Maryland Website Tracking, Privacy & Wiretap Litigation

Published by Crandall Consulting · Informational litigation intelligence · Last intelligence update: August 31, 2026

Lawsuits, demand letters, tracked matters, and reported claims are counted separately and are not interchangeable. Last intelligence update: August 31, 2026.

Current Landscape

Within the provided dataset for Maryland there are no tracked lawsuits, demand letters, or other matters; nevertheless the jurisdiction is assessed at a moderate risk level. The Maryland Wiretapping and Electronic Surveillance Act (Md. Cts. & Jud. Proc. § 10-401 et seq.) is the primary statutory framework called out in the dataset and therefore is a relevant risk indicator when businesses deploy technologies that capture user interactions.

The technologies identified in the tracked-technologies list include session replay code (SRC) and session replay software, website interaction recording, geolocation capture, cookies, web beacons, chatbots, website analytics, and other online data-tracking technologies. Even with no active matters recorded here, the presence of those technologies in the dataset is a risk indicator that merits attention by in-house teams and service providers because they can affect how interception, collection, and consent questions are viewed under the statutory framework noted above.

Current Litigation Activity

Current litigation component: 0/100.

Current Filing & Litigation Trends

The dataset contains no tracked filings or demand letters in Maryland. That absence of recorded litigation activity in this dataset does not eliminate the relevance of the Maryland Wiretapping and Electronic Surveillance Act and the listed tracking technologies as ongoing risk indicators; continued monitoring of filings and demand activity is recommended.

Precedent Landscape: What Courts Have Decided

Precedent component: 50/100. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately — a high number of filings does not by itself indicate strong plaintiff-favorable binding precedent.

No decided precedent with a clear substantive direction is currently tracked.

A settlement is not a binding precedent, and a procedural dismissal (for example, for lack of standing) is not a holding that the underlying technology is lawful. Where courts disagree, that disagreement is reflected rather than resolved.

Current Laws & Relevant Statutes

• Maryland Wiretapping and Electronic Surveillance Act — Md. Cts. & Jud. Proc. § 10-401 et seq. · all-party consent · private right of action

Regulatory Enforcement

Regulatory enforcement component: 0/100. Regulatory enforcement (agency investigations, sweeps, settlements, guidance, rulemaking) is tracked separately from private litigation and is never counted as a lawsuit.

No specific enforcement actions are itemized for this jurisdiction.

Agency Guidance

Regulatory trend: insufficient data.

Global Privacy Control / Opt-Out Signals

Currently required

GPC / universal opt-out exposure component: 80/100. This component reflects whether the state currently requires or recognizes universal opt-out preference signals (such as GPC) and related enforcement activity, and is a weighted input to the overall risk guideline. It describes the state's legal posture — never any individual website's behavior.

GPC / universal opt-out privacy rights are a different legal theory from wiretap / interception litigation, though both affect third-party website data flows.

Effective since: October 1, 2025.

Statutory baseline: Maryland Online Data Privacy Act (Md. Code Ann., Com. Law § 14-4707 (SB 541)).

GPC evidence confidence: 90%.

Learn more about Global Privacy Control → · How GPC posture is weighted in the risk guideline →

Changes Coming in the Next 24 Months

Forward-looking (24-month) component: 0/100. Enacted changes with future effective dates may affect a jurisdiction's forward-looking risk, but are not presented as currently enforceable.

Coming Into Effect (Enacted)

No enacted future-effective laws identified in our latest research cycle.

Legislation to Watch (Pending)

No pending website-privacy legislation identified for this jurisdiction in our latest research cycle.

Important Cases & Tracked Matters

No cases are currently tracked for this jurisdiction. This reflects our tracked source set, not an absence of litigation.

Technologies Appearing in Claims

• Global Privacy Control (GPC)
• Sec-GPC HTTP header
• navigator.globalPrivacyControl JavaScript flag
• navigator.globalPrivacyControl JavaScript property
• third-party tracking pixels
• advertising cookies
• automated_decisionmaking
• artificial_intelligence
• algorithmic_bias
• biometrics
• telehealth
• location_data
• data_brokers
• social_media
• GeoIP databases
• Virtual Private Networks (VPNs)
• Consent Management Platforms (CMPs)
• browser-based universal opt-out signals
• browser extensions / device settings
• cookie_banner_requirements
• ad-tech
• Session Replay Code (SRC)
• website interaction recording
• geolocation capture
• session replay software

Historical Risk Guideline

What Businesses Should Review

Perform a technical and vendor inventory focused on session replay code, website interaction recording, geolocation capture, chatbots, analytics scripts, cookies, and web beacons; map data flows to determine what user inputs or identifiers are captured and transmitted. Where feasible, apply minimization (masking or excluding form fields and sensitive inputs), truncate or anonymize recorded data, limit retention, enforce strict access controls and logging, and evaluate consent banner/configuration and opt-out mechanisms. Review vendor contracts and processing agreements for security, purpose limitation, and liability terms, and consider documenting a privacy/processing impact assessment and legal review that references Md. Cts. & Jud. Proc. § 10-401 et seq. as part of the compliance posture.

Data Quality

9 source(s), 2 primary; evidence is fresh.

Methodology & Limitations

Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.

The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.

Sources

• Universal Opt-Out Mechanisms: Which States Require Them — CookieBeam · Tier D (Industry data)
• Universal Opt-Out Mechanism (UOOM) Compliance: What Every Business Needs to Know in 2026 — PrivacyLawMap · Tier D (Industry data)
• U.S. Cybersecurity and Data Privacy Review and Outlook – 2025 — Gibson, Dunn & Crutcher LLP · Tier E (General web)
• Letter from Senator Ron Wyden to State Attorneys General on Global Privacy Control — U.S. Senate - Office of Senator Ron Wyden (PDF) · Tier A (Primary authority)
• Global Privacy Controls: Preparing for the Next Wave of Enforcement — Foster Garvey · Tier C (Professional analysis)
• The US State Privacy Law Tracker for 2026: Twenty Laws, One Compliance Baseline — Consenteo · Tier C (Professional analysis)
• Malinda Smidga v. Spirit Airlines Inc, No. 24-1757 (3d Cir. 2026) — Justia · Tier B (Authoritative secondary)
• Tips for Protecting Your Business from Wiretap Lawsuits Targeting Companies with Consumer-Facing Websites — American Bar Association · Tier A (Primary authority)
• Bass Pro Shops, Cabela’s Customers Revive ‘Session Replay’ Suit — Bloomberg Law · Tier B (Authoritative secondary)

All State Pages