Comprehensive state privacy law
Maryland privacy law
Maryland Online Data Privacy Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Md. Code Ann., Com. Law §§ 14-4701 to 14-4714 (enacted as §§ 14-4601 to 14-4614)
- Official text
- https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false
- Enacted
- May 9, 2024. 2024 Md. Laws ch. 455 (SB 541), approved by the Governor 9 May 2024; companion act 2024 Md. Laws ch. 454 (HB 567)
- In force
- October 1, 2025
- Effective dates
- October 1, 2025: whole Act (ch. 455, section 4)
- April 1, 2026: uncodified section 2 of ch. 455: the Act's exceptions section (enacted as § 14-4612, now § 14-4712) applies only prospectively and has no effect on personal data processing activities before 1 April 2026; generally read as the date from which processing is covered
- July 1, 2026: 2026 Md. Laws ch. 874 (HB 711): inferred sensitive data, ban on sales to governmental units engaged in civil immigration enforcement, and related changes
- Enforcer
- Attorney General, Consumer Protection Division (violations are unfair, abusive or deceptive trade practices under Title 13)
- Private right of action
- No. The Consumer Protection Act private action (§ 13-408) does not apply to violations of the subtitle (§ 14-4713(a)(2)), but a consumer may still pursue any other remedy provided by law (§ 14-4713(b)).
- Cure period
- 60 days. Ends April 1, 2027. For alleged violations occurring on or before 1 April 2027, the Division may (at its discretion) issue a notice of violation if it decides a cure is possible; the controller or processor then has at least 60 days to cure. The Division weighs listed factors such as size, number of violations and likelihood of harm. (§ 14-4714)
- Rulemaking
- No. No rulemaking power was found in the sections read. Chapter 874 allows the Division to post consumer education materials on civil immigration enforcement (§ 14-4712(a)(2)(iv)).
Amendments
- 2026 Md. Laws ch. 874 (HB 711, Data Privacy Act), enacted without the Governor's signature under Md. Const. art. II, § 17(c) on 31 May 2026 (in force July 1, 2026). Adds that 'sensitive data' includes data a controller infers that indicates a sensitive category (§ 14-4701(gg)(2)); bars knowingly selling a consumer's personal data to a federal, state or local governmental unit that in the prior six months engaged in or supported civil immigration enforcement through personnel or material resources (§ 14-4707(a)(6)); extends precise geolocation to a mobile device or vehicle (§ 14-4701(x)); narrows the public-records and Driver's Privacy Protection Act carve-outs (§ 14-4701(cc), § 14-4703(b)(8)); and limits the compliance-with-subpoena and law-enforcement-cooperation exceptions where the requesting body supported civil immigration enforcement, unless a valid court warrant is presented (§ 14-4712(a)(2)).
Topics
- ApplicabilityThe Act applies to persons that do business in Maryland or target its residents and that, in the preceding calendar year, controlled or processed personal data of at least 35,000 consumers (not counting payment-only data), or of at least 10,000 consumers while earning more than 20% of gross revenue from selling personal data. GLBA financial institutions and their affiliates, government bodies and registered securities and futures associations are excluded, but nonprofits are covered unless they only help investigate insurance fraud or assist first responders. HIPAA protected health information, FCRA, FERPA, employment-context data and data collected in the business of insurance are among the data exemptions.
- Consumer rightsConsumers may confirm and access their data, correct it, delete it, obtain a portable copy, get a list of the categories of third parties that received their data, and opt out of targeted advertising, sale and profiling for solely automated significant decisions. Controllers must answer within 45 days, extendable once by 45 days, and responses are free once a year. Appeals must be decided in writing within 60 days, with a route to complain to the Consumer Protection Division if denied.
- Sensitive dataMaryland does not use a consent model for sensitive data. A controller may collect, process or share sensitive data only where strictly necessary to provide or maintain a specific product or service the consumer requested, and may never sell sensitive data. Since 1 July 2026, sensitive data also includes data the controller infers that indicates a sensitive category. Controllers may not use data of anyone they know or should have known is under 18 for targeted advertising, nor sell it.
- Controller dutiesControllers must limit collection to what is reasonably necessary and proportionate to provide or maintain a specific product or service the consumer requested, a stricter test than in most states. The privacy notice must include sensitive data categories, purposes, rights and consent revocation, and third-party categories described in enough detail to show their business model. Data protection assessments are required for heightened-risk processing, including one for each algorithm used, for processing from 1 October 2025. Since 1 July 2026, controllers may not knowingly sell personal data to governmental units that supported civil immigration enforcement in the prior six months.
- ProcessorsA controller that uses a processor must sign a binding contract setting out instructions, nature and purpose, data types, duration and both parties' rights and obligations. The contract must require confidentiality, reasonable security, stopping processing on an authenticated consumer request, deletion or return, compliance information, subcontracting only after a chance to object, and assessments. A person that goes beyond the controller's instructions is treated as a controller.
- EnforcementA violation is an unfair, abusive or deceptive trade practice under the Consumer Protection Act, enforced by the Attorney General's Consumer Protection Division. For violations up to 1 April 2027, the Division may offer a cure period of at least 60 days at its discretion. Civil penalties are up to $10,000 per violation and up to $25,000 for each repeated violation. The Consumer Protection Act private action does not apply, though other legal remedies are preserved.
Sources
- Md. Code, Com. Law §§ 14-4701 to 14-4714 (statute text pages, 2025 Replacement Volume; not yet showing ch. 874 changes)
- 2024 Md. Laws ch. 455 (SB 541), enrolled chapter text
- SB 541 (2024) legislation page (Chapter 455)
- 2026 Md. Laws ch. 874 (HB 711), chapter text
- HB 711 (2026) legislation page (status: enacted under Article II, § 17(c), Chapter 874)
- Md. Code, Com. Law § 13-410 (civil penalties)
- HB 1365 (2025) legislation page (hearing only, not enacted)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Maryland statute
Reference material, not legal advice.