--- title: "Maryland privacy law (MODPA): sensitive data" canonical: "https://dposchool.com/state-privacy-laws/state/maryland/sensitive-data" source: "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Maryland Online Data Privacy Act # Maryland privacy law (MODPA): sensitive data Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Maryland does not use a consent model for sensitive data. A controller may collect, process or share sensitive data only where strictly necessary to provide or maintain a specific product or service the consumer requested, and may never sell sensitive data. Since 1 July 2026, sensitive data also includes data the controller infers that indicates a sensitive category. Controllers may not use data of anyone they know or should have known is under 18 for targeted advertising, nor sell it. ## Key points 1. Sensitive data: race or ethnicity, religion, consumer health data, sex life, sexual orientation, transgender or nonbinary status, national origin, citizenship or immigration status, genetic or biometric data, data of a known child, and precise geolocation. Section: [§ 14-4701(gg)(1)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 2. Since 1 July 2026, includes data inferred by a controller that indicates any of those categories. Section: [§ 14-4701(gg)(2)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 3. Collection, processing or sharing of sensitive data is allowed only where strictly necessary to provide or maintain a specific product or service the consumer requested. Section: [§ 14-4707(a)(1)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 4. Sale of sensitive data is prohibited outright. Section: [§ 14-4707(a)(2)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 5. No targeted advertising to, and no sale of the data of, consumers the controller knew or should have known are under 18. Section: [§ 14-4707(a)(4) and (5)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 6. No geofence within 1,750 feet of mental health or reproductive or sexual health facilities to track or message consumers about their health data. Section: [§ 14-4704(3)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) 7. Precise geolocation means location within a 1,750-foot radius of a consumer, a mobile device or a vehicle (device and vehicle added from 1 July 2026). Section: [§ 14-4701(x)](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) ## Sources - [https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4707&enactments=false](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4707&enactments=false) - [2026 Md. Laws ch. 874 (HB 711), chapter text](https://mgaleg.maryland.gov/2026RS/chapters_noln/Ch_874_hb0711T.pdf) [Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Maryland statute](https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false) Reference material, not legal advice. ## Other topics for Maryland - [Applicability](https://dposchool.com/state-privacy-laws/state/maryland/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/maryland/consumer-rights) - [Controller duties](https://dposchool.com/state-privacy-laws/state/maryland/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/maryland/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/maryland/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Maryland](https://dposchool.com/state-privacy-laws/state/maryland) / Sensitive data Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/maryland/consumer-rights) Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/maryland/controller-duties) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents