Privacy advocates allege data brokers are violating Maryland’s strict data privacy law by selling personal data directly to police and federal immigration agencies, including ICE, according to NPR. Maryland’s law — among the strongest state data privacy laws in the country — contains specific provisions restricting the sale of sensitive personal data. The alleged violations represent a specific and significant enforcement gap: state-level privacy protections can be circumvented by data brokers who treat federal agency purchases as a category exempt from state law requirements.
2-MINUTE CONTEXT — WHAT MARYLAND’S LAW REQUIRES
Maryland’s data privacy law, modeled on but in some respects stronger than the EU’s GDPR, establishes specific rights for Maryland residents regarding their personal data. The relevant provisions for the ICE data sale allegation:
▸ Sensitive data restrictions: Maryland law categorizes certain data — including geolocation, health data, and immigration status-related data — as sensitive and subject to heightened protection
▸ Sale restrictions: selling sensitive personal data requires specific consent from the data subject; blanket consent buried in terms of service does not satisfy the requirement
▸ Government agency exemption question: whether federal agency purchases of data broker information are exempt from state law is a specific legal question that the alleged violations raise
▸ Private right of action: Maryland’s law gives residents some ability to enforce their rights directly, in addition to state enforcement
The specific enforcement gap: data brokers that have aggregated Maryland residents’ data from multiple sources — social media, consumer records, public records — may be selling that data to ICE without the consent that Maryland law requires. The brokers may argue that the data was acquired lawfully from each source; the advocates argue that the aggregation and resale to enforcement agencies without consent violates the spirit and letter of Maryland’s protections.
THE ICE DATA LANDSCAPE
ICE has been a significant purchaser of commercially available data throughout the current enforcement intensification period. Commercial data purchases allow ICE to access information that would otherwise require warrants, court orders, or cooperation from private companies: location data from apps, contact networks, financial transaction patterns, and other data that aggregated together can locate and identify individuals.
The specific use case: ICE uses commercial data purchases to identify individuals in enforcement priority categories, to track their locations over time, and to build network maps of immigrant communities. The legal framework for these purchases has been challenged in multiple jurisdictions; the Maryland law allegation is one specific front in a broader legal battle over whether and under what conditions commercial data can be used for immigration enforcement.
THE DATA BROKER INDUSTRY DIMENSION
The data broker industry — companies that aggregate, analyze, and sell personal data from multiple sources — operates in a legal gray zone that has not been comprehensively regulated at the federal level. Individual states — California, Virginia, Colorado, Connecticut, and Maryland among others — have passed state privacy laws that create state-level requirements. But federal agencies operating under federal authority may not be bound by state law requirements in the same way private parties are.
The Supremacy Clause of the US Constitution establishes that federal law preempts state law when they conflict. Whether state data privacy laws can restrict federal agency data purchases is a constitutional question that courts have not fully resolved. Data brokers selling to ICE may be arguing that their sales to a federal agency are a matter of federal authority that Maryland law cannot restrict.
Maryland passed a law to protect its residents’ data. Data brokers are allegedly selling that data to the federal government anyway. The legal question is whether the state law can reach a federal buyer.
WHAT HAPPENS NEXT
▸ Maryland AG enforcement action — the state attorney general can investigate and potentially sue data brokers for Maryland Privacy Act violations
▸ Federal preemption litigation — any enforcement action against data brokers for ICE sales will produce a federal preemption defense that courts will need to resolve
▸ Congressional action — the gap between state privacy laws and federal agency data purchases may produce legislative proposals for a federal privacy standard that addresses government purchases specifically
▸ ICE data purchase policy review — whether the administration continues or modifies commercial data purchase practices in response to legal challenges
| CONFIDENCE: HIGH | Privacy advocates’ allegation of Maryland data privacy law violations through ICE data sales is from NPR confirmed reporting. Maryland data privacy law provisions are from established state law. ICE commercial data purchase practices are from established prior reporting. |
| ⚖️ BIAS CHECK — WHO IS SAYING WHAT | |
| Privacy Advocates | Documenting the specific gap between Maryland’s law and its enforcement; their documentation is the evidentiary foundation of any enforcement action |
| Data Brokers | Will argue that federal agency sales are outside Maryland law’s reach; their legal defense is constitutionally grounded even if the practice is ethically contested |
| ICE | Has not commented on Maryland-specific data purchases; its commercial data acquisition program is documented practice, not a new development |
| Maryland AG | Has enforcement jurisdiction but faces significant legal obstacles in applying state law to federal agency data flows |
| Immigrant Communities in Maryland | Most directly affected; their data is the specific subject of the alleged violation |
SOURCES
▸ NPR — Maryland data privacy law, data brokers, ICE data sales allegation, August 2026
▸ Maryland Online Data Privacy Act — established state law
Q: Can a state law restrict what the federal government buys?
A: Generally, the Supremacy Clause means federal law overrides state law. But states can regulate the entities doing business within their borders, including data brokers. The question is whether regulating a data broker’s sale to a federal agency constitutes an attempt to regulate the federal government itself (prohibited) or regulating the private broker (permissible). Courts have found it can go either way depending on the specific statutory framework.
Q: What data is ICE buying?
A: Based on documented reporting across multiple outlets, ICE has purchased: location data from smartphone apps; license plate reader data; utility records; and social media monitoring services. The specific Maryland allegation concerns what types of data are being sold and whether the consent requirements for sensitive data under Maryland law were satisfied.
