--- title: "Maryland privacy law (MODPA): controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/maryland/controller-duties" source: "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Maryland Online Data Privacy Act # Maryland privacy law (MODPA): controller duties Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Controllers must limit collection to what is reasonably necessary and proportionate to provide or maintain a specific product or service the consumer requested, a stricter test than in most states. The privacy notice must include sensitive data categories, purposes, rights and consent revocation, and third-party categories described in enough detail to show their business model. Data protection assessments are required for heightened-risk processing, including one for each algorithm used, for processing from 1 October 2025. Since 1 July 2026, controllers may not knowingly sell personal data to governmental units that supported civil immigration enforcement in the prior six months. ## Key points 1. Collection limited to what is reasonably necessary and proportionate to provide or maintain a specific product or service the consumer requested. Section: [§ 14-4707(b)(1)(i)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 2. Consent must be revocable as easily as given; processing must stop within 30 days of revocation. Section: [§ 14-4707(b)(1)(iii) and (2)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 3. Privacy notice: data categories including sensitive data, purposes, rights including appeal and consent revocation, third-party categories with enough detail to understand each type or business model, data shared, and a contact email or online mechanism. Section: [§ 14-4707(d)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 4. Opt-out methods may include a clear website link and an opt-out preference signal, which the statute frames around 1 October 2025; opt-outs sent by an authorized agent through a browser or device setting must be honoured if authenticated. Section: [§ 14-4707(f)(3); § 14-4706](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 5. Data protection assessments for targeted advertising, sale, sensitive data and risky profiling, including each algorithm used, for processing on or after 1 October 2025. Section: [§ 14-4710(b) and (h)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 6. Since 1 July 2026: no knowing sale of personal data to a governmental unit that engaged in or supported civil immigration enforcement in the prior six months. Section: [§ 14-4707(a)(6)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 7. Third parties that change how they use or share data must give notice before the new practice starts. Section: [§ 14-4709](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) ## Sources - [https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4707&enactments=false](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4707&enactments=false) - [https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4710&enactments=false](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4710&enactments=false) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Maryland statute](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) Reference material, not legal advice. ## Other topics for Maryland - [Applicability](https://dposchool.com/state-privacy-laws/state/maryland/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/maryland/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/maryland/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/maryland/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/maryland/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Maryland](https://dposchool.com/state-privacy-laws/state/maryland) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/maryland/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/maryland/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents