HomeLegal DirectoryMaryland Online Data Privacy Act

In effect Limited protection

Maryland Online Data Privacy Act (MODPA)

Maryland · 2024 Md. Laws ch. 440 (SB 541); Md. Code Ann., Com. Law §§ 14-4601–14-4626

Maryland's privacy law is stricter than most: it prohibits processing sensitive personal data unless strictly necessary for the requested service. Consumers can access, correct, delete, and port their data, and opt out of automated profiling and targeted advertising. AG enforcement began April 2026.

Technical detail

MODPA (SB 541), Md. Code Ann., Com. Law §§ 14-4601 et seq., eff. Oct. 1, 2025 (AG enforcement Apr. 1, 2026); strict-necessity standard for sensitive data; data protection assessments for algorithmic decision-making; profiling opt-out.

Who is protected: Maryland residents

Who must comply: Controllers processing data of 35,000+ MD residents/year, or 10,000+ with 20%+ revenue from data sales

Key facts

JurisdictionMaryland
LevelState
StatusIn effect
Protection strengthLimited protection
Effective date2025-10-01
Enacted2024-05-09
Citation2024 Md. Laws ch. 440 (SB 541); Md. Code Ann., Com. Law §§ 14-4601–14-4626
Enforced byMaryland Attorney General
Private right of actionNo — agency enforcement only
PenaltiesUp to $10,000 per violation; $25,000 per subsequent; 60-day cure period
Topicsconsumer data privacy · data retention · automated decision-making · consumer protection
Last verified2026-06-12
Official sourceMaryland SB 541 — Maryland Online Data Privacy Act ↗

More AI rules in Maryland

Related consumer data privacy rules elsewhere

See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.