language: en · status: in-force · last checked: 2026-10-08

Maryland — student data privacy (Md. Code, Educ. §4-131)

Maryland's operator statute, in the Education Article of the Annotated Code of Maryland. Its definition of operator is unusual: it reaches the provider that works with schools under FERPA's school-official exception and under a contract or agreement with a Maryland public school or local school system. In other words it covers the contracted edtech vendor, not every service a school happens to use. It requires security and deletion on request, prohibits targeted advertising, profiling, sale and most disclosure, and lists the permitted disclosures and uses. Section 4-131 was added by the Student Data Privacy Act of 2015 (2015 Md. Laws ch. 413, House Bill 298), whose Section 3 provides that the Act "shall take effect July 1, 2015".

Applicability to EdTech

• Operator means a contracted school official. An individual or entity "who engages with institutions under the school official exception of the federal Family Educational Rights and Privacy Act and is operating in accordance with a contract or an agreement with a public school or local school system in the State" to provide a website, online service or application that processes covered information and is used for a PreK–12 school purpose or issued at the school's direction (§4-131(a)(3)(i)). A division of a parent company is included if it serves education clients and does not share covered information with the parent ((a)(3)(ii)). General-audience services are excluded ((b)).
• Covered information is listed broadly, including "Biometric information", "Voice recordings", "Photos", "Online behavior or usage of applications when linked or linkable to a specific student" and "Persistent unique identifiers" (§4-131(a)(2)(ii); items 11, 19, 21, 22). Persistent unique identifiers are defined to include device identifiers and cookie identifiers ((a)(4)), so headset or device serials linked to a student fall within it.
• Duties: protect covered information from unauthorised access, destruction, use, modification or disclosure; implement and maintain reasonable security procedures and practices; and delete within a reasonable time when the school or system that holds authority under the contract asks (§4-131(c), (c)(3)).
• Prohibitions, each limited to what the operator does "knowingly": targeted advertising; profiling except in furtherance of a PreK–12 school purpose; sale; and disclosure except as subsection (e) allows (§4-131(d)(1)). Disclosure to a service provider (a sub-processor) requires a contract limiting its use and onward disclosure and binding it to the security and prohibition subsections ((e)(6)). A successor in a merger or acquisition is bound for previously collected data ((f)).
• Notice-and-consent route. Apart from the sale ban, other uses and disclosures are allowed where the operator gave clear and conspicuous notice and obtained affirmative consent from the parent, or from the student if 18 or over (§4-131(h)).
• Adaptive learning, recommendations within the service and aggregated or de-identified use for product improvement remain allowed ((g), (j)).

Contents

Key obligations at a glance

• Protect covered information; reasonable security; delete on request — §4-131(c).
• No targeted advertising, non-school profiling, sale or unpermitted disclosure — §4-131(d)(1).
• Sub-processors bound by contract — §4-131(e)(6).

Enforcement

The section names no penalty or enforcing authority.

Licence

The corpus reproduces Education Article §4-131 verbatim from the Maryland General Assembly's Statutes Text page (read 2026-10-08), which carries no copyright notice.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in the fact document's {.meta} provenance line, and its Meta section describes what it changed (anchors added, whitespace collapsed, nothing reworded).

Related

• FERPA — the school-official exception that defines who is an operator here
• California SOPIPA — the operator model §4-131 follows, with a narrower operator definition

Sources

• Maryland General Assembly — Statutes Text, Education §4-131
• Maryland General Assembly — 2015 Laws of Maryland, Chapter 413 (House Bill 298) — "BY adding to Article – Education Section 4–131"; Section 3: "this Act shall take effect July 1, 2015"; approved by the Governor 12 May 2015