Regulations › US states › Maryland
MODPA
Maryland Online Data Privacy Act
WhenIn effect since 1 October 2025
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsApplies to businesses controlling or processing data of 35,000+ Maryland consumers (excluding…
Universal opt-outFrom October 1, 2025, controllers must allow opt-outs of targeted ads and sale through an opt-…
Cure periodUntil April 1, 2027, the Division may, at its discretion, give a notice of violation with at l…
Request deadlineControllers must respond within 45 days, extendable once by 45 days with notice to the consumer
Maximum penaltyUnder the Consumer Protection Act, up to $10,000 per violation and up to $25,000 for each repe…
Private actionNo private right of action: the Consumer Protection Act private suit provision (§ 13-408) is e…
68%
of Maryland's 19 requirements are already met by California (CA). Here is what MODPA adds, biggest gaps first.
Sensitive dataSensitive data and minorsBig gap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
MODPA adds3 Sensitive data may be processed only when strictly necessary for a requested product, and its sale is banned. It includes consumer health data and transgender or nonbinary status.
Md. Code Com. Law §§ 14-4701, 14-4707(a) · source ↗
ThresholdsWho it coversBig gap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
MODPA adds2 Applies to businesses controlling or processing data of 35,000+ Maryland consumers (excluding payment-only data), or 10,000+ consumers with over 20% of gross revenue from data sales.
Md. Code Com. Law § 14-4702 · source ↗
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
MODPA adds2 Controllers must offer an appeal and decide it in writing within 60 days; on denial they must give a way to complain to the Consumer Protection Division.
Md. Code Com. Law § 14-4705(f) · source ↗
Children and teensSensitive data and minorsGap
CA2 Opt-in consent needed to sell or share data of consumers under 16: parental consent under 13, the teen's own consent for ages 13 to 15.
MODPA adds3 Under-13 data is sensitive (COPPA). Targeted ads to, and sale of data of, consumers the controller knew or should have known are 13 to 17 are restricted.
Md. Code Com. Law § 14-4707(a) · source ↗
Data minimizationSensitive data and minorsGap
CA2 Collection, use, retention and sharing must be reasonably necessary and proportionate to the disclosed purposes.
MODPA adds3 Collection must be limited to what is reasonably necessary and proportionate to provide or maintain a specific product or service the consumer requested.
Md. Code Com. Law § 14-4707(a) · source ↗
Maximum penaltyEnforcementGap
CA2 Up to $2,663 per violation and $7,988 per intentional violation or violation involving known minors under 16 (2025 adjusted).
MODPA adds3 Under the Consumer Protection Act, up to $10,000 per violation and up to $25,000 for each repeat violation.
Md. Code Com. Law § 14-4713; § 13-410 · source ↗
Already covered by CA: Exemptions, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, De-identified data, Who enforces, Cure period, Private action, Rulemaking.
A gap means MODPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws