Maryland Online Data Privacy Act (MODPA)
Amended Maryland · In force Oct 1, 2025 · next deadline Apr 1, 2027 (in 6 months)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
The strictest US state comprehensive privacy law: imposes data minimization limited to what is strictly necessary, bans the sale of sensitive data outright, and bans targeted advertising to and sale of data of consumers under 18 (known or should have known). Took effect Oct 1, 2025 but does not apply to personal data processing activities before April 1, 2026.
- Who it applies to
- Persons doing business in Maryland or targeting Maryland residents that in the preceding calendar year controlled or processed personal data of 35,000+ consumers (excluding payment-only data), or 10,000+ consumers and derived more than 20% of gross revenue from the sale of personal data.
- Penalties
- Violations are unfair, abusive or deceptive trade practices under the Maryland Consumer Protection Act (civil penalties up to $10,000 per violation and $25,000 for repeat violations). Discretionary 60-day cure period for violations occurring on or before April 1, 2027. Consumers may pursue other remedies but no private right of action under the MCPA's section 13-408.
- Enforced by
- Maryland Attorney General, Consumer Protection Division
- Official name
- Maryland Online Data Privacy Act of 2024 (SB 541 / HB 567), Md. Code, Com. Law 14-4601 et seq.
- Citation
- 2024 Md. Laws ch. 455 (SB 541) and ch. 454 (HB 567); Md. Code, Com. Law 14-4601 to 14-4614
- Topics
- privacy, children, health, biometrics
Research notes
A 2026 amendment reportedly expanded the precise geolocation definition (1,750-foot radius) effective July 1, 2026 (Venable, July 2026); bill number not verified, so no deadline row added. Penalty amounts come from the Maryland Consumer Protection Act (Com. Law 13-410), not restated in MODPA.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)Questions about Maryland Online Data Privacy Act (MODPA)
- What are the Maryland Online Data Privacy Act (MODPA) compliance deadlines?
- Oct 1, 2025: MODPA takes effect. Apr 1, 2026: MODPA applies to personal data processing. Apr 1, 2027: Discretionary 60-day cure period ends.
- When does Maryland Online Data Privacy Act (MODPA) take effect?
- Maryland Online Data Privacy Act (MODPA) took effect on Oct 1, 2025. The next milestone is Apr 1, 2027: Discretionary 60-day cure period ends.
- Who does Maryland Online Data Privacy Act (MODPA) apply to?
- Persons doing business in Maryland or targeting Maryland residents that in the preceding calendar year controlled or processed personal data of 35,000+ consumers (excluding payment-only data), or 10,000+ consumers and derived more than 20% of gross revenue from the sale of personal data.
- What are the penalties under Maryland Online Data Privacy Act (MODPA)?
- Violations are unfair, abusive or deceptive trade practices under the Maryland Consumer Protection Act (civil penalties up to $10,000 per violation and $25,000 for repeat violations). Discretionary 60-day cure period for violations occurring on or before April 1, 2027. Consumers may pursue other remedies but no private right of action under the MCPA's section 13-408.