Maryland Online Data Privacy Act (MODPA)

The Maryland Online Data Privacy Act (MODPA) was signed into law on May 9, 2024, and took effect on October 1, 2025. Enforcement by the Attorney General began April 1, 2026. Maryland's law is one of the strictest US state privacy laws, adopting a data minimization approach and an opt-in default for sensitive data.

What Is the MODPA?

The MODPA grants Maryland residents rights over their personal data and imposes obligations on businesses that collect or process that data. Unlike most other state privacy laws that follow an opt-out model, the MODPA prohibits controllers from processing personal data beyond what is strictly necessary for the stated purpose, making it more closely aligned with GDPR principles.

Who Does the MODPA Apply To?

The MODPA applies to businesses that conduct business in Maryland or produce products or services targeted to Maryland residents, and during the prior calendar year either:

• Controlled or processed the personal data of at least 35,000 consumers; or
• Controlled or processed the personal data of at least 10,000 consumers and derived more than 20% of gross revenue from the sale of personal data.

Consumer Rights Under the MODPA

Maryland residents are entitled to:

• Right to access: confirm whether a business processes their personal data and request a copy
• Right to correction: request correction of inaccurate personal data
• Right to deletion: request deletion of their personal data
• Right to data portability: obtain a portable copy of their personal data
• Right to opt out: opt out of targeted advertising, sale of personal data, and profiling for significant decisions
• Right to appeal: appeal a business's denial of a rights request

Businesses must respond to verified consumer requests within 45 days, extendable by an additional 45 days when reasonably necessary.

Data Minimization

A key distinguishing feature of the MODPA is its data minimization requirement. Controllers may only collect and process personal data that is reasonably necessary and proportionate to the disclosed purpose. Processing personal data for purposes that are not compatible with the original purpose requires obtaining consumer consent.

Sensitive Data

Processing sensitive data requires opt-in consent from consumers. The MODPA defines sensitive data to include racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sexual orientation, status as transgender or nonbinary, citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, precise geolocation data, and personal data of known children under 18. The MODPA's sensitive data protections for minors under 18 are broader than most other state laws.

Controllers are prohibited from processing the personal data of consumers under 18 for targeted advertising or selling such data.

Enforcement

The Maryland Attorney General enforces the MODPA. There is no private right of action. A 60-day cure period is quasi-mandatory through March 31, 2027; after that date, granting a cure opportunity is at the Attorney General's discretion. Civil penalties of up to $10,000 per violation may be imposed, and up to $25,000 per violation for subsequent violations.

How UniConsent Supports MODPA Compliance

UniConsent provides the tools businesses need to meet MODPA requirements:

• Opt-out and opt-in consent banners configurable by state
• Data minimization and purpose limitation support
• Consumer rights request management
• Sensitive data and children's data consent workflows
• Integration with websites, mobile apps, and tag managers

Get started with UniConsent or explore our features.

Other US State Privacy Laws

• CCPA: California Consumer Privacy Act, learn more at CCPA
• CPRA: California Privacy Rights Act, learn more at CPRA
• CPA: Colorado Privacy Act, learn more at CPA
• VCDPA: Virginia Consumer Data Protection Act, learn more at VCDPA
• UCPA: Utah Consumer Privacy Act, learn more at UCPA
• CTDPA: Connecticut Data Protection Act, learn more at CTDPA
• TDPSA: Texas Data Privacy and Security Act, learn more at TDPSA
• DPDPA: Delaware Personal Data Privacy Act, learn more at DPDPA
• NHPA: New Hampshire Privacy Act, learn more at NHPA
• MTCDPA: Montana Consumer Data Privacy Act, learn more at MTCDPA
• FDBR: Florida Digital Bill of Rights, learn more at FDBR
• NJDPA: New Jersey Data Protection Act, learn more at NJDPA
• INCDPA: Indiana Consumer Data Protection Act, learn more at INCDPA
• ICDPA: Iowa Consumer Data Protection Act, learn more at ICDPA

Compare different US State Privacy Laws