Maryland Online Data Privacy Act (MODPA) Reference Guide

A company doing business in Maryland or offering products or services targeted to Maryland residents may fall within MODPA if, during the preceding calendar year, it processed data of at least 35,000 consumers, excluding data processed solely for completing a payment transaction. The alternative is at least 10,000 consumers and more than 20% of gross revenue from selling personal data. Maryland Code: § 14-4702

The act contains entity and data exemptions. A site’s analytics count alone cannot establish the statutory consumer count, revenue test or an exemption. The legal team should review the business, data and processing purpose. Maryland Code: § 14-4703

Maryland looks to the preceding calendar year. Payment-only data is excluded from the 35,000-person branch; the second branch also requires a revenue share. Keep the calculation separate from web sessions.

Eligible consumers may access, correct, delete and receive a portable copy of personal data, and obtain categories of third parties to which it was disclosed. They may opt out of targeted advertising, a sale, or profiling in furtherance of solely automated decisions with legal or similarly significant effects. Controllers ordinarily respond within 45 days; a justified 45-day extension requires notice within the first period. Maryland Code: § 14-4705

A controller generally cannot collect, process or share sensitive data unless it is strictly necessary to provide or maintain the consumer’s requested product or service. Selling sensitive data is prohibited. This is different from treating a consent checkbox as universal permission to collect it. Controllers also must limit general collection to what is reasonably necessary and proportionate. Maryland Code: § 14-4707

Maryland’s sale definition encompasses monetary or other valuable consideration, with exceptions that depend on the recipient and context. Targeted advertising creates a separate opt-out question. A network call to an ad vendor is evidence of data flow; counsel must assess whether it is a covered sale, targeted advertisement, processor transfer or exempt use. Maryland Code: definitions Maryland Code: opt-out rights

Map each script, cookie, recipient and purpose. Test the actual opt-out route, and compare pre-choice with post-choice traffic. Give special attention to identifiers on health, financial, location or child-facing pages, where the sensitive-data or minors rules may change the analysis. Maryland Code: controller restrictions

Maryland requires secure, reliable ways for consumers to exercise their rights. Its statute says a controller may utilize a clear website opt-out link or a qualifying opt-out preference-signal method. It also says recognition of signals approved by other states satisfies that provision. Do not describe the text as a blanket GPC-recognition mandate for every controller. Maryland Code: § 14-4707(f)–(g)

Test consent rejection and GPC in separate browser sessions. That helps expose multistate tracking leaks, but Maryland-specific evidence should include the opt-out route the website actually offers and whether the resulting choice reaches every relevant tag.

A MODPA violation is treated under the Maryland Consumer Protection Act’s enforcement and penalty framework, excluding its specific private-action provision. The statute preserves other remedies under other laws. For alleged violations occurring on or before April 1, 2027, the Consumer Protection Division may issue a notice if it determines a cure is possible. If it does, the business has at least 60 days to cure. That is not an automatic safe harbor. Maryland Code: § 14-4713 Maryland Code: § 14-4714

The legal team determines whether MODPA applies and how each data use should be classified. The technical team maps those decisions to scripts and tests the behavior after a consumer choice.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal applicability, exemptions, sensitive-data decisions, notices, vendor contracts, rights requests and organizational governance belong with qualified privacy counsel.

This guide uses the current Maryland Commercial Law subtitle rather than the initial bill’s former section numbering, and checks the 2024 enacted chapter for the effective and application dates.

Prepared by Etalon Editorial Team. Last reviewed September 27, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for scope, exemptions, sensitive-data restrictions, data-use classifications, notices, rights requests, contracts and governance.