DPO SchoolDPO School

Maryland Online Data Privacy Act

Maryland privacy law (MODPA): sensitive data

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Maryland does not use a consent model for sensitive data. A controller may collect, process or share sensitive data only where strictly necessary to provide or maintain a specific product or service the consumer requested, and may never sell sensitive data. Since 1 July 2026, sensitive data also includes data the controller infers that indicates a sensitive category. Controllers may not use data of anyone they know or should have known is under 18 for targeted advertising, nor sell it.

Key points

  1. Sensitive data: race or ethnicity, religion, consumer health data, sex life, sexual orientation, transgender or nonbinary status, national origin, citizenship or immigration status, genetic or biometric data, data of a known child, and precise geolocation.

    Section: § 14-4701(gg)(1)

  2. Since 1 July 2026, includes data inferred by a controller that indicates any of those categories.

    Section: § 14-4701(gg)(2)

  3. Collection, processing or sharing of sensitive data is allowed only where strictly necessary to provide or maintain a specific product or service the consumer requested.

    Section: § 14-4707(a)(1)

  4. Sale of sensitive data is prohibited outright.

    Section: § 14-4707(a)(2)

  5. No targeted advertising to, and no sale of the data of, consumers the controller knew or should have known are under 18.

    Section: § 14-4707(a)(4) and (5)

  6. No geofence within 1,750 feet of mental health or reproductive or sexual health facilities to track or message consumers about their health data.

    Section: § 14-4704(3)

  7. Precise geolocation means location within a 1,750-foot radius of a consumer, a mobile device or a vehicle (device and vehicle added from 1 July 2026).

    Section: § 14-4701(x)

Sources

Compare sensitive data across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Maryland statute

Reference material, not legal advice.