--- title: "Maryland privacy law (MODPA): enforcement" canonical: "https://dposchool.com/state-privacy-laws/state/maryland/enforcement" source: "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Maryland Online Data Privacy Act # Maryland privacy law (MODPA): enforcement Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) A violation is an unfair, abusive or deceptive trade practice under the Consumer Protection Act, enforced by the Attorney General's Consumer Protection Division. For violations up to 1 April 2027, the Division may offer a cure period of at least 60 days at its discretion. Civil penalties are up to $10,000 per violation and up to $25,000 for each repeated violation. The Consumer Protection Act private action does not apply, though other legal remedies are preserved. ## Key points 1. Violations are unfair, abusive or deceptive trade practices subject to Title 13 enforcement and penalties, except the private action in § 13-408. Section: [§ 14-4713(a)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 2. Discretionary notice and cure of at least 60 days for alleged violations occurring on or before 1 April 2027. Section: [§ 14-4714](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 3. Civil penalty up to $10,000 per violation; up to $25,000 for each repeated violation. Section: [§ 13-410(a) and (b)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 4. Consumers keep any other remedy provided by law. Section: [§ 14-4713(b)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 5. The Division may require a data protection assessment relevant to an investigation and use it in an enforcement action. Section: [§ 14-4710(d)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) ## Sources - [https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4713&enactments=false](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4713&enactments=false) - [https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4714&enactments=false](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4714&enactments=false) - [Md. Code, Com. Law § 13-410 (civil penalties)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=13-410&enactments=false) [Compare enforcement across all states](https://dposchool.com/state-privacy-laws/topic/enforcement) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 83: General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83) (enforcement) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Maryland statute](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) Reference material, not legal advice. ## Other topics for Maryland - [Applicability](https://dposchool.com/state-privacy-laws/state/maryland/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/maryland/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/maryland/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/maryland/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/maryland/processors) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Maryland](https://dposchool.com/state-privacy-laws/state/maryland) / Enforcement Previous: [Processors](https://dposchool.com/state-privacy-laws/state/maryland/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents