Maryland · Senate Bill · 2025 Regular Session
SB905
Maryland Senate Bill 905 — Criminal Law – Identity Fraud – Artificial Intelligence and Deepfake Representations

Status ● Failed Effective N/A Passage Likelihood N/A

WHAT THIS BILL REGULATES · 1 REQUIREMENT TYPE

How Is This Bill Enforced

Enforcement Authority
Criminal enforcement by State's Attorneys and the Attorney General. The Department of State Police may initiate investigations statewide. For the new AI/deepfake impersonation offense under subsection (f)(2), the bill also creates a private right of action allowing the victim to bring a civil action in a court of competent jurisdiction.
Private Right of Action
private right of action allowing the victim to bring a civil action in a court of competent jurisdiction.
Penalties
Criminal penalties for violations of subsection (f)(2): one victim — felony, up to 5 years imprisonment or fine up to $10,000 or both; two or more victims — felony, up to 10 years imprisonment or fine up to $15,000 or both. Civil remedy: injunctive relief and any other appropriate relief as determined by the court. Existing identity fraud criminal penalties (graduated by value of benefit obtained) also apply to amended subsections. Restitution for reasonable costs including attorney's fees is available in criminal proceedings.

What This Bill Requires

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text
Analysis & Obligations
Md. Code, Crim. Law § 8-301(a)
Definitions

(a)(2) "ARTIFICIAL INTELLIGENCEArtificial intelligence"Artificial intelligence" has the meaning stated in § 3.5–801 of the State Finance and Procurement Article. [Per § 3.5-801(c): "Artificial intelligence" means a machine–based system that: (1) can, for a given set of human–defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments; (2) uses machine and human–based inputs to perceive real and virtual environments and abstracts those perceptions into models through analysis in an automated manner; and (3) uses model inference to formulate options for information or action.]Md. Code, Crim. Law § 8-301(a)(2); Md. Code, State Fin. & Proc. § 3.5-801(c)" HAS THE MEANING STATED IN § 3.5–801 OF THE STATE FINANCE AND PROCUREMENT ARTICLE.

(a)(3) "DEEPFAKE REPRESENTATIONDeepfake representation"Deepfake representation" means a photograph, a film, a video, an audio recording, a digital image, a picture, or a computer or computer–generated image or picture, whether made, produced, or generated by electronic, mechanical, or other means, that is indistinguishable from an actual and identifiable human being. "Deepfake representation" does not include images or items depicting human beings that are: 1. drawings; 2. cartoons; 3. sculptures; or 4. paintings.Md. Code, Crim. Law § 8-301(a)(3)" MEANS A PHOTOGRAPH, A FILM, A VIDEO, AN AUDIO RECORDING, A DIGITAL IMAGE, A PICTURE, OR A COMPUTER OR COMPUTER–GENERATED IMAGE OR PICTURE, WHETHER MADE, PRODUCED, OR GENERATED BY ELECTRONIC, MECHANICAL, OR OTHER MEANS, THAT IS INDISTINGUISHABLE FROM AN ACTUAL AND IDENTIFIABLE HUMAN BEINGIndistinguishable from an actual and identifiable human being"Indistinguishable from an actual and identifiable human being" means an image an ordinary person would conclude is of an actual and identifiable human being. "Indistinguishable from an actual and identifiable human being" includes an image that is computer–generated and has been created, adapted, or modified to appear as an actual and identifiable human being.Md. Code, Crim. Law § 8-301(a)(7). (II) "DEEPFAKE REPRESENTATIONDeepfake representation"Deepfake representation" means a photograph, a film, a video, an audio recording, a digital image, a picture, or a computer or computer–generated image or picture, whether made, produced, or generated by electronic, mechanical, or other means, that is indistinguishable from an actual and identifiable human being. "Deepfake representation" does not include images or items depicting human beings that are: 1. drawings; 2. cartoons; 3. sculptures; or 4. paintings.Md. Code, Crim. Law § 8-301(a)(3)" DOES NOT INCLUDE IMAGES OR ITEMS DEPICTING HUMAN BEINGS THAT ARE: 1. DRAWINGS; 2. CARTOONS; 3. SCULPTURES; OR 4. PAINTINGS.

(a)(4) "HARMHarm"Harm" means: (I) physical injury; (II) serious emotional distress; or (III) economic damages.Md. Code, Crim. Law § 8-301(a)(4)" MEANS: (I) PHYSICAL INJURY; (II) SERIOUS EMOTIONAL DISTRESS; OR (III) ECONOMIC DAMAGES.

(a)(7) "INDISTINGUISHABLE FROM AN ACTUAL AND IDENTIFIABLE HUMAN BEINGIndistinguishable from an actual and identifiable human being"Indistinguishable from an actual and identifiable human being" means an image an ordinary person would conclude is of an actual and identifiable human being. "Indistinguishable from an actual and identifiable human being" includes an image that is computer–generated and has been created, adapted, or modified to appear as an actual and identifiable human being.Md. Code, Crim. Law § 8-301(a)(7)" MEANS AN IMAGE AN ORDINARY PERSON WOULD CONCLUDE IS OF AN ACTUAL AND IDENTIFIABLE HUMAN BEING. (II) "INDISTINGUISHABLE FROM AN ACTUAL AND IDENTIFIABLE HUMAN BEINGIndistinguishable from an actual and identifiable human being"Indistinguishable from an actual and identifiable human being" means an image an ordinary person would conclude is of an actual and identifiable human being. "Indistinguishable from an actual and identifiable human being" includes an image that is computer–generated and has been created, adapted, or modified to appear as an actual and identifiable human being.Md. Code, Crim. Law § 8-301(a)(7)" INCLUDES AN IMAGE THAT IS COMPUTER–GENERATED AND HAS BEEN CREATED, ADAPTED, OR MODIFIED TO APPEAR AS AN ACTUAL AND IDENTIFIABLE HUMAN BEING.

This subsection adds several new defined terms to Maryland's identity fraud statute to support the bill's AI and deepfake provisions. Key additions include artificial intelligence (cross-referencing the State Finance and Procurement Article definition), deepfake representation (covering AI-generated media indistinguishable from a real person, but excluding drawings, cartoons, sculptures, and paintings), harm (encompassing physical injury, serious emotional distress, and economic damages), and indistinguishable from an actual and identifiable human being (using an ordinary-person standard). Existing definitions are renumbered to accommodate the new terms.

Md. Code, Crim. Law § 8-301(b-2)
Prohibition on using personal identifying information to cause harm

(b-2) 1 A PERSON MAY NOT KNOWINGLY, WILLFULLY, AND WITH FRAUDULENT INTENT UTILIZE THE PERSONAL IDENTIFYING INFORMATION OF AN INDIVIDUAL, WITHOUT THE CONSENT OF THE INDIVIDUAL, IN ORDER TO CAUSE HARMHarm"Harm" means: (I) physical injury; (II) serious emotional distress; or (III) economic damages.Md. Code, Crim. Law § 8-301(a)(4).

New subsection (b-2) creates a standalone criminal prohibition against knowingly, willfully, and with fraudulent intent utilizing personal identifying information of an individual, without consent, in order to cause harm. This broadens the existing identity fraud provision in subsection (b) — which requires intent to obtain a benefit or access health information — by adding harm (physical injury, serious emotional distress, or economic damages) as an independent prohibited purpose. The provision applies to any person and is not limited to AI or deepfake contexts, though it complements the AI-specific provisions added elsewhere in the bill.

Compliance actions 1 item
1
A person must not knowingly, willfully, and with fraudulent intent utilize personal identifying information of an individual, without consent, in order to cause harmHarm"Harm" means: (I) physical injury; (II) serious emotional distress; or (III) economic damages.Md. Code, Crim. Law § 8-301(a)(4) (physical injury, serious emotional distress, or economic damages).
Md. Code, Crim. Law § 8-301(c)(2)(iv)
Identity assumption — expanded prohibited purposes

(c)(2)(iv) 2 HARMHarm"Harm" means: (I) physical injury; (II) serious emotional distress; or (III) economic damages.Md. Code, Crim. Law § 8-301(a)(4), HARASS, INTIMIDATE, THREATEN, OR COERCE THE OTHER PERSON.

The bill adds a new subparagraph (iv) to the existing identity assumption offense, making it a crime to knowingly and willfully assume the identity of another person (including a fictitious person) with fraudulent intent to harm, harass, intimidate, threaten, or coerce that person. This supplements the existing prohibited purposes of avoiding identification, obtaining a benefit, accessing health information, and avoiding payment of debt.

Compliance actions 1 item
2
A person must not knowingly and willfully assume the identity of another person with fraudulent intent to harmHarm"Harm" means: (I) physical injury; (II) serious emotional distress; or (III) economic damages.Md. Code, Crim. Law § 8-301(a)(4), harass, intimidate, threaten, or coerce that person.
Md. Code, Crim. Law § 8-301(f)(2)
Prohibition on AI and deepfake impersonation and false records
DeployerDeveloperPublisher

(f)(2)(I) 3 A PERSON MAY NOT KNOWINGLY, WILLFULLY, AND WITH FRAUDULENT INTENT USE ARTIFICIAL INTELLIGENCEArtificial intelligence"Artificial intelligence" has the meaning stated in § 3.5–801 of the State Finance and Procurement Article. [Per § 3.5-801(c): "Artificial intelligence" means a machine–based system that: (1) can, for a given set of human–defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments; (2) uses machine and human–based inputs to perceive real and virtual environments and abstracts those perceptions into models through analysis in an automated manner; and (3) uses model inference to formulate options for information or action.]Md. Code, Crim. Law § 8-301(a)(2); Md. Code, State Fin. & Proc. § 3.5-801(c) OR A DEEPFAKE REPRESENTATIONDeepfake representation"Deepfake representation" means a photograph, a film, a video, an audio recording, a digital image, a picture, or a computer or computer–generated image or picture, whether made, produced, or generated by electronic, mechanical, or other means, that is indistinguishable from an actual and identifiable human being. "Deepfake representation" does not include images or items depicting human beings that are: 1. drawings; 2. cartoons; 3. sculptures; or 4. paintings.Md. Code, Crim. Law § 8-301(a)(3) TO: (I) IMPERSONATE, FALSELY DEPICT, OR CLAIM TO REPRESENT ANOTHER PERSON WITH THE INTENT TO DEFRAUD, MISLEAD, OR CAUSE HARMHarm"Harm" means: (I) physical injury; (II) serious emotional distress; or (III) economic damages.Md. Code, Crim. Law § 8-301(a)(4) TO THAT PERSON OR ANY OTHER PERSON;

(f)(2)(II) 4 CREATE OR DISTRIBUTE FALSE RECORDS WITH THE INTENT TO: 1. CAUSE HARMHarm"Harm" means: (I) physical injury; (II) serious emotional distress; or (III) economic damages.Md. Code, Crim. Law § 8-301(a)(4) TO ANOTHER PERSON; 2. INDUCE ANOTHER PERSON TO PROVIDE PERSONAL IDENTIFYING INFORMATIONPersonal identifying information"Personal identifying information" includes a name, address, telephone number, driver's license number, Social Security number, place of employment, employee identification number, health insurance identification number, medical identification number, mother's maiden name, bank or other financial institution account number, date of birth, personal identification number, unique biometric data, including fingerprint, voice print, retina or iris image or other unique physical representation, digital signature, credit card number, or other payment device number. "Personal identifying information" may be derived from any element in subparagraph (i) of this paragraph, alone or in conjunction with any other information to identify a specific natural or fictitious individual.Md. Code, Crim. Law § 8-301(a)(10); OR 3. OBTAIN A BENEFIT, CREDIT, GOOD, SERVICE, OR OTHER THING OF VALUE.

This is the bill's core AI-specific prohibition. New subsection (f)(2) makes it a crime for any person to knowingly, willfully, and with fraudulent intent use artificial intelligence or a deepfake representation to either (I) impersonate, falsely depict, or claim to represent another person with intent to defraud, mislead, or cause harm, or (II) create or distribute false records with intent to cause harm, induce someone to provide personal identifying information, or obtain a benefit. The mens rea is triple-layered — knowingly, willfully, and with fraudulent intent — establishing a high bar for criminal liability. The penalties under subsection (g)(5) are felony-level, scaling with the number of victims.

Compliance actions 2 items
3
A person must not knowingly, willfully, and with fraudulent intent use artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning stated in § 3.5–801 of the State Finance and Procurement Article. [Per § 3.5-801(c): "Artificial intelligence" means a machine–based system that: (1) can, for a given set of human–defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments; (2) uses machine and human–based inputs to perceive real and virtual environments and abstracts those perceptions into models through analysis in an automated manner; and (3) uses model inference to formulate options for information or action.]Md. Code, Crim. Law § 8-301(a)(2); Md. Code, State Fin. & Proc. § 3.5-801(c) or a deepfake representationDeepfake representation"Deepfake representation" means a photograph, a film, a video, an audio recording, a digital image, a picture, or a computer or computer–generated image or picture, whether made, produced, or generated by electronic, mechanical, or other means, that is indistinguishable from an actual and identifiable human being. "Deepfake representation" does not include images or items depicting human beings that are: 1. drawings; 2. cartoons; 3. sculptures; or 4. paintings.Md. Code, Crim. Law § 8-301(a)(3) to impersonate, falsely depict, or claim to represent another person with intent to defraud, mislead, or cause harmHarm"Harm" means: (I) physical injury; (II) serious emotional distress; or (III) economic damages.Md. Code, Crim. Law § 8-301(a)(4) to that person or any other person.
CP-01
4
A person must not knowingly, willfully, and with fraudulent intent use artificial intelligenceArtificial intelligence"Artificial intelligence" has the meaning stated in § 3.5–801 of the State Finance and Procurement Article. [Per § 3.5-801(c): "Artificial intelligence" means a machine–based system that: (1) can, for a given set of human–defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments; (2) uses machine and human–based inputs to perceive real and virtual environments and abstracts those perceptions into models through analysis in an automated manner; and (3) uses model inference to formulate options for information or action.]Md. Code, Crim. Law § 8-301(a)(2); Md. Code, State Fin. & Proc. § 3.5-801(c) or a deepfake representationDeepfake representation"Deepfake representation" means a photograph, a film, a video, an audio recording, a digital image, a picture, or a computer or computer–generated image or picture, whether made, produced, or generated by electronic, mechanical, or other means, that is indistinguishable from an actual and identifiable human being. "Deepfake representation" does not include images or items depicting human beings that are: 1. drawings; 2. cartoons; 3. sculptures; or 4. paintings.Md. Code, Crim. Law § 8-301(a)(3) to create or distribute false records with intent to cause harmHarm"Harm" means: (I) physical injury; (II) serious emotional distress; or (III) economic damages.Md. Code, Crim. Law § 8-301(a)(4), induce another person to provide personal identifying informationPersonal identifying information"Personal identifying information" includes a name, address, telephone number, driver's license number, Social Security number, place of employment, employee identification number, health insurance identification number, medical identification number, mother's maiden name, bank or other financial institution account number, date of birth, personal identification number, unique biometric data, including fingerprint, voice print, retina or iris image or other unique physical representation, digital signature, credit card number, or other payment device number. "Personal identifying information" may be derived from any element in subparagraph (i) of this paragraph, alone or in conjunction with any other information to identify a specific natural or fictitious individual.Md. Code, Crim. Law § 8-301(a)(10), or obtain a benefit.
CP-01
Md. Code, Crim. Law § 8-301(g)(5)
Criminal penalties for AI and deepfake impersonation

(g)(5)(I)–(II) A PERSON WHO VIOLATES SUBSECTION (F)(2) OF THIS SECTION INVOLVING ONE VICTIM IS GUILTY OF A FELONY AND ON CONVICTION IS SUBJECT TO IMPRISONMENT NOT EXCEEDING 5 YEARS OR A FINE NOT EXCEEDING $10,000 OR BOTH. (II) A PERSON WHO VIOLATES SUBSECTION (F)(2) OF THIS SECTION INVOLVING TWO OR MORE VICTIMS IS GUILTY OF A FELONY AND ON CONVICTION IS SUBJECT TO IMPRISONMENT NOT EXCEEDING 10 YEARS OR A FINE NOT EXCEEDING $15,000 OR BOTH.

New subsection (g)(5) establishes graduated felony penalties for violations of the AI/deepfake impersonation prohibition in subsection (f)(2). For offenses involving one victim, the penalty is up to 5 years imprisonment or a fine up to $10,000 or both. For offenses involving two or more victims, the penalty increases to up to 10 years imprisonment or a fine up to $15,000 or both. These are independent felony penalties — they do not depend on the value of any benefit obtained, unlike the graduated penalties in subsection (g)(1)–(2) that apply to traditional identity fraud.

Md. Code, Crim. Law § 8-301(h)
Private right of action for AI and deepfake impersonation victims

(h)(1)–(2) A PERSON WHO IS THE VICTIM OF AN ACT THAT WOULD CONSTITUTE A VIOLATION OF SUBSECTION (F)(2) OF THIS SECTION MAY BRING A CIVIL ACTION AGAINST THE PERSON OR PERSONS WHO COMMITTED THE ACT IN A COURT OF COMPETENT JURISDICTION. (2) THE COURT MAY: (I) ISSUE AN INJUNCTION TO PREVENT OR RESTRAIN AN ACT THAT WOULD CONSTITUTE A VIOLATION OF SUBSECTION (F)(2) OF THIS SECTION; AND (II) GRANT ANY OTHER APPROPRIATE RELIEF.

New subsection (h) creates a private right of action specifically for victims of the AI/deepfake impersonation offense under subsection (f)(2). The victim may bring a civil action in a court of competent jurisdiction, and the court may issue injunctive relief to prevent or restrain violations and grant any other appropriate relief. The provision does not specify statutory damages, attorney fee shifting, or a statute of limitations, leaving those to general Maryland civil procedure rules. This is notable as a civil companion to an otherwise criminal statute.

Passage Likelihood

Failed
Status Failed
Final action Hearing 2/26 at 1:00 p.m.

Legislative History

2025-02-03 First Reading Judicial Proceedings
2025-02-04 Hearing 2/26 at 1:00 p.m.

Entry Last Reviewed

2026-05-20
AI generated