Maryland Online Data Privacy Act
Maryland privacy law (MODPA): controller duties
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Controllers must limit collection to what is reasonably necessary and proportionate to provide or maintain a specific product or service the consumer requested, a stricter test than in most states. The privacy notice must include sensitive data categories, purposes, rights and consent revocation, and third-party categories described in enough detail to show their business model. Data protection assessments are required for heightened-risk processing, including one for each algorithm used, for processing from 1 October 2025. Since 1 July 2026, controllers may not knowingly sell personal data to governmental units that supported civil immigration enforcement in the prior six months.
Key points
Collection limited to what is reasonably necessary and proportionate to provide or maintain a specific product or service the consumer requested.
Section: § 14-4707(b)(1)(i)
Consent must be revocable as easily as given; processing must stop within 30 days of revocation.
Section: § 14-4707(b)(1)(iii) and (2)
Privacy notice: data categories including sensitive data, purposes, rights including appeal and consent revocation, third-party categories with enough detail to understand each type or business model, data shared, and a contact email or online mechanism.
Section: § 14-4707(d)
Opt-out methods may include a clear website link and an opt-out preference signal, which the statute frames around 1 October 2025; opt-outs sent by an authorized agent through a browser or device setting must be honoured if authenticated.
Section: § 14-4707(f)(3); § 14-4706
Data protection assessments for targeted advertising, sale, sensitive data and risky profiling, including each algorithm used, for processing on or after 1 October 2025.
Section: § 14-4710(b) and (h)
Since 1 July 2026: no knowing sale of personal data to a governmental unit that engaged in or supported civil immigration enforcement in the prior six months.
Section: § 14-4707(a)(6)
Third parties that change how they use or share data must give notice before the new practice starts.
Section: § 14-4709
Sources
Compare controller duties across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 35: Data protection impact assessment (assessments)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Maryland statute
Reference material, not legal advice.