Maryland Online Data Privacy Act (MODPA)

The Maryland Online Data Privacy Act (MODPA) provides consumers with rights over their personal data, including the ability to access, correct, and delete information. It also imposes data security requirements on businesses handling personal data.

JurisdictionMaryland
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The Maryland Online Data Privacy Act (MODPA) imposes several key requirements on businesses:

  • Data Minimization: Controllers must limit collection of personal data to what is "reasonably necessary and proportionate" to provide requested products/services. This is stricter than other state laws. Source: Maryland General Assembly
  • Sensitive Data Restrictions: Controllers are prohibited from collecting or processing sensitive data without consent, except when strictly necessary. Selling sensitive data is banned entirely. Source: Maryland Attorney General
  • Consumer Rights: Consumers have rights to access, correct, delete, and obtain their personal data, as well as opt out of targeted advertising, sales, and profiling. Source: Maryland Consumer Rights Brochure

Compliance Challenges

Organizations face several challenges in complying with MODPA:

  • Strict Data Minimization: The requirement to limit data collection to only what's necessary is more stringent than other state laws, requiring careful review of data practices. Source: IAPP Analysis
  • Consent Management: Obtaining and managing consent for sensitive data processing while ensuring it's not sold can be complex. Source: OneTrust BlogPost
  • Technical Implementation: Implementing systems to fulfill consumer rights requests and manage opt-outs can be technically challenging. Source: NIST Privacy Framework

Implementation Best Practices

To implement MODPA requirements effectively:

Recent Updates

As of August 2024, there have been no significant updates to MODPA since its passage. Key dates include:

Related Regulations

MODPA interacts with several other privacy regulations:

  • Virginia Consumer Data Protection Act (VCDPA): Shares many similarities in structure, but MODPA has unique provisions on sensitive data. Source: Virginia CDPA Full Text
  • General Data Protection Regulation (GDPR): While a EU regulation, many MODPA concepts align with GDPR principles. Source: GDPR Full Text

Industry Impact

MODPA will significantly impact various industries:

  • Healthcare: Additional protections for consumer health data will require careful compliance measures. Source: HIPAA Journal

Sources

Recent developments

  • — MODPA enforcement began on this date, making Maryland’s comprehensive consumer privacy law active for covered businesses. The law imposes rights to access, correction, deletion, portability, and opt-out, along with strict limits on sensitive data processing.[1] (source)
  • — Bloomberg Law reported that MODPA’s enforcement date is April 1, 2026, and highlighted that the law’s minimization and sensitive-data rules go beyond many other state privacy statutes. The piece emphasized the practical compliance burden on businesses operating in Maryland.[7] (source)
  • — OneTrust summarized MODPA’s application date as April 1, 2026, after an October 1, 2025 effective date. The update noted that organizations processing personal data of at least 35,000 consumers must comply and that sensitive data sales are prohibited outright.[2] (source)
  • — Baker Donelson’s compliance guidance underscores the operational changes businesses need for MODPA, including opt-out preference signals, appeal rights, and data protection assessments. This is directly relevant to industry impact as the law moved into enforcement.[5] (source)
  • — Baker Donelson highlighted MODPA’s broad treatment of sensitive data, including consumer health data, geolocation, and children’s data. The analysis points to significant impacts for health care, life sciences, and AI companies because processing such data is tightly restricted.[6] (source)
  • — Osano’s update explained that MODPA’s processing rules became applicable in April 2026, after the earlier effective date. The article emphasized stricter requirements around data minimization, consent, universal opt-out mechanisms, and children’s data.[3] (source)
  • — Potomac Law’s summary indicates that covered businesses must answer consumer requests within roughly 45–60 days and cannot retaliate against consumers for exercising privacy rights. This has practical implications for customer support, data governance, and legal response workflows.[1] (source)
  • — Bloomberg Law reported that MODPA creates a low applicability threshold and imposes stringent disclosure and data-minimization standards. The article suggests affected companies may need to tighten disclosures and reassess ad-tech and profiling practices.[7] (source)
  • — Baker Donelson noted that violations can be treated as unfair, abusive, or deceptive trade practices under Maryland law, with civil penalties reaching $10,000 for first violations and $25,000 for repeat violations. That enforcement exposure is a key business risk factor.[5] (source)
  • — OneTrust described MODPA as creating extensive consumer rights and special limits on automated decision-making and sensitive data use. Industry compliance teams are using such guidance to align internal policies with the law’s enforcement timeline.[2] (source)
  • — Maryland’s Online Data Privacy Act (MODPA) took effect on October 1, 2025, but the law does not apply to processing activities until April 1, 2026. The update highlights that MODPA broadens privacy compliance obligations for businesses handling Maryland residents’ data. (source)
  • — OneTrust summarizes MODPA’s core requirements, including opt-outs for sale, targeted advertising, and profiling, plus special restrictions on sensitive data and automated decision-making. It notes the law became effective October 1, 2025, with application starting April 1, 2026. (source)

Read the full guide to Maryland Online Data Privacy Act (MODPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates