2025 Supplement)
BY repealing and reenacting, without amendments,
Article – State Finance and Procurement
Section 3.5–801(a) and (c)
Annotated Code of Maryland
(2021 Replacement Volume and 2025 Supplement)
SECTION 1. BE IT ENACTED BY THE GENERAL ASSEMBLY OF MARYLAND,
That the Laws of Maryland read as follows:
Article – Criminal Law
8–301.
(a) (1) In this section the following words have the meanings indicated.
(2) “ARTIFICIAL INTELLIGENCE” HAS THE MEANING STATED IN §
3.5–801 OF THE STATE FINANCE AND PROCUREMENT ARTICLE.
(3) (I) “DEEPFAKE REPRESENTATION” MEANS A PHOTOGRAPH, A
FILM, A VIDEO, AN AUDIO RECORDING, A DIGITAL IMAGE, A PICTURE, OR A
COMPUTER OR COMPUTER–GENERATED IMAGE OR PICTURE, WHETHER MADE,
PRODUCED, OR GENERATED BY ELECTRONIC, MECHANICAL, OR OTHER MEANS,
THAT IS INDISTINGUISHABLE FROM AN ACTUAL AND IDENTIFIABLE HUMAN BEING.
–1–
Ch. 445 2026 LAWS OF MARYLAND
(II) “DEEPFAKE REPRESENTATION” DOES NOT INCLUDE
IMAGES OR ITEMS DEPICTING HUMAN BEINGS THAT ARE:
1. DRAWINGS;
2. CARTOONS;
3. SCULPTURES; OR
4. PAINTINGS.
(4) “HARM” MEANS:
(I) PHYSICAL INJURY;
(II) SERIOUS EMOTIONAL DISTRESS; OR
(III) ECONOMIC DAMAGES.
[(2)] (5) “Health care” means care, services, or supplies related to the
health of an individual that includes the following:
(i) preventative, diagnostic, therapeutic, rehabilitative,
maintenance care, palliative care and counseling, service assessment, or procedure:
1. with respect to the physical or mental condition or
functional status of an individual; or
2. that affects the structure or function of the body; and
(ii) the sale or dispensing of a drug, device, equipment, or other item
in accordance with a prescription.
[(3)] (6) “Health information” means any information, whether oral or
recorded in any form or medium, that:
(i) is created or received by:
1. a health care provider;
2. a health care carrier;
3. a public health authority;
–2–
WES MOORE, Governor Ch. 445
4. an employer;
5. a life insurer;
6. a school or university; or
7. a health care clearinghouse; and
(ii) relates to the:
1. past, present, or future physical or mental health or
condition of an individual;
2. provision of health care to an individual; or
3. past, present, or future payment for the provision of health
care to an individual.
(7) (I) “INDISTINGUISHABLE FROM AN ACTUAL AND IDENTIFIABLE
HUMAN BEING” MEANS AN IMAGE AN ORDINARY PERSON WOULD CONCLUDE IS OF
AN ACTUAL AND IDENTIFIABLE HUMAN BEING.
(II) “INDISTINGUISHABLE FROM AN ACTUAL AND IDENTIFIABLE
HUMAN BEING” INCLUDES AN IMAGE THAT IS COMPUTER–GENERATED AND HAS
BEEN CREATED, ADAPTED, OR MODIFIED TO APPEAR AS AN ACTUAL AND
IDENTIFIABLE HUMAN BEING.
[(4)] (8) “Interactive computer service” means an information service,
system, or access software provider that provides or enables computer access by multiple
users to a computer server, including a system that provides access to the Internet and
cellular phones.
[(5)] (9) “Payment device number” has the meaning stated in § 8–213 of
this title.
[(6)] (10) (i) “Personal identifying information” includes a name,
address, telephone number, driver’s license number, Social Security number, place of
employment, employee identification number, health insurance identification number,
medical identification number, mother’s maiden name, bank or other financial institution
account number, date of birth, personal identification number, unique biometric data,
including fingerprint, voice print, retina or iris image or other unique physical
representation, digital signature, credit card number, or other payment device number.
(ii) “Personal identifying information” may be derived from any
element in subparagraph (i) of this paragraph, alone or in conjunction with any other
information to identify a specific natural or fictitious individual.
–3–
Ch. 445 2026 LAWS OF MARYLAND
[(7)] (11) “Re–encoder” means an electronic device that places encoded
personal identifying information or a payment device number from the magnetic strip or
stripe of a credit card onto the magnetic strip or stripe of a different credit card or any
electronic medium that allows such a transaction to occur.
[(8)] (12) “Skimming device” means a scanner, skimmer, reader, or any
other electronic device that is used to access, read, scan, obtain, memorize, or store,
temporarily or permanently, personal identifying information or a payment device number
encoded on the magnetic strip or stripe of a credit card.
(b) A person may not knowingly, willfully, and with fraudulent intent possess,
obtain, or help another to possess or obtain any personal identifying information of an
individual, without the consent of the individual, in order to use, sell, or transfer the
information to get a benefit, credit, good, service, or other thing of value or to access health
information or health care.
(b–1) A person may not maliciously use an interactive computer service to disclose
or assist another person to disclose the driver’s license number, bank or other financial
institution account number, credit card number, payment device number, Social Security
number, or employee identification number of an individual, without the consent of the
individual, in order to annoy, threaten, embarrass, or harass the individual.
(B–2) A PERSON MAY NOT KNOWINGLY, WILLFULLY, AND WITH FRAUDULENT
INTENT UTILIZE THE PERSONAL IDENTIFYING INFORMATION OF AN INDIVIDUAL,
WITHOUT THE CONSENT OF THE INDIVIDUAL, IN ORDER TO CAUSE HARM.
(c) A person may not knowingly and willfully assume the identity of another,
including a fictitious person:
(1) to avoid identification, apprehension, or prosecution for a crime; or
(2) with fraudulent intent to:
(i) get a benefit, credit, good, service, or other thing of value;
(ii) access health information or health care; [or]
(iii) avoid the payment of debt or other legal obligation; OR
(IV) HARM, HARASS, INTIMIDATE, THREATEN, OR COERCE THE
OTHER PERSON.
–4–
WES MOORE, Governor Ch. 445
(d) A person may not knowingly, willfully, and with fraudulent intent to obtain a
benefit, credit, good, service, or other thing of value or to access health information or health
care, use:
(1) a re–encoder to place information encoded on the magnetic strip or
stripe of a credit card onto the magnetic strip or stripe of a different credit card or use any
other electronic medium that allows such a transaction to occur without the consent of the
individual authorized to use the credit card from which the personal identifying
information or payment device number is being re–encoded; or
(2) a skimming device to access, read, scan, obtain, memorize, or store
personal identifying information or a payment device number on the magnetic strip or
stripe of a credit card without the consent of the individual authorized to use the credit
card.
(e) A person may not knowingly, willfully, and with fraudulent intent possess,
obtain, or help another possess or obtain a re–encoder device or a skimming device for the
unauthorized use, sale, or transfer of personal identifying information or a payment device
number.
(f) (1) A person may not knowingly and willfully claim to represent another
person without the knowledge and consent of that person, with the intent to solicit, request,
or take any other action to otherwise induce another person to provide personal identifying
information or a payment device number.
(2) A PERSON MAY NOT KNOWINGLY, WILLFULLY, AND WITH
FRAUDULENT INTENT USE ARTIFICIAL INTELLIGENCE OR A DEEPFAKE
REPRESENTATION TO:
(I) IMPERSONATE, FALSELY DEPICT, OR CLAIM TO REPRESENT
ANOTHER PERSON WITH THE INTENT TO DEFRAUD, MISLEAD, OR CAUSE HARM TO
THAT PERSON OR ANY OTHER PERSON CAUSE HARM TO ANOTHER BY
IMPERSONATING, FALSELY DEPICTING, OR CLAIMING TO REPRESENT THAT PERSON
OR ANY OTHER PERSON; OR
(II) CREATE OR DISTRIBUTE FALSE RECORDS WITH THE INTENT
TO:
1. CAUSE HARM TO ANOTHER PERSON;
2. INDUCE ANOTHER PERSON TO PROVIDE PERSONAL
IDENTIFYING INFORMATION; OR
3. OBTAIN A BENEFIT, CREDIT, GOOD, SERVICE, OR
OTHER THING OF VALUE. –5–
Ch. 445 2026 LAWS OF MARYLAND
(g) (1) (i) A person who violates this section where the benefit, credit, good,
service, health information or health care, or other thing of value that is the subject of
subsection (b), [(c)] (C)(2)(I), (II), (III), or (d) of this section has a value of at least $1,500
but less than $25,000 is guilty of a felony and on conviction is subject to imprisonment not
exceeding 5 years or a fine not exceeding $10,000 or both.
(ii) A person who violates this section where the benefit, credit, good,
service, or other thing of value that is the subject of subsection (b), [(c)] (C)(2)(I), (II), (III),
or (d) of this section has a value of at least $25,000 but less than $100,000 is guilty of a
felony and on conviction is subject to imprisonment not exceeding 10 years or a fine not
exceeding $15,000 or both.
(iii) A person who violates this section where the benefit, credit, good,
service, or other thing of value that is the subject of subsection (b), [(c)] (C)(2)(I), (II), (III),
or (d) of this section has a value of $100,000 or more is guilty of a felony and on conviction
is subject to imprisonment not exceeding 20 years or a fine not exceeding $25,000 or both.
(2) A person who violates this section where the benefit, credit, good,
service, health information or health care, or other thing of value that is the subject of
subsection (b), [(c)] (C)(2)(I), (II), (III), or (d) of this section has a value of at least $100
but less than $1,500 is guilty of a misdemeanor and on conviction is subject to
imprisonment not exceeding 1 year or a fine not exceeding $500 or both.
(3) A person who violates this section under circumstances that reasonably
indicate that the person’s intent was to manufacture, distribute, or dispense another
individual’s personal identifying information without that individual’s consent is guilty of
a felony and on conviction is subject to imprisonment not exceeding 10 years or a fine not
exceeding $25,000 or both.
(4) A person who violates subsection (b–1), (B–2), (c)(1), (C)(2)(IV), (e), or
[(f)] (F)(1) of this section is guilty of a misdemeanor and on conviction is subject to
imprisonment not exceeding 1 year or a fine not exceeding $500 or both.
(5) (I) A PERSON WHO VIOLATES SUBSECTION (F)(2) OF THIS
SECTION INVOLVING ONE VICTIM IS GUILTY OF A FELONY AND ON CONVICTION IS
SUBJECT TO IMPRISONMENT NOT EXCEEDING 5 YEARS OR A FINE NOT EXCEEDING
$10,000 OR BOTH.
(II) A PERSON WHO VIOLATES SUBSECTION (F)(2) OF THIS
SECTION INVOLVING TWO OR MORE VICTIMS IS GUILTY OF A FELONY AND ON
CONVICTION IS SUBJECT TO IMPRISONMENT NOT EXCEEDING 10 YEARS OR A FINE
NOT EXCEEDING $15,000 OR BOTH.
–6–
WES MOORE, Governor Ch. 445
[(5)] (6) When the violation of this section is pursuant to one scheme or
continuing course of conduct, whether from the same or several sources, the conduct may
be considered as one violation and the value of the benefit, credit, good, service, or other
thing of value may be aggregated in determining whether the violation is a felony or
misdemeanor.
(H) (1) A PERSON WHO IS THE VICTIM OF AN ACT THAT WOULD
CONSTITUTE A VIOLATION OF SUBSECTION (F)(2) OF THIS SECTION MAY BRING A
CIVIL ACTION AGAINST THE PERSON OR PERSONS WHO COMMITTED THE ACT IN A
COURT OF COMPETENT JURISDICTION.
(2) THE COURT MAY:
(I) ISSUE AN INJUNCTION TO PREVENT OR RESTRAIN AN ACT
THAT WOULD CONSTITUTE A VIOLATION OF SUBSECTION (F)(2) OF THIS SECTION;
AND
(II) GRANT ANY OTHER APPROPRIATE RELIEF.
[(h)] (I) A person described in subsection (g)(2) or (4) of this section is subject to
§ 5–106(b) of the Courts Article.
[(i)] (J) In addition to restitution under Title 11, Subtitle 6 of the Criminal
Procedure Article, a court may order a person who pleads guilty or nolo contendere or who
is found guilty under this section to make restitution to the victim for reasonable costs,
including reasonable attorney’s fees, incurred:
(1) for clearing the victim’s credit history or credit rating;
(2) for clearing the victim’s record or history related to health information
or health care; and
(3) in connection with a civil or administrative proceeding to satisfy a debt,
lien, judgment, or other obligation of the victim that arose because of the violation.
[(j)] (K) A sentence under this section may be imposed separate from and
consecutive to or concurrent with a sentence for any crime based on the act or acts
establishing the violation of this section.
[(k)] (L) Notwithstanding any other law, the Department of State Police may
initiate investigations and enforce this section throughout the State without regard to any
limitation otherwise applicable to the Department’s activities in a municipal corporation or
other political subdivision.
–7–
Ch. 445 2026 LAWS OF MARYLAND
[(l)] (M) (1) Notwithstanding any other law, a law enforcement officer of the
Maryland Transportation Authority Police, the Maryland Port Administration Police, the
Park Police of the Maryland–National Capital Park and Planning Commission, or a
municipal corporation or county may investigate violations of this section throughout the
State without any limitation as to jurisdiction and to the same extent as a law enforcement
officer of the Department of State Police.
(2) The authority granted in paragraph (1) of this subsection may be
exercised only in accordance with regulations that the Department of State Police adopts.
(3) The regulations are not subject to Title 10, Subtitle 1 of the State
Government Article.
(4) The authority granted in paragraph (1) of this subsection may be
exercised only if an act related to the crime was committed in the investigating law
enforcement agency’s jurisdiction or if the complaining witness resides in the investigating
law enforcement agency’s jurisdiction.
[(m)] (N) If action is taken under the authority granted in subsection [(l)] (M) of
this section, notification of an investigation:
(1) in a municipal corporation, shall be made to the chief of police or
designee of the chief of police;
(2) in a county that has a county police department, shall be made to the
chief of police or designee of the chief of police;
(3) in a county without a police department, shall be made to the sheriff or
designee of the sheriff;
(4) in Baltimore City, shall be made to the Police Commissioner or the
Police Commissioner’s designee;
(5) on property owned, leased, or operated by or under the control of the
Maryland Transportation Authority, the Maryland Aviation Administration, or the
Maryland Port Administration, shall be made to the respective chief of police or the chief’s
designee; and
(6) on property owned, leased, or operated by or under the control of the
Maryland–National Capital Park and Planning Commission, to the chief of police of the
Maryland–National Capital Park and Planning Commission for the county in which the
property is located.
[(n)] (O) When acting under the authority granted in subsection [(k)] (L) or [(l)]
(M) of this section, a law enforcement officer:
–8–
WES MOORE, Governor Ch. 445
(1) in addition to any other immunities and exemptions to which the officer
may be entitled, has the immunities from liability and exemptions accorded to a law
enforcement officer of the Department of State Police; but
(2) remains an employee of the officer’s employing agency.
[(o)] (P) (1) A State’s Attorney or the Attorney General may investigate and
prosecute a violation of this section or a violation of any crime based on the act establishing
a violation of this section.
(2) If the Attorney General exercises authority under paragraph (1) of this
subsection, the Attorney General has all the powers and duties of a State’s Attorney,
including the use of a grand jury in any county or Baltimore City, to investigate and
prosecute the violation.
[(p)] (Q) Notwithstanding any other provision of law, the prosecution of a
violation of this section or for a violation of any crime based on the act establishing a
violation of this section may be commenced in any county in which:
(1) an element of the crime occurred; or
(2) the victim resides.
Article – State Finance and Procurement
3.5–801.
(a) In this subtitle the following words have the meanings indicated.
(c) “Artificial intelligence” means a machine–based system that:
(1) can, for a given set of human–defined objectives, make predictions,
recommendations, or decisions influencing real or virtual environments;
(2) uses machine and human–based inputs to perceive real and virtual
environments and abstracts those perceptions into models through analysis in an
automated manner; and
(3) uses model inference to formulate options for information or action.
SECTION 2. AND BE IT FURTHER ENACTED, That this Act shall take effect
October 1, 2026.
Approved by the Governor, May 12, 2026.
–9–Every fact on this page links to its source, starting with the official bill record.