Maryland Online Data Privacy Act
MODPA · Normalized Research Card v2.1
IN FORCELAST VERIFIED · AUG 26 2026At a glance
Who must comply?
Applicability model: Lower numerical threshold.
Core threshold: 35,000 consumers; or 10,000 consumers and >20% gross revenue from sale
Applicability remains subject to statutory entity, data-level and activity-specific exemptions. Employment/B2B treatment and federal-law carve-outs should be read together with the official statute linked below.
Consumer rights
| Right / protection | Status |
|---|---|
| Limit use/disclosure | ✓ Included / qualified by statute |
| Opt-out sale/sharing | ✓ Included / qualified by statute |
| Correction | ✓ Included / qualified by statute |
| Know/access | ✓ Included / qualified by statute |
| Equal treatment | ✓ Included / qualified by statute |
| Deletion | ✓ Included / qualified by statute |
| Appeal | ✓ Included / qualified by statute |
Sensitive data & minors
Sensitive-data standard: Sale prohibited; processing/sharing limited to what is strictly necessary for a requested product or service
Personal data of a child is sensitive data; MODPA's strict-necessity rule materially affects sensitive-data processing.
Business obligations
Strong data minimization, privacy notice, reasonable safeguards, consumer-rights handling and assessments for heightened-risk processing, including qualifying algorithms.
Enforcement
Authority: Maryland Attorney General
Private right of action: No MODPA private enforcement right identified in official guidance
Penalty / remedy baseline: Up to $10,000 per violation; up to $25,000 for subsequent violations
What makes Maryland different?
Maryland is one of the most restrictive states in this baseline. Its minimization rule is tied to what is reasonably necessary and proportionate to provide a requested product or service, while sensitive data cannot be sold and may be processed only under a strict-necessity standard.
Developments to watch
MODPA is in force. Nonprofits are generally not categorically exempt, which increases practical reach.
Editorial rule: future-effective, proposed and pending measures are kept separate from current law.
Primary sources & verification
Last verified: August 26, 2026
Research standard: primary official sources prioritized; official guidance used to explain operational requirements.