Maryland, USA

Regulator And AuthorityAmber

The Maryland AG holds exclusive enforcement authority over MODPA; there is no separate privacy supervisory authority.

Claims (1):

• The Maryland Attorney General has exclusive authority to enforce MODPA, with no dedicated state data protection authority.

Act And InstrumentsGreen

Core instruments are MODPA, the Maryland Kids Code, and the pre-existing PIPA breach-notification statute.

Claims (3):

• MODPA was signed May 9, 2024, came into effect October 1, 2025, but does not apply to processing occurring before April 1, 2026.
• The Maryland Kids Code (Age-Appropriate Design Code / Online Child Protection Act), effective October 1, 2024, remains fully in effect despite ongoing constitutional litigation of the kind seen against peer-state AADC laws.
• Maryland's Personal Information Protection Act (PIPA), Md. Code Ann., Comm. Law §14-3504, is a pre-existing breach-notification statute enforced by the AG, operating independently of MODPA.

Material ScopeAmber

MODPA applies on population/revenue thresholds and carves out government entities and several federally-regulated data types.

Claims (2):

• MODPA applies to controllers/processors that controlled or processed personal data of at least 35,000 consumers (excluding payment-transaction-only processing) or at least 10,000 consumers while deriving over 20% of gross revenue from selling personal data.
• MODPA excludes Maryland state and local government entities, courts, and businesses/data already subject to the Gramm-Leach-Bliley Act, HIPAA, or FERPA.

Territorial ScopeGreen

MODPA uses an effects-based test keyed to targeting of Maryland residents rather than establishment.

Claims (1):

• MODPA applies to individuals/businesses providing products or services targeted to Maryland residents, an effects-based territorial test rather than one requiring in-state establishment.

Regulator Registration And FilingAmber

No general registration/filing regime exists; the AG may compel confidential DPIAs from controllers on request.

Claims (1):

• MODPA does not create a general controller registration/filing regime; instead, the AG may request confidential DPIAs from controllers, shielded from disclosure under the Maryland Public Information Act.

Lawful BasesAmber

MODPA substitutes a data-minimization necessity/proportionality test for an enumerated lawful-bases list.

Claims (1):

• MODPA requires controllers to limit collection of personal data to what is reasonably necessary and proportionate to provide or maintain the product or service requested by the consumer, functioning as the primary processing-legitimacy standard in place of an enumerated lawful-bases regime.

Consent ThresholdsAmber

Consent must be an 'unambiguous affirmative action'; the minimization-first design leaves few processing activities where consent alone suffices.

Claims (1):

• Under MODPA, 'consent' requires an unambiguous affirmative action by the consumer, and the law's minimization-first design leaves consent as a comparatively residual legal basis.

Special CategoriesGreen

Sensitive data is broadly defined and subject to a strict-necessity standard, an absolute sale ban, and health-facility geofencing restrictions.

Claims (3):

• MODPA's 'sensitive data' definition includes racial/ethnic origin, religious beliefs, consumer health data, sexual orientation, transgender or non-binary status, citizenship/immigration status, genetic and biometric data, precise geolocation, and personal data known to belong to a child.
• Rather than a consent-based model, MODPA bans collection, processing, or sharing of sensitive data unless 'strictly necessary' to provide the requested product/service, and separately prohibits the sale of sensitive data outright under section 14-4607, with no consent exception.
• MODPA bans geofencing within 1,750 feet of a mental-health facility or reproductive/sexual-health facility for purposes of identifying, tracking, or targeting consumers in relation to consumer health data.

Pseudonymisation And AnonymisationRed

No MODPA-specific pseudonymisation or anonymisation safe-harbour provision was located in the sources retrieved for this run.

Access RightGreen

Consumers may request access to personal data held by a controller.

Claims (1):

• MODPA authorizes consumers to exercise rights regarding their personal data and requires controllers to establish a method for consumers to exercise those rights, encompassing access, correction, deletion, and portability.

Rectification And ErasureGreen

Consumers may request correction and deletion of personal data.

Claims (1):

• MODPA authorizes consumers to exercise rights regarding their personal data and requires controllers to establish a method for consumers to exercise those rights, encompassing access, correction, deletion, and portability.

Restriction And ObjectionAmber

Consumers may opt out of targeted advertising and sale; MODPA uniquely makes universal opt-out mechanism recognition optional rather than mandatory.

Claims (1):

• MODPA describes universal opt-out mechanisms as an alternative to, rather than a mandatory replacement for, a conspicuous 'do not sell' link — the first instance of a state making universal opt-out signal recognition optional.

Data PortabilityGreen

Consumers may obtain a portable copy of their personal data.

Claims (1):

• MODPA authorizes consumers to exercise rights regarding their personal data and requires controllers to establish a method for consumers to exercise those rights, encompassing access, correction, deletion, and portability.

Deadlines And Response WindowsRed

Controllers must maintain an appeal process for denied requests; the exact response-window in days was not confirmed in this run's sources.

Claims (2):

• MODPA requires controllers to establish an appeal process for consumers regarding controller decisions on rights requests.
• The specific statutory number of days within which a Maryland controller must respond to a consumer rights request under MODPA was not confirmed against primary statutory text in this run; comparable Virginia-modeled state laws commonly use a 45-day window with a possible 45-day extension, but this has not been verified as MODPA's exact figure.

Accountability And DpiaGreen

DPIAs are required for heightened-risk processing from October 1, 2025, and are confidential when requested by the AG.

Claims (2):

• MODPA requires controllers to conduct data protection impact assessments for processing activities presenting a heightened risk of harm to consumers, applicable to processing occurring on or after October 1, 2025.
• DPIAs requested by the Maryland AG under MODPA are confidential and exempt from disclosure under the Maryland Public Information Act.

Dpo RequirementsRed

No MODPA provision mandating a formal Data Protection Officer appointment was located; this is consistent with most US state comprehensive privacy laws.

Claims (1):

• No MODPA provision was located requiring controllers to appoint a formal Data Protection Officer; this omission is typical of the US state comprehensive-privacy-law model.

Ropa RequirementsRed

No explicit records-of-processing-activities requirement distinct from the DPIA obligation was located in this run's sources.

Joint Controller ArrangementsGreen

MODPA requires a written, binding controller-processor contract with specified terms.

Claims (1):

• MODPA requires controllers and processors to enter into a written, binding contract containing specified data-processing terms whenever a controller engages a processor.

Security MeasuresAmber

MODPA imposes a confidentiality obligation as part of core controller duties.

Claims (1):

• MODPA imposes confidentiality obligations on covered businesses as part of its core set of controller duties.

Breach NotificationGreen

PIPA (Md. Code Ann., Comm. Law §14-3504) requires notice to affected residents and the AG following a security breach.

Claims (1):

• Maryland's Personal Information Protection Act requires businesses to notify affected Maryland residents and the Attorney General's Identity Theft Unit following a breach of personal information, operating independently of MODPA.

Retention And DisposalRed

No explicit stand-alone retention-limit or disposal-duty provision beyond purpose-based minimization was located in this run's sources.

Transfer MechanismsRed

No MODPA-specific transfer mechanism provision was located.

Claims (1):

• MODPA does not establish a cross-border data-transfer mechanism, adequacy determination process, SCC/BCR framework, transfer-impact-assessment requirement, or data-localisation mandate; such matters remain governed, where applicable, by federal sectoral law.

Adequacy ReceivedRed

Not applicable; US states do not receive adequacy decisions.

Adequacy GrantedRed

Not applicable; Maryland does not grant adequacy decisions.

Sccs And BcrsRed

No state-level SCC/BCR framework exists under MODPA.

Transfer Impact AssessmentRed

No transfer-impact-assessment requirement was located under MODPA.

Data LocalisationRed

No data-localisation mandate was located under MODPA.

Financial Sector OverlayGreen

GLBA-regulated financial institutions and GLBA-covered data are excluded from MODPA.

Claims (1):

• MODPA excludes financial institutions and data subject to Title V of the Gramm-Leach-Bliley Act from its scope.

Health Sector OverlayGreen

HIPAA-covered data is excluded from MODPA scope, while MODPA separately regulates non-HIPAA consumer health data with geofencing bans.

Claims (1):

• MODPA excludes HIPAA-covered data from its scope while separately regulating non-HIPAA 'consumer health data' with heightened protections including facility geofencing bans.

Telecoms And EprivacyRed

No Maryland-specific telecoms/eprivacy overlay distinct from MODPA was located.

Employment DataRed

No Maryland-specific employment-data privacy overlay was located.

Credit And ScoringGreen

FCRA-covered consumer-reporting-agency activity is excluded from MODPA's sensitive-data sale restrictions.

Claims (1):

• MODPA excludes consumer-reporting-agency activity covered by the Fair Credit Reporting Act from its sensitive-data sale restrictions.

EducationGreen

FERPA-covered education records are excluded from MODPA.

Claims (1):

• MODPA excludes data covered by the Family Educational Rights and Privacy Act from its scope.

InsuranceRed

No Maryland-specific insurance-sector privacy overlay was located.

Cookies And TrackersRed

No MODPA-specific cookie/tracker consent provision distinct from general consent standards was located.

Dark PatternsAmber

MODPA's consent definition requiring 'unambiguous affirmative action' implicitly disfavours dark-pattern-obtained consent, consistent with peer state laws.

Claims (1):

• MODPA defines consent as requiring an 'unambiguous affirmative action,' a standard that implicitly excludes consent obtained via manipulative interface design (dark patterns).

Opt Out SignalsAmber

MODPA treats universal opt-out mechanism recognition as optional rather than mandatory, a notable departure from most peer states.

Claims (1):

• MODPA recognizes universal opt-out mechanisms as an optional alternative to a conspicuous 'do not sell' link rather than mandating recognition of such signals.

Clean Rooms And DcrRed

No clean-room or data-collaboration-room-specific provision was located under MODPA.

Cross Context AdvertisingGreen

MODPA bans targeted advertising to consumers a controller knew or should have known are under 18.

Claims (1):

• MODPA bans processing personal data for targeted advertising where the controller knew or should have known the consumer is under 18, applying an expanded constructive-knowledge standard.

Direct MarketingRed

No MODPA provision specific to direct-marketing consent/suppression distinct from the general sale/targeted-advertising opt-out was located.

Profiling RestrictionsRed

No MODPA provision establishing a general profiling-restriction regime akin to GDPR Art. 22 was located.

Automated Decision Making TransparencyRed

No ADM-transparency/explanation-right provision was located under MODPA.

Ai Risk AssessmentsRed

Maryland is considering, but has not enacted, dedicated AI risk-assessment legislation separate from MODPA.

Claims (1):

• Maryland lawmakers are considering AI-specific bills distinct from MODPA, including Senate Bill 827 on chatbot/generative-AI liability and House Bill 956 establishing an AI-implementation workgroup, indicating an emerging but not-yet-comprehensive state AI-governance overlay.

Biometric RegimeGreen

Biometric data is included in MODPA's sensitive-data category, subject to strict-necessity and sale-ban rules.

Claims (1):

• MODPA includes biometric and genetic data within its 'sensitive data' definition, subjecting their collection, processing, and sharing to the 'strictly necessary' standard and an outright sale ban.

Genetic DataGreen

Genetic data is likewise included in MODPA's sensitive-data category under the same strict-necessity and sale-ban rules.

Claims (1):

• MODPA includes biometric and genetic data within its 'sensitive data' definition, subjecting their collection, processing, and sharing to the 'strictly necessary' standard and an outright sale ban.

State Surveillance CarveoutsRed

No MODPA-specific national-security or state-surveillance carve-out provision was located in this run's sources.

Age VerificationAmber

MODPA uses a 'knew or should have known' constructive-knowledge standard rather than mandating affirmative age verification, though commentators note this could functionally require age-assurance practices.

Claims (1):

• MODPA bans processing personal data for targeted advertising and prohibits the sale of personal data belonging to consumers the controller knew or should have known are under 18.

Parental ConsentRed

No MODPA-specific parental-consent mechanism was located; federal COPPA continues to apply concurrently for children under 13.

Claims (1):

• MODPA itself does not impose a distinct parental-consent mechanism; federal COPPA continues to apply concurrently for children under 13, and this interaction remains outside MODPA's own text as reviewed.

Minor Profiling BansGreen

MODPA bans targeted advertising and sale of data belonging to consumers known or reasonably known to be minors under 18.

Claims (1):

• MODPA bans processing personal data for targeted advertising and prohibits the sale of personal data belonging to consumers the controller knew or should have known are under 18.

Education SettingsRed

No Maryland-specific education-settings privacy rule beyond the general FERPA carve-out was located.

Dependent AdultsRed

No Maryland-specific dependent-adult data-protection provision was located in this run's sources.

Regulator Powers And PenaltiesAmber

AG enforcement runs through Consumer Protection Act unfair/deceptive-trade-practice provisions, with a discretionary 60-day cure right sunsetting in 2027.

Claims (2):

• MODPA violations are treated as unfair, abusive, or deceptive trade practices subject to the enforcement and penalty provisions of Title 13 of the Maryland Commercial Law Article (Consumer Protection Act).
• The AG may issue a notice of violation triggering a 60-day cure period before bringing an enforcement action, retains discretion over whether to grant the cure opportunity considering factors including violation volume and entity size, and this cure right sunsets in 2027.

Enforcement Activity IndexAmber

Pre-MODPA multistate breach enforcement (e.g., the Inmediata settlement) illustrates the AG's active data-security enforcement track record under PIPA/CPA/HIPAA.

Claims (1):

• In 2023, the Maryland AG joined a 33-state settlement with health-data clearinghouse Inmediata over a data exposure affecting 1.5 million consumers (16,423 in Maryland), resolving alleged violations of the Maryland Consumer Protection Act, PIPA, and HIPAA.

Regulator Funding And CapacityRed

No specific budget or headcount data for the AG's privacy-enforcement capacity was located in this run's sources.

Collective Redress And Class ActionsRed

No MODPA-specific collective-redress mechanism was located; its interaction with general Maryland Consumer Protection Act private-action provisions remains unresolved in the sources reviewed.

Claims (1):

• No MODPA-specific collective-redress or class-action mechanism was located; whether general Maryland Consumer Protection Act private-action provisions apply to MODPA-predicated claims was not resolved in the sources reviewed.

Private Right Of ActionGreen

MODPA does not create a private right of action; enforcement runs exclusively through the AG.

Claims (1):

• MODPA does not create a private cause of action for violations; the Maryland Office of the Attorney General is responsible for enforcement.

Recent Developments 180DAmber

A 2026 amendment strengthened MODPA's sensitive-data and immigration-related protections effective July 1, 2026; further AI-liability and surveillance-pricing bills remain in progress.

Claims (2):

• In 2026, Maryland enacted amendments strengthening MODPA's sensitive-data and immigration-enforcement-related protections, effective July 1, 2026.
• Additional 2026 Maryland legislative proposals extend the state's data/AI agenda beyond MODPA, including Senate Bill 827 (chatbot/generative-AI liability), House Bill 895 (ban on surveillance-based dynamic pricing in grocery stores), and House Bill 956 (AI-implementation workgroup); their enactment status was not confirmed in this run.