--- title: "Maryland privacy law (MODPA): consumer rights" canonical: "https://dposchool.com/state-privacy-laws/state/maryland/consumer-rights" source: "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Maryland Online Data Privacy Act # Maryland privacy law (MODPA): consumer rights Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Consumers may confirm and access their data, correct it, delete it, obtain a portable copy, get a list of the categories of third parties that received their data, and opt out of targeted advertising, sale and profiling for solely automated significant decisions. Controllers must answer within 45 days, extendable once by 45 days, and responses are free once a year. Appeals must be decided in writing within 60 days, with a route to complain to the Consumer Protection Division if denied. ## Key points 1. Rights: confirm, access, correct, delete, portable copy, and a list of categories of third parties that received personal data. Section: [§ 14-4705(b)(1) to (6)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 2. Opt out of targeted advertising, sale, and profiling in furtherance of solely automated decisions with legal or similarly significant effects. Section: [§ 14-4705(b)(7)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 3. Response within 45 days; one 45-day extension if the consumer is told within the first period, with reasons. Section: [§ 14-4705(e)(2)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 4. Responses free once in any 12-month period; unfounded, excessive, technically infeasible or repetitive requests may be charged or refused. Section: [§ 14-4705(e)(4)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 5. Opt-out requests need not be authenticated. Section: [§ 14-4705(e)(6)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 6. Appeal decided in writing within 60 days; on denial, an online route to complain to the Division. Section: [§ 14-4705(f)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 7. An authorized agent may opt out for the consumer, including through a browser setting, extension or global device setting. Section: [§ 14-4706](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) ## Sources - [https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4705&enactments=false](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4705&enactments=false) - [https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4706&enactments=false](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4706&enactments=false) [Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access) - [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion) - [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Maryland statute](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) Reference material, not legal advice. ## Other topics for Maryland - [Applicability](https://dposchool.com/state-privacy-laws/state/maryland/applicability) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/maryland/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/maryland/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/maryland/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/maryland/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Maryland](https://dposchool.com/state-privacy-laws/state/maryland) / Consumer rights Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/maryland/applicability) Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/maryland/sensitive-data) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents