Privacy Map

Maryland. Comprehensive data protection. Act

MODPAMaryland Online Data Privacy Act of 2024 (Md. Code, Com. Law § 14-4601 et seq.)

In force
Partly verifiedMedium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.

§1Summary

Synopsis

The strictest state comprehensive law: collection must be reasonably necessary to provide the requested service, sale of sensitive data is banned, and targeted advertising to under-18s is barred.

Key themes
  • consumer rights (access, deletion, correction, portability)
  • opt-out of sale, targeted advertising and profiling
  • sensitive data consent
  • data protection assessments
  • processor contracts
  • strict data minimisation
  • sensitive data sale ban
  • minors under 18
Unique features

Sensitive data may be processed only where strictly necessary for the requested service, with consent alone insufficient; 'knew or should have known' minor standard.

SaaS relevance

Applies at 35,000 Maryland consumers, or 10,000 with 20%+ revenue from sales; SaaS processing sensitive data needs a strict-necessity analysis.

§2Obligations

Extraterritorial
Yes
Breach notification
See Md. Code, Com. Law § 14-3504 (separate statute)
DPO
No
Cross-border transfers
None
Maximum penalty
Up to $10,000 per violation; $25,000 for repeat violations

§3Dates

Key dates
  • Adopted
  • In force
  • Applies to processing activities from 2026-04-01; discretionary cure until 2027-04-01.

§4Text and authority

Text
Authority
Maryland Attorney General (Consumer Protection Division)

§5Where it applies

Domestic law of
Maryland

§6Sources and verification

Sources consulted
Verification

Medium confidence.

Partly verifiedMedium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.