Maryland Online Data Privacy Act of 2024
MODPA
Comprehensive privacy · Children · Health · Genetic · Biometric · Location
Maryland's comprehensive consumer privacy law gives residents rights to access, correct, delete, and port their personal data, to get a list of categories of third parties that received it, and to opt out of targeted advertising, sale, and significant-decision profiling. It is stricter than most state laws: data collection must be limited to what is reasonably necessary for a requested product or service, sensitive data may be collected only when strictly necessary and may never be sold, and minors' data may not be sold or used for targeted advertising. A 2026 amendment (HB 711, ch. 874) extends sensitive data to inferences and bars knowing sales of personal data to government units engaged in civil immigration enforcement.
- Where
- Maryland
- Citation
- Md. Code, Com. Law §§ 14-4701 to 14-4714 (enacted by 2024 Md. Laws chs. 454 and 455 as §§ 14-4601 to 14-4613, since renumbered)
- Status
- In force
- In force since
- 2025-10-01
- Last amended
- 2026-07-01
- Enforced by
- Consumer Protection Division, Office of the Attorney General (14-4713; Com. Law Title 13)
- People can sue
- No
- Penalties
- A violation is an unfair, abusive, or deceptive trade practice under the Maryland Consumer Protection Act, enforced under Title 13 except the private action in § 13-408 (14-4713). Civil penalties up to $10,000 per violation and up to $25,000 per repeat violation (Com. Law 13-410). For violations on or before 2027-04-01 the Division may, at its discretion, issue a notice of violation with at least 60 days to cure (14-4714).
- Applies to
- Persons that conduct business in Maryland or target products or services to Maryland residents and, in the preceding calendar year, controlled or processed personal data of at least 35,000 consumers (excluding data processed only to complete a payment transaction), or of at least 10,000 consumers while deriving more than 20% of gross revenue from selling personal data (14-4702)
- Exempt entities: state and local government bodies, registered securities and futures associations, GLBA financial institutions and affiliates and GLBA-covered data, and certain nonprofits assisting insurance-fraud investigations or first responders (14-4703(a))
- Exempt data includes HIPAA PHI, FCRA-regulated activity, FERPA data, employment-context data, and data collected by insurance-regulated persons in the business of insurance (14-4703(b))
- Applies only to personal data processing activities on or after 2026-04-01 (2024 Md. Laws ch. 454, § 2)
What a privacy notice must say
- Provide a clear privacy notice listing categories of personal data (including sensitive data), purposes, how to exercise rights and appeal, categories of third parties and data shared, and an active contact email or online mechanism; clearly disclose any sale, targeted advertising, or significant profiling and how to opt out.Com. Law 14-4707(d)-(e)
Rights it gives people
- Honor opt-outs sent by authorized agents, including via browser settings, extensions, or global device settings (opt-out preference signals).Com. Law 14-4706; 14-4707(f)(3)-(5)
- Consumers may confirm processing, access, correct, delete, and port their personal data, get the categories of third parties that received it, and opt out of targeted advertising, sale, and solely automated profiling with legal or similarly significant effects.Com. Law 14-4705(b)
Practices it requires
- Collect, process, or share sensitive data only where strictly necessary to provide or maintain a requested product or service, and never sell sensitive data.Com. Law 14-4707(a)(1)-(2)
- Do not sell personal data of, or target advertising to, a consumer the controller knew or should have known is under 18.Com. Law 14-4707(a)(4)-(5)
- Do not knowingly sell personal data to a federal, state, or local governmental unit that in the prior 6 months engaged in or supported civil immigration enforcement; subpoena and law-enforcement cooperation exceptions do not cover such units absent a particularized court warrant.Com. Law 14-4707(a)(6), 14-4712(a)(2) (as amended by 2026 Md. Laws ch. 874) · From 2026-07-01
- Do not give employees, contractors, or processors access to consumer health data without confidentiality duties, and do not geofence within 1,750 feet of mental health or reproductive or sexual health facilities to identify, track, collect data from, or message consumers about their health data.Com. Law 14-4704
- Sensitive data now includes data a controller infers from personal data to indicate a sensitive attribute, and personal data processed to identify a sensitive attribute; precise geolocation now covers locating a mobile device or vehicle within 1,750 feet.Com. Law 14-4701(x), (gg)-(hh) (as amended by 2026 Md. Laws ch. 874) · From 2026-07-01
- Respond to rights requests within 45 days (one 45-day extension allowed), free once per 12 months, and provide a conspicuous appeal process answered within 60 days.Com. Law 14-4705(e)-(f)
- Limit collection of personal data to what is reasonably necessary and proportionate to provide or maintain a product or service the consumer requested.Com. Law 14-4707(b)(1)(i)
Security duties
- Maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the data.Com. Law 14-4707(b)(1)(ii)
Other duties
- Use binding processor contracts covering instructions, confidentiality, deletion or return of data, and assessments.Com. Law 14-4708
- Conduct and document data protection assessments for targeted advertising, sale, sensitive-data processing, and risky profiling, including an assessment for each algorithm used; make them available to the Division on request.Com. Law 14-4710
Sources
- Official text
- Md. Code, Com. Law § 14-4701 (Maryland General Assembly)
- Md. Code, Com. Law § 14-4702 (applicability)
- Md. Code, Com. Law § 14-4703 (exemptions)
- Md. Code, Com. Law § 14-4704 (consumer health data, geofencing)
- Md. Code, Com. Law § 14-4705 (consumer rights)
- Md. Code, Com. Law § 14-4707 (controller duties)
- Md. Code, Com. Law § 14-4710 (data protection assessments)
- Md. Code, Com. Law § 14-4713 (enforcement)
- Md. Code, Com. Law § 14-4714 (cure period)
- Md. Code, Com. Law § 13-410 (civil penalties)
- 2024 Md. Laws ch. 454 (HB 567), effective and applicability dates
- 2026 Md. Laws ch. 874 (HB 711, Data Privacy Act), effective 2026-07-01
- HB 711 (2026) Fiscal and Policy Note, Department of Legislative Services
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: The online Code on mgaleg.maryland.gov (fetched 2026-09-25) still showed the pre-HB 711 text of 14-4701 and 14-4707; the 2026 amendments were read from the chapter law PDF, whose strike-through markup does not survive text extraction. The immigration-sale and inferred-data summaries were cross-checked against the DLS Fiscal and Policy Note, but exact enacted wording and new paragraph numbers (e.g., 14-4707(a)(6)) should be confirmed against the next Code update. | 2026 Md. Laws ch. 435 (HB 264, state-government data privacy, effective 2026-10-01) and ch. 154 (HB 895) reenact parts of 14-4701 without amendment only for cross-reference; they do not change MODPA.
Research reference, not legal advice.