Maryland Online Data Privacy Act
Maryland privacy law (MODPA): enforcement
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
A violation is an unfair, abusive or deceptive trade practice under the Consumer Protection Act, enforced by the Attorney General's Consumer Protection Division. For violations up to 1 April 2027, the Division may offer a cure period of at least 60 days at its discretion. Civil penalties are up to $10,000 per violation and up to $25,000 for each repeated violation. The Consumer Protection Act private action does not apply, though other legal remedies are preserved.
Key points
Violations are unfair, abusive or deceptive trade practices subject to Title 13 enforcement and penalties, except the private action in § 13-408.
Section: § 14-4713(a)
Discretionary notice and cure of at least 60 days for alleged violations occurring on or before 1 April 2027.
Section: § 14-4714
Civil penalty up to $10,000 per violation; up to $25,000 for each repeated violation.
Section: § 13-410(a) and (b)
Consumers keep any other remedy provided by law.
Section: § 14-4713(b)
The Division may require a data protection assessment relevant to an investigation and use it in an enforcement action.
Section: § 14-4710(d)
Sources
Compare enforcement across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Maryland statute
Reference material, not legal advice.