Recording Law for Voiceprints & Biometric Data in Maryland

Maryland’s wiretapping law, found in Courts & Judicial Proceedings §§ 10-401 through 10-414, generally requires all parties to a conversation to consent before anyone can legally record it. The law protects three types of communications: wire communications (like phone calls), oral communications (in-person speech), and electronic communications (like texts or emails). Wire communications are protected essentially per se—consent of all parties is required regardless of whether a reasonable-expectation-of-privacy analysis would otherwise apply. For phone calls and electronic messages, consent is always required; there’s no exception based on where the call or message happens. For in-person conversations, the law only protects "oral communications," which Maryland defines in §10-401(13)(i) as "'Oral communication' means any conversation or words spoken to or by any person in private conversation." Whether a conversation counts as "private" depends on whether the speaker had a reasonable expectation of privacy under the two-part Katz test applied by Maryland courts. If the conversation is loud, public, or observable by others, it’s not considered private and doesn’t require consent under the wiretap law. But if it’s quiet, secluded, or meant to be kept from others, all parties must consent before recording. Electronic communications (e.g., text messages or emails) are covered similarly to wire communications and require all-party consent regardless of setting.

Maryland courts have ruled that conversations in public places or during public interactions with police generally don’t qualify as protected "oral communications" under the wiretap law. For example, an unreported trial-court decision in State v. Graber (Harford Co. Cir. Ct., Crim. No. 12-K-10-000462, Sept. 27, 2010) dismissed wiretapping charges against a motorcyclist who recorded a state trooper during a public traffic stop, finding the trooper had no reasonable expectation of privacy in statements made during a public roadside encounter; however, this ruling is not binding precedent. Maryland’s Fourth Circuit federal appeals court has also recognized a First Amendment right to record police performing their duties in public in Sharpe v. Winterville Police Dep't, 59 F.4th 674 (4th Cir. 2023). So, if you’re recording a conversation in a public space like a street, park, or transit platform, or during an interaction with police in a public setting, Maryland’s wiretap law likely does not require consent. But if the conversation moves indoors, into a vehicle, or into a space where speakers take steps to keep it private, consent may still be required. Maryland’s statute draws a meaningful line between "wire communications" (e.g., phone calls) and "oral communications" (in-person speech), with wire communications protected per se and oral communications protected only where a reasonable expectation of privacy exists.

Maryland’s Online Data Privacy Act (MODPA), effective October 1, 2025, treats voiceprints as "biometric data"—a category of sensitive data that can’t be collected unless it’s strictly necessary to provide the service a consumer requested. The law defines a voiceprint as data generated from automatic measurements of biological characteristics used to uniquely authenticate a person’s identity, and explicitly includes "a voice print" within its definition of biometric data under §14-4701(d). Under MODPA §14-4707(a)(1), collecting or processing biometric data is only lawful if it’s strictly necessary to provide or maintain a specific product or service the consumer asked for; consent alone does not make a non-necessary collection legal. The law also bans the sale of biometric data outright, with no exceptions. MODPA applies to businesses that process data of at least 35,000 Maryland consumers annually, or 10,000 consumers if more than 20% of gross revenue comes from selling personal data. Smaller operations may not be covered, but if you’re using voiceprints for speaker identification in Maryland, you must ensure the collection is strictly necessary for the service the user requested. MODPA’s enforcement is handled by the Attorney General, with a mandatory 60-day cure period before an action can be brought, which sunsets for violations occurring after April 1, 2027.

Maryland’s wiretap law only protects in-person conversations where the speaker had a reasonable expectation of privacy; this gate does not apply to phone calls or electronic messages, which are protected per se. Courts apply a two-part test: first, whether the speaker subjectively expected privacy, and second, whether society would recognize that expectation as reasonable. Location matters, but it’s not the only factor. For example, a Maryland appeals court ruled in Malpas v. State, 116 Md. App. 69, 695 A.2d 588 (Md. Ct. Spec. App. 1997), that a third party’s loud, profane statements made in his own apartment were not protected because they were "the functional equivalent of statements knowingly exposed to the public." The court noted the statements were audible through a shared wall to someone in the next unit and were recorded by the defendant on a handheld cassette recorder. So, even in a private home, if speech is loud enough to be overheard by unintended listeners, it may not be protected. Quiet conversations, or those in enclosed spaces like a closed booth or a room with the door shut, are more likely to qualify as private and require consent to record. Maryland’s highest court has also been cited as endorsing this reasonable-expectation-of-privacy framework in Agnew v. State, 461 Md. 672, 197 A.3d 27 (2018). Maryland courts have held that wire communications (telephone calls) are protected regardless of a case-by-case reasonable-expectation-of-privacy showing, while electronic communications (text/email) are covered similarly to wire communications. The net effect is that an all-party-consent rule applies to phone calls and to in-person conversations that are legally "private," but no wiretap-consent obligation attaches to in-person speech in public/non-private settings.

Imagine you’re a Maryland lawyer using a voice-authentication feature in your legal tech tool during a client meeting in your office. The meeting is quiet, the door is closed, and the client isn’t aware they’re being recorded for voice authentication. Under Maryland’s wiretap law, this is likely an in-person "oral communication" in a private setting, so all parties—you and your client—must consent before recording. Even if the recording is only used for voice authentication, the law doesn’t distinguish between types of recordings; it covers any interception of a private conversation. Separately, if your tool extracts a biometric voiceprint from the recording and stores it, you must also comply with Maryland’s MODPA. Storing a voiceprint for authentication would only be legal if it’s strictly necessary to provide the service the client requested—and MODPA bans the sale of biometric data outright. If the meeting were held in a public park instead, with no effort to keep the conversation private, consent likely wouldn’t be required under the wiretap law, but MODPA’s strict-necessity rule would still apply to any voiceprint collection. Maryland’s statute excludes electronic communications from the definition of "oral communication," so text messages and emails are treated like phone calls and require all-party consent regardless of setting.

Recording a private conversation without all-party consent in Maryland is a felony under Courts & Judicial Proceedings § 10-402, punishable by up to five years in prison and a $10,000 fine. Even if the recording isn’t used maliciously, the act of intercepting a private conversation without consent is itself a crime. Maryland also allows private lawsuits under § 10-410, where individuals can sue for damages—at least $100 per day or $1,000 in liquidated damages, plus punitive damages and attorney’s fees. Under MODPA, enforcement is handled by the Attorney General, not private individuals, and violations are treated as unfair or deceptive trade practices. MODPA doesn’t impose per-violation statutory damages, but it does require a 60-day cure period before the AG can bring an action, which sunsets for violations occurring after April 1, 2027. For voiceprint collection, if MODPA applies and the collection isn’t strictly necessary, the AG could order you to stop and impose penalties, even if no consumer harm occurred. Maryland’s penalty structure is mixed: felony penalties apply to interception under §10-402(b), while lesser penalties and misdemeanor-level fines apply to certain related offenses under §10-402(d) and (e).