State guide
Maryland ID scanning laws
Maryland does not restrict ID scanning, and its privacy law lets covered businesses collect only what is reasonably necessary for what the customer asked for.
For bars, restaurants, dispensaries and retailers, the practical questions are when an ID check is required, which IDs count as proof of age, how tobacco and vape sales must be checked and what Maryland's privacy law means for the data you keep.
Reviewed September 27, 2026 · 21 primary sources linked
Maryland at a glance
- Is it legal to scan IDs in Maryland?
- Yes.Maryland has no general law prohibiting ID scanning. For tobacco and vape retailers, the licensing and health laws use conflicting language about whether an electronic or mechanical device may assist the face-to-face age check.
- Do you have to check IDs in Maryland, and when?
- It depends on what you sell.Tobacco and vape retailers check government-issued photo ID for customers under 30, and dispensaries check ID before every sale. Maryland's alcohol law does not require every customer to be carded.
- Which IDs provide protection in Maryland?
- For alcohol, Maryland lists a Maryland license or ID card for a Maryland resident, a US military ID and Maryland's mobile ID.The alcohol defense itself is not tied to that list. Tobacco sales need a government-issued photo ID with the date of birth, and dispensaries accept a wider list that includes passports and out-of-state licenses.
- Can you keep data from an ID scan in Maryland?
- Yes.Maryland sets no general scan-specific field list or retention period, but covered businesses must follow the state's privacy rules. Dispensaries need an adult-use customer's express permission to create or maintain a customer profile.
- What other Maryland laws reach the data you keep?
- A privacy law with a 35,000-resident threshold, and a data-security law for every business.The Maryland Online Data Privacy Act applies above its thresholds and limits collection to what is reasonably necessary and proportionate to the service the customer requested. The data-security law covers a name kept with an unencrypted driver's license or ID number.
- Does scanning give you a defense if you serve a minor in Maryland?
- A scan does not create the alcohol defense, but it can document the ID staff relied on.The defense depends on the customer's written representation and supporting documents, the customer's appearance and staff's good faith. County-specific due-caution defenses may also apply.
- Can a customer refuse an ID scan in Maryland?
- Maryland does not generally create a right to refuse a scan or require a manual alternative.Dispensaries are different: they may not refuse a sale solely because an adult-use customer declines to have personal information saved for a customer profile.
What Maryland venues should know
Is it legal to scan IDs in Maryland?
Yes. Maryland does not generally prohibit ID scanning, but its tobacco and vape laws use conflicting language about devices.
Maryland's alcohol law does not require venues to scan an ID, and it does not restrict scanning either. The same is true of the state's driver's license law. What Maryland regulates is the age check itself and, for businesses its privacy law covers, how much personal data is collected.
At tobacco and vape counters, Maryland's two sets of rules word the use of a device differently. The licensing laws for cigarettes, other tobacco products and vapes say a retailer may verify age only in a direct face-to-face exchange without the assistance of any electronic or mechanical device. The health law, which also covers these retailers, says the face-to-face exchange includes the assistance of any electronic or mechanical device.
Do you have to check IDs in Maryland, and when?
It depends on what you sell.
Alcohol
Maryland prohibits selling or providing alcohol to anyone under 21, but its alcohol law does not require every customer to be carded. Every retail alcohol license must have the license holder or a designated employee trained in an approved alcohol awareness program, and those programs cover how to tell whether a customer is under 21.
Tobacco and vape
Licensed retailers must check a government-issued photo ID showing the date of birth, face to face, before selling cigarettes, other tobacco products or vapes, unless the customer is 30 or older. Maryland's licensing and health laws word the use of a device at that check differently.
The licensing laws say a retailer may verify age only in a direct face-to-face exchange without the assistance of any electronic or mechanical device. The health law, which also covers these retailers, says the exchange includes the assistance of any electronic or mechanical device.
Cannabis
Dispensaries must check a valid, unexpired government-issued photo ID showing the date of birth before every sale. Apart from young children with a patient or caregiver, only adults 21 or older and registered patients and caregivers may enter. The state cannabis regulator has said dispensaries do not have to use ID scanners, at the counter or at the door.
The exact wording
A license holder or an employee of the license holder may not sell or provide alcoholic beverages to an individual under the age of 21 years.
A holder of any retail alcoholic beverages license or an employee designated by the holder shall complete training in an approved alcohol awareness program.
(2) Subject to paragraph (3) of this subsection, a licensed retailer may verify an individual's age only: (i) by means of a government-issued photo identification containing the individual's date of birth; and (ii) in a direct face-to-face exchange without the assistance of any electronic or mechanical device. (3) A licensed retailer is not required to verify the age of an individual at least 30 years old.
(2) A person who distributes tobacco products may verify an individual's age only: (i) By means of a government-issued photo identification containing the individual's date of birth; and (ii) In a direct face-to-face exchange including the assistance of any electronic or mechanical device.
At the point of sale, a dispensary agent shall verify that the consumer is 21 years old or older using the consumer's government-issued photo identification.
Dispensaries are not required to purchase or employ identification scanners either at the point-of-sale or upon entry to the licensed premises to be in compliance.
Md. Code, Alco. Bev. & Cannabis 4-505Md. Code, Bus. Reg. 16.7-204.1Md. Code, Health-Gen. 24-305COMAR 14.17.12.04Maryland Cannabis Administration dispensary guidance
Which IDs provide protection in Maryland?
Maryland uses different ID rules for alcohol, tobacco and cannabis, so the accepted ID depends on the transaction.
The alcohol law names:
- A Maryland driver's license or ID card, if the holder is a Maryland resident
- A US military ID card
- The mobile ID issued by the Maryland Motor Vehicle Administration
Maryland's alcohol defense is not tied to this list. It turns on whether the customer backed a false written age claim with documents, and it does not name a particular ID.
Tobacco and vape retailers check a government-issued photo ID showing the date of birth. The state cannabis regulator lists the IDs dispensaries may accept: a driver's license or ID card from a US state, territory or the District of Columbia, a US passport or passport card, a foreign passport, a US military ID or a tribal card. A college or university ID does not qualify.
The exact wording
A license holder or an employee of the license holder may accept as proof of an individual's age: (1) if the individual is a resident of the State, the individual's driver's license or identification card as provided for in the Maryland Vehicle Law; (2) a United States military identification card; or (3) the individual's electronic credential issued by the Motor Vehicle Administration under Title 16, Subtitle 10 of the Transportation Article.
(2) A government-issued identification card under §B(1) of this regulation includes: (a) State driver's license; (b) U.S. passport; (c) U.S. passport card; (d) Non-driver's state photo ID card; (e) Foreign passport; (f) U.S. military ID card; and (g) Tribal card. (3) A government-issued photo identification card does not include a student identification card issued by a public institution or university.
Md. Code, Alco. Bev. & Cannabis 6-305Md. Code, Alco. Bev. & Cannabis 6-306Maryland Cannabis Administration dispensary guidanceCOMAR 14.17.12.04Md. Code, Transp. 16-1001
Can you keep data from an ID scan in Maryland?
Yes. Maryland does not impose a general scan-specific retention period, but privacy and dispensary rules can limit what you collect and keep.
No Maryland alcohol, tobacco or driver's license law says which details from an ID may be kept or for how long, so the retention period is largely a matter of venue policy. The information you keep can still bring the state's privacy and data-security laws into play, and both apply whether a detail was scanned or typed in by staff.
Dispensaries are different: they may not use an adult-use customer's personal information to create or maintain a customer profile without the customer's express permission, and they may not refuse a sale because the customer declines. The state cannabis regulator has said this rule covers data saved or sent by a dispensary's ID scanning system. Its guidance says dispensaries should switch off any scanner setting that automatically saves or sends personal data other than the customer's first name, which may be collected to identify them at the point of sale.
The exact wording
Consumer Profiles. A dispensary may not: (a) Use an adult-use consumer's personal information, including records of their purchases, to create or maintain a customer profile without the consumer's express permission; or (b) Deny an adult-use consumer the opportunity to purchase adult-use cannabis exclusively on the basis that the customer does not consent to the storage and use of their personal information.
This provision applies to data collected at the point of sale, as well as any data saved or transmitted by a dispensary's identification card scanning system. A dispensary should inspect its identification card scanning system and disable any setting that automatically saves or transmits any personal data other than an adult-use consumer's first name. A dispensary's identification card scanning system may collect an adult-use consumer's first name for the limited purpose of identifying them at the point of sale.
"Process" means an operation or set of operations performed by manual or automated means on personal data.
Md. Code, Com. Law 14-4701COMAR 14.17.12.04Maryland Cannabis Administration, Customer Profiles
What other Maryland laws reach the data you keep?
Maryland combines a data-security law that applies at any business size with a consumer privacy law for businesses above its thresholds.
The Maryland Online Data Privacy Act took effect on October 1, 2025. It applies to a business that, in the previous calendar year, handled the personal data of at least 35,000 Maryland residents, not counting data used only to complete a payment, or of at least 10,000 residents while earning more than 20 percent of its gross revenue from selling personal data.
A business the act covers must limit the personal data it collects to what is reasonably necessary and proportionate to provide or maintain the specific product or service the customer asked for. Stricter limits apply to sensitive data, a category that includes data revealing national origin or citizenship or immigration status: it may be collected only where strictly necessary for that service, and it may not be sold. Violations are treated as unfair, abusive or deceptive trade practices.
Maryland's data-security law has no size threshold. A Maryland resident's name kept with an unencrypted driver's license, state ID or passport number is personal information, and a business holding it must use reasonable security, take reasonable steps to protect it when the records are destroyed and give notice of a qualifying breach.
The exact wording
This subtitle applies to a person that conducts business in the State or provides products or services that are targeted to residents of the State, and that during the preceding calendar year did any of the following: (1) Controlled or processed the personal data of at least 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) Controlled or processed the personal data of at least 10,000 consumers and derived more than 20% of its gross revenue from the sale of personal data.
(b) (1) A controller shall: (i) Limit the collection of personal data to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer to whom the data pertains; (ii) Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data at issue; and (iii) Provide an effective mechanism for a consumer to revoke the consumer's consent under this section that is at least as easy as the mechanism by which the consumer provided the consumer's consent.
Md. Code, Com. Law 14-4702Md. Code, Com. Law 14-4707Md. Code, Com. Law 14-3501Md. Code, Com. Law 14-3503
Does scanning give you a defense if you serve a minor in Maryland?
No. A scan can document which ID staff relied on, while Maryland's alcohol defense depends on the customer's written claim, documents, appearance and staff's good faith.
Maryland's alcohol defense has three parts, and none depends on how the ID was checked. The customer must have falsely claimed in writing to be 21 or older, backed the claim with documents and looked 21 or older to a reasonable, careful person. The sale must also have been made in good faith, relying on that claim and the customer's appearance.
Most counties' sections of the alcohol law add a second defense where staff used due caution to establish that the customer was 21 or older. In most of those counties it applies only when the customer is not a Maryland resident. A scan record can help show which ID was presented and when, but it does not stand in for the staff check of the customer's appearance.
For tobacco and vape, the defense is that staff examined, in a direct face-to-face exchange, a driver's license or other valid government ID showing the customer was 21 or older. Dispensaries have a similar defense when an agent examined a driver's license or other valid government ID showing the customer met the minimum age.
The exact wording
The establishment of the following facts by a seller of alcoholic beverages to an underage individual is prima facie evidence of innocence and a defense to a prosecution for serving alcoholic beverages to an underage individual: (1) the purchaser falsely represented in writing and supported with other documentary evidence that the purchaser was of legal age to purchase alcoholic beverages; (2) on the basis of the appearance of the purchaser, an ordinary and prudent individual would believe the purchaser to be of legal age to purchase alcoholic beverages; and (3) the sale was made in good faith and in reliance on the written representation and appearance of the purchaser.
(b) A license holder or an employee of a license holder may not be found guilty of a violation of § 6-304 of this article if: (1) the license holder or employee establishes to the satisfaction of the finder of fact that the license holder or employee used due caution to establish that the individual was not under the age of 21 years; and (2) the individual was not a resident of the State.
In a prosecution for a violation of this section, it is a defense that the defendant examined, in a direct, face-to-face exchange, the purchaser's or recipient's driver's license or other valid identification issued by a government unit that positively identified the purchaser or recipient as at least 21 years of age.
In a hearing for an alleged violation of this section, it is a defense that an agent of the defendant examined the consumer's, patient's, or caregiver's driver's license or other valid identification issued by a governmental unit that positively identified the consumer, patient, or caregiver as meeting the minimum age specified in subsection (a) of this section.
Md. Code, Alco. Bev. & Cannabis 6-306Md. Code, Alco. Bev. & Cannabis 9-2702Md. Code, Crim. Law 10-107Md. Code, Alco. Bev. & Cannabis 36-1101
Can a customer refuse an ID scan in Maryland?
Maryland does not create a general right to refuse a scan, but dispensaries must let adult-use customers decline profile storage without losing the sale.
Maryland does not require a venue to offer manual inspection as an alternative to scanning. How a venue handles a customer who does not want their ID scanned is therefore generally a matter of venue policy, and where an ID check is required, the customer still has to show an acceptable ID for the sale to go ahead.
Dispensaries must post a notice from the state cannabis regulator where staff first ask for ID. It tells customers that the state does not require dispensaries to keep their personal information to create a customer profile, and that they can refuse to have it saved without being denied service on that basis.
Any refusal policy is subject to Maryland's public-accommodation law, which bars refusing service because of race, sex, age, color, creed, national origin, marital status, sexual orientation, gender identity or disability.
The exact wording
Although ID checks are required by law to ensure customers are 21+, the Maryland Cannabis Administration does not require dispensaries to retain your personal information to create or maintain a customer profile.
An owner or operator of a place of public accommodation or an agent or employee of the owner or operator may not refuse, withhold from, or deny to any person any of the accommodations, advantages, facilities, or privileges of the place of public accommodation because of the person's race, sex, age, color, creed, national origin, marital status, sexual orientation, gender identity, or disability.
COMAR 14.17.12.04Maryland Cannabis Administration, Customer ProfilesMd. Code, State Gov't 20-304
Alcohol, tobacco and cannabis
Alcohol
Maryland's alcohol defense rests on the customer's written claim, documents and appearance, not on how the ID was checked.
Local liquor boards issue and enforce alcohol licenses, and most counties' sections of the alcohol law add their own due-caution defense. Every retail license must have the license holder or a designated employee trained in an approved alcohol awareness program.
Md. Code, Alco. Bev. & Cannabis 6-306Tobacco and vape
Licensed retailers check a government-issued photo ID face to face for any customer under 30.
The licensing laws for cigarettes, other tobacco products and vapes say a retailer may verify age only in a face-to-face exchange without the assistance of any electronic or mechanical device. The health law, which also covers these retailers, says the exchange includes that assistance, and both require a government-issued photo ID showing the date of birth.
Md. Code, Bus. Reg. 16-209.1Cannabis
Dispensaries check ID at every sale and need an adult-use customer's express permission to build a customer profile.
A dispensary may not refuse a sale because a customer declines to have their information saved, and it must post a notice saying so where staff ask for ID. The state cannabis regulator has said the profile rule reaches data saved by a dispensary's ID scanning system.
COMAR 14.17.12.04What this means for your AgeShield setup
These are the AgeShield settings affected by the Maryland rules above. How you configure them is ultimately a decision for your venue.
- How long visits are kept
- Maryland sets no scan-specific retention period.AgeShield setting: Set your retention period based on your venue's own policy.
- Which ID fields are stored
- Maryland sets no scan-specific field list. A business its privacy law covers must limit the personal data it collects to what is reasonably necessary and proportionate to the service the customer asked for. The state cannabis regulator's guidance says dispensaries should switch off any ID scanner setting that automatically saves or sends personal data other than an adult-use customer's first name.AgeShield setting: Choose which ID fields are collected and stored. Individual fields can be switched off.
- Manual entry
- Maryland's privacy and data-security laws apply the same way to details typed in by staff as to scanned ones.AgeShield setting: Enable manual entry if your venue uses it as part of its own ID-checking policy.
- Consent screen
- Maryland does not require a consent screen for ID scanning. A dispensary needs an adult-use customer's express permission to create a customer profile and may not refuse a sale when the customer declines.AgeShield setting: Enable the consent screen if your venue chooses to use one as part of its own policy.
- Banned and watch lists
- Maryland has no law on venue banned lists. Refusals of service are subject to the state's public-accommodation law.AgeShield setting: Banned, VIP, Regulars and custom lists can be kept for one venue or shared across an owner's venues. A Banned entry carries a reason and a note.
- Security of what you keep
- A Maryland resident's name kept with an unencrypted driver's license, state ID or passport number is personal information under Maryland's data-security law, at any business size.AgeShield setting: Use the retention and field controls to limit what information is stored and how long it is kept.
Common questions
Is it legal to scan IDs at a bar in Maryland?
Yes. Maryland has no specific law about scanning an ID, and its alcohol law does not restrict scanning.
Do you have to check IDs in Maryland, and when?
It depends on what you sell. Tobacco and vape retailers check government-issued photo ID for customers under 30, and dispensaries check ID before every sale. Maryland's alcohol law does not require every customer to be carded.
Which IDs provide protection in Maryland?
For alcohol, Maryland lists a Maryland license or ID card for a Maryland resident, a US military ID and Maryland's mobile ID. The alcohol defense itself is not tied to that list and depends on the customer's written age claim, supporting documents, appearance and staff's good faith.
Can you keep data from an ID scan in Maryland?
Yes. Maryland sets no general scan-specific field list or retention period, but covered businesses must follow the state's privacy rules, and its data-security law applies at any size. Dispensaries need an adult-use customer's express permission to create or maintain a customer profile.
Does the Maryland Online Data Privacy Act apply to my venue?
It applies to a business that handled the personal data of at least 35,000 Maryland residents in the previous calendar year, not counting data used only to complete a payment, or of 10,000 residents while earning more than 20 percent of its gross revenue from selling personal data. A Maryland resident whose ID a business scans is one of the residents whose personal data it has handled.
Does scanning give you a defense if you serve a minor in Maryland?
A scan does not create the alcohol defense, but it can document the ID staff relied on. The defense depends on the customer's written representation and supporting documents, the customer's appearance and staff's good faith. County-specific due-caution defenses may also apply.
Can a customer refuse an ID scan in Maryland?
Maryland does not generally create a right to refuse a scan or require a manual alternative. Dispensaries are different: they may not refuse a sale solely because an adult-use customer declines to have personal information saved for a customer profile.
What do Maryland's tobacco laws say about using a device to check ID?
Maryland's licensing laws for cigarettes, other tobacco products and vapes say a retailer may verify age only in a direct face-to-face exchange without the assistance of any electronic or mechanical device. Its health law on the same sales says the exchange includes that assistance, and both require a government-issued photo ID showing the date of birth.
Does Maryland accept a mobile ID for alcohol?
Yes. Maryland's alcohol law lists the mobile ID issued by the Motor Vehicle Administration as proof of age.
Sources
- Md. Code, Alco. Bev. & Cannabis 6-304
- Md. Code, Bus. Reg. 16-209.1
- Md. Code, Health-Gen. 24-307
- Md. Code, Alco. Bev. & Cannabis 4-505
- Md. Code, Bus. Reg. 16.7-204.1
- Md. Code, Health-Gen. 24-305
- COMAR 14.17.12.04
- Maryland Cannabis Administration dispensary guidance
- Md. Code, Alco. Bev. & Cannabis 6-305
- Md. Code, Alco. Bev. & Cannabis 6-306
- Md. Code, Transp. 16-1001
- Md. Code, Com. Law 14-4701
- Maryland Cannabis Administration, Customer Profiles
- Md. Code, Com. Law 14-4702
- Md. Code, Com. Law 14-4707
- Md. Code, Com. Law 14-3501
- Md. Code, Com. Law 14-3503
- Md. Code, Alco. Bev. & Cannabis 9-2702
- Md. Code, Crim. Law 10-107
- Md. Code, Alco. Bev. & Cannabis 36-1101
- Md. Code, State Gov't 20-304
This page is for informational purposes only and is not a substitute for professional legal advice. We research each rule and link its source, so you can check it against your own venue. Questions are welcome at support@ageshield.bar.
ID scanning laws in nearby states
Rules change across state lines. Compare the ID-scanning guidance for nearby states.
- State lawState law
Virginia ID scanning laws
Virginia expressly allows ID scanning for listed purposes and recognizes scanners in tobacco age checks from October 2026. See when scan data may be kept.
- State lawState law
Washington, DC ID scanning laws
DC has no law that restricts ID scanning or sets how long scan details are kept. See when to check ID and which IDs count.
- State lawState law
Delaware ID scanning laws
Delaware does not restrict ID scanning, and a reasonable photo-ID check can protect a venue from alcohol license penalties. See the rule.
Still unsure how Maryland applies to your venue?
Tell us what type of venue you run and we'll point you to the published rules we know of that may apply.