Regulations › US states › Maryland
MODPA
Maryland Online Data Privacy Act
WhenIn effect since 1 October 2025
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsApplies to businesses controlling or processing data of 35,000+ Maryland consumers (excluding…
Universal opt-outFrom October 1, 2025, controllers must allow opt-outs of targeted ads and sale through an opt-…
Cure periodUntil April 1, 2027, the Division may, at its discretion, give a notice of violation with at l…
Request deadlineControllers must respond within 45 days, extendable once by 45 days with notice to the consumer
Maximum penaltyUnder the Consumer Protection Act, up to $10,000 per violation and up to $25,000 for each repe…
Private actionNo private right of action: the Consumer Protection Act private suit provision (§ 13-408) is e…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
2
Applies to businesses controlling or processing data of 35,000+ Maryland consumers (excluding payment-only data), or 10,000+ consumers with over 20% of gross revenue from data sales.Md. Code Com. Law § 14-4702 · source ↗
Enacted as 2024 Md. Laws ch. 454 (HB 567) and ch. 455 (SB 541) with sections numbered 14-46xx; codified as Com. Law §§ 14-4701 to 14-4714 (per DWT and 2026 SB 569 bill text). Cites use the codified numbering, mapped one to one from the chapter law.
Exemptions
2
Entity-level exemption for GLBA financial institutions; HIPAA data is exempt only at the data level. Nonprofits are covered except those that solely assist insurance-fraud or first-responder work.Md. Code Com. Law § 14-4703 · source ↗
Scored 2 because HIPAA is data-level only; coverage of nonprofits makes it stricter than the scale captures.
Sensitive data and minors
Sensitive data
3
Sensitive data may be processed only when strictly necessary for a requested product, and its sale is banned. It includes consumer health data and transgender or nonbinary status.Md. Code Com. Law §§ 14-4701, 14-4707(a) · source ↗
Children and teens
3
Under-13 data is sensitive (COPPA). Targeted ads to, and sale of data of, consumers the controller knew or should have known are 13 to 17 are restricted.Md. Code Com. Law § 14-4707(a) · source ↗
DWT describes the sale restriction for under-18s as a flat ban; the chapter-law text is redlined, so whether a consent exception applies to sale is uncertain.
Data minimization
3
Collection must be limited to what is reasonably necessary and proportionate to provide or maintain a specific product or service the consumer requested.Md. Code Com. Law § 14-4707(a) · source ↗
Maryland-style standard tied to the requested product. 2025 HB 1365, which would have relaxed it, did not advance past first reader.
Consumers' rights
Rights
2
Confirm and access, correct, delete, portability, list of categories of third parties receiving data, and opt out of targeted ads, sale and solely automated significant profiling.Md. Code Com. Law § 14-4705(b) · source ↗
Eight rights counted; the third-party list covers categories, not named recipients.
Request deadline
2
Controllers must respond within 45 days, extendable once by 45 days with notice to the consumer.Md. Code Com. Law § 14-4705(e) · source ↗
Appeals
2
Controllers must offer an appeal and decide it in writing within 60 days; on denial they must give a way to complain to the Consumer Protection Division.Md. Code Com. Law § 14-4705(f) · source ↗
Universal opt-out
2
From October 1, 2025, controllers must allow opt-outs of targeted ads and sale through an opt-out preference signal sent with the consumer's consent.Md. Code Com. Law § 14-4707(f)(3)(ii), (f)(4) · source ↗
The statute lists the signal under methods a controller 'may utilize'. Most trackers read it as required from Oct. 1, 2025, but DWT calls it discretionary. Treat the scoring as uncertain.
Business duties
Assessments
3
Assessments are required for heightened-risk processing, including targeted ads, sale, sensitive data and profiling, and must be done for each algorithm used. Available to the Division on request.Md. Code Com. Law § 14-4710 · source ↗
Applies to processing on or after October 1, 2025.
Processor contracts
3
Binding contract with detailed terms, assessments, confidentiality and return or deletion. Subcontractors may be used only after the controller can object, under flow-down written contracts.Md. Code Com. Law § 14-4708 · source ↗
Privacy notice
2
Notice must list data and sensitive-data categories, purposes, third-party categories, rights and appeals. Third parties must give notice before materially changing how they use shared data.Md. Code Com. Law §§ 14-4707(d)-(f), 14-4709 · source ↗
Loyalty programs
2
Bona fide loyalty programs may offer different prices or features, but selling personal data cannot be a condition of participation.Md. Code Com. Law § 14-4707(c)(2) · source ↗
De-identified data
2
Deidentified data needs reasonable safeguards, a public commitment not to reidentify and contract limits on recipients; disclosers must monitor recipients.Md. Code Com. Law §§ 14-4701, 14-4711 · source ↗
Pseudonymous-data provisions could not be confirmed in the redlined chapter text; may warrant level 3.
Enforcement
Who enforces
1
Enforced by the Attorney General's Consumer Protection Division as an unfair, abusive or deceptive trade practice under Title 13.Md. Code Com. Law § 14-4713 · source ↗
Cure period
1
Until April 1, 2027, the Division may, at its discretion, give a notice of violation with at least 60 days to cure. No cure right after that date.Md. Code Com. Law § 14-4714 · source ↗
Discretionary and sunsets April 1, 2027.
Maximum penalty
3
Under the Consumer Protection Act, up to $10,000 per violation and up to $25,000 for each repeat violation.Md. Code Com. Law § 14-4713; § 13-410 · secondary source · source ↗
Penalty amounts come from the Consumer Protection Act and were taken from DWT, not read in statute. Scored 3 on the $25,000 repeat-violation cap.
Private action
0
No private right of action: the Consumer Protection Act private suit provision (§ 13-408) is expressly excluded.Md. Code Com. Law § 14-4713 · source ↗
Rulemaking
0
The Act grants no specific rulemaking authority.Md. Code Com. Law §§ 14-4701 to 14-4714 · source ↗
No rulemaking provision found in the chapter law.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws