Blog

Maryland’s Online Data Privacy Act (MODPA) key rules & requirements

Maryland has become part of the growing wave of U.S. states adopting comprehensive privacy laws.

Harry Chambers
Regulatory Content Strategist
October 6, 2025

Scope and applicability: Who must comply
Key requirements
Organizational obligations and enforcement
Preparing for compliance: Practical steps
Moving forward
Key questions about MODPA

Maryland has become part of the growing wave of U.S. states adopting comprehensive privacy laws with the Maryland Online Data Privacy Act (MODPA). Enacted in 2024, it took effect on October 1, 2025, but the law will not apply to processing activities that occurred before April 1, 2026. This gap gives organizations a short transition period, but preparation should begin well before those dates.

It introduces stricter rules than many existing state laws, with an approach to sensitive data, consumer rights, and algorithmic decision-making that creates a distinct compliance burden. Organizations must adapt policies, technical controls, and processes to align with Maryland’s specific expectations, which often go beyond what other state frameworks currently require.

By setting a higher bar in areas such as the prohibition of sensitive data sales and the obligations tied to automated decision-making, Maryland signals how state-level privacy rules are evolving. Businesses, nonprofits, and regulators worldwide are watching how these requirements will influence future standards.

Scope and applicability: Who must comply

MODPA’s scope is broad, and it applies to a wide range of organizations operating in Maryland. Two primary thresholds determine whether an entity falls under its obligations:

Data volume: Organizations that process the personal data of at least 35,000 consumers in a calendar year must comply. Importantly, this number excludes payment transaction data, which narrows the threshold slightly.
Revenue from data sales: Organizations that earn revenue from selling the personal data of at least 10,000 consumers must also comply, if those sales represent 20% or more of total gross revenue.

This scope captures a broad range of entities, including many mid-sized businesses that may not fall under other state privacy laws. A key differentiator is Maryland’s treatment of nonprofits. Unlike many other states that broadly exempt nonprofit organizations, MODPA applies to them with very narrow exceptions. Only first responder organizations, or nonprofits that process personal data solely to assist law enforcement with investigating crimes or fraudulent insurance activity, are carved out. This means many nonprofits will be subject to the same obligations as for-profit companies.

Maryland also uses “personal data” instead of “personal information” and defines “sale” broadly to include exchanges for monetary or other valuable consideration. This mirrors trends in other states but still expands the number of data transactions captured under the definition.

By expanding the scope in this way, Maryland is making it clear that MODPA is not limited to big tech players or consumer data brokers. The law extends to any organization meeting the thresholds, regardless of size or sector, and places responsibility for compliance squarely on them.

Key requirements: Sensitive data, consumer rights, and automated decision-making

One of the most notable elements of MODPA is its treatment of sensitive data. Sensitive data includes genetic, biometric, health, precise geolocation, and children’s information. Organizations may only collect, process, or share sensitive data when it is strictly necessary to provide or maintain a product or service the consumer has requested. The law prohibits the sale of sensitive data entirely, and importantly, consent does not override this prohibition. This restriction marks a significant departure from most state laws, which allow the sale of sensitive data with consumer consent.

MODPA also introduces a full suite of consumer rights, giving individuals strong control over their personal data. These rights include:

The right to be informed about data processing activities.
The right to confirm whether personal data is being processed.
The right to access, correct, and delete personal data, subject to certain legal retention rules.
The right to data portability.
The right to opt out of sales, targeted advertising, and profiling.

When it comes to profiling, Maryland narrows the scope to decisions made solely by automated means that have legal or similarly significant effects, such as lending or hiring. This distinction highlights the state’s concern about algorithmic fairness and accountability.

Consent plays a central role. Organizations must obtain opt-in consent for further processing beyond the original purpose and for handling sensitive data. Consumers must be able to withdraw consent easily, and organizations must honor withdrawal requests within 30 days.

MODPA also requires transparency around data sharing. Consumers can ask organizations to provide the categories of third parties that received their data. They may also appoint a representative to exercise rights on their behalf.

By aligning consumer rights with broader state trends while layering stricter conditions on sensitive data and profiling, Maryland is advancing a more consumer-centric privacy model that demands careful operational planning.

Organizational obligations and enforcement

MODPA goes beyond granting rights. It imposes obligations on controllers and processors that demand changes to privacy operations. Controllers must implement reasonable security measures, conduct risk assessments, and publish clear privacy notices. Notices must explicitly state whether personal data will be sold or shared and explain how consumers can exercise opt-out rights. These disclosures must be clear, prominent, and written in straightforward language.

Data protection assessments are required for processing representing a heightened risk of harm to consumers, including sales of personal data, targeted advertising, and profiling. A unique aspect of MODPA is its explicit requirement to address algorithms in an assessment, underscoring the state’s focus on automated decision-making.

At the same time, processors also have obligations tofollow controller instructions, maintain security, stop processing when directed, and support compliance efforts, including consumer rights requests.

Enforcement sits with the Maryland Attorney General. Organizations receive 60 days to cure violations once notified, which is longer than the cure periods in some states. Penalties reach up to $10,000 for a first violation and up to $25,000 for each subsequent violation. Consumers do not have a private right of action under MODPA, meaning they cannot bring lawsuits directly. This leaves enforcement entirely in the hands of the state.

The law’s delayed application to pre-April 2026 processing activities provides organizations with a brief window to get systems in place. But delaying compliance preparation risks creating a bottleneck as the effective date approaches.

Preparing for compliance: Practical steps for organizations

Maryland’s approach to sensitive data, consumer rights, and automated decision-making makes MODPA stand out among state privacy laws. Preparing for compliance involves three key steps:

Inventory data with a focus on sensitive categories
Build a clear picture of what personal data you process and whether any of it qualifies as sensitive under MODPA’s definition. Pay attention to biometric, health, and geolocation data in particular.
Evaluate automated decision-making systems
Assess how algorithms are being used, especially in decisions with legal or significant effects. Incorporate these systems into data protection assessments to meet MODPA’s specific requirements.
Review consent mechanisms and notices
Ensure consumers have clear and easy ways to opt in for sensitive data and to withdraw consent. Update privacy notices so they provide transparency in plain language, particularly around sales and targeted advertising.
Strengthen risk assessment and security practices
Prepare to conduct thorough assessments for processing activities starting October 1, 2025. Reinforce security controls to meet the expectation of “reasonable” protection.
Engage nonprofit stakeholders
Nonprofit organizations that previously assumed exemptions under other laws should reexamine their practices. MODPA’s narrow nonprofit carve-out means compliance may now apply.

The dual dates of October 2025 and April 2026 require careful attention. Enforcement begins in October, but processing activities prior to April 2026 are not covered. Organizations should use this window to update systems and processes, but they should not view it as extra time to delay action. The sooner preparation begins, the smoother compliance will be when the law takes full effect.

Moving forward

MODPA reflects the trajectory of U.S. state privacy laws toward more rigorous protections, particularly for sensitive data and automated decision-making as well as setting a higher bar of privacy accountability.

Managing compliance with laws like MODPA will take more than manual processes. OneTrust helps privacy teams automate data subject rights, build accurate data inventories, and integrate privacy by design into daily operations. With automation, organizations can respond quickly to regulatory change, reduce the burden of repetitive tasks, and maintain a clear line of accountability.

To explore how OneTrust can support your privacy program as MODPA approaches, request a demo to see the platform in action.

Key questions about MODPA

The Maryland Online Data Privacy Act (MODPA) is a comprehensive state privacy law adopted in 2024. It took effect on October 1, 2025, with application beginning April 1, 2026. The law creates obligations for organizations processing personal data and grants Maryland consumers extensive rights, with special restrictions on sensitive data and automated decision-making.

MODPA applies to organizations that process the personal data of at least 35,000 consumers annually (excluding payment data) or that derive 20% or more of their gross revenue from selling the data of at least 10,000 consumers. Nonprofits are largely included, with narrow exceptions for first responders and organizations supporting law enforcement fraud investigations.

MODPA sets stricter requirements than many state laws. Sensitive data, such as biometric, genetic, health, precise geolocation, and children’s information, may only be processed when strictly necessary to deliver a service requested by the consumer. The sale of sensitive data is prohibited outright, and consent does not override this ban.

Organizations should begin with a thorough inventory of data, paying close attention to sensitive categories. They should conduct risk assessments that include profiling and algorithmic decision-making and update privacy notices, consent mechanisms, and workflows to reflect MODPA’s requirements. Early action ensures smoother compliance and reduces the risk of penalties.

Privacy Matters

Our privacy center makes it easy to see how
we collect and use your information.

Your privacy

When we collect your personal information, we always inform you of your rights and make it easy for you to exercise them. Where possible, we also let you manage your preferences about how much information you choose to share with us, or our partners.

Blog

Maryland’s Online Data Privacy Act (MODPA) key rules & requirements

Table of contents

Scope and applicability: Who must comply

Key requirements: Sensitive data, consumer rights, and automated decision-making

Organizational obligations and enforcement

Preparing for compliance: Practical steps for organizations

Moving forward

Key questions about MODPA

What is the Maryland Online Data Privacy Act?

Who must comply with MODPA?

How does MODPA regulate sensitive data?

What steps should organizations take to prepare for MODPA compliance?

You may also like

Privacy Automation

Turning regulatory change into action with DataGuidance & Copilot

Discover how OneTrust DataGuidance and Copilot turn global privacy regulations into actionable workflows, helping teams stay compliant efficiently.

November 13, 2025

AI Governance

Navigating AI governance: Privacy compliance under Philippine law

Join this webinar to learn how the Philippines is activley sharing its AI Governance framework, with new guidelines from the NPC and updates to the DPA that impact how organisations deploy and manage AI systems.

November 06, 2025

Privacy Automation

Managing data privacy and cybersecurity in insurance

Discover how insurers can navigate global privacy laws and cybersecurity mandates. Learn strategies for AI risk, third-party oversight, and data governance to build a resilient, privacy-first insurance organization.

November 06, 2025

Privacy Automation

Navigating the cybersecurity threat landscape: Legal and compliance perspectives for financial services firms

As financial services firms across Europe and the U.S. face an increasingly complex cyber threat environment, legal and compliance leaders are at the forefront of managing risk, regulatory obligations, and incident response.

November 04, 2025

Privacy Automation

End-to-end automation for DSRs & privacy incidents

Learn how OneTrust automates DSRs and privacy incident management to reduce risk, accelerate responses, and scale privacy operations.

October 23, 2025

Privacy Automation

Global regulatory update: Q4 2025 privacy & data trends

Stay ahead of privacy and data protection in Q4 2025. Join OneTrust’s live update covering US state laws, EU AI Act readiness, children’s data, cross-border transfers, DORA, APAC trends, and key enforcement actions.

October 14, 2025

Privacy Automation

Automating your privacy map and risk workflows

Learn how privacy teams automate data mapping, vendor risk, DPAs, and privacy impact assessments with OneTrust.

October 02, 2025

Privacy Automation

Financial services privacy readiness checklist

Download the Financial Services Privacy Readiness Checklist to address evolving regulations, strengthen customer trust, and govern AI risks with a clear, structured privacy approach.

September 25, 2025

Privacy Automation

State spotlight: Navigating the new Maryland & Minnesota privacy laws

Explore Minnesota & Maryland’s new privacy laws. Learn how automation helps teams stay compliant, efficient & audit-ready in 2025’s evolving landscape.

September 18, 2025

Privacy Automation

Malaysia PDPA Amendment Act: Essential compliance handbook for privacy professionals

Download your guide to Malaysia’s PDPA 2024 amendments: key changes, compliance steps, penalties, and tools to build a future-ready privacy program.

September 05, 2025

Privacy Automation

From compliance to scale: Real-world lessons in privacy automation

Discover expert insights on scaling privacy automation, overcoming common challenges, and using AI to boost efficiency—perfect for privacy programs at any maturity stage.

September 03, 2025

Privacy Automation

Moving from risk to revenue: Consent management with OneTrust and Hightouch

Unlock revenue and customer trust. Learn how OneTrust + Hightouch activate consented data to power compliant, personalized marketing at scale.

August 13, 2025

Privacy Automation

Scaling privacy in financial services: Navigating regulation, consumer trust, and AI

Join privacy and risk experts from OneTrust and KPMG as they break down the critical trends shaping the future of privacy in financial services—and how leading institutions are responding.

August 12, 2025

Privacy Automation

CCPA developments & trends in 2025

Join us for an insightful webinar as we delve into privacy developments in California in 2025, and learn how California privacy legislation shapes up against a developing privacy landscape across the US with privacy law amendments and data privacy rules, including trends in enforcement.

August 12, 2025

AI Governance

Agentic AI: Navigating the tension between privacy and the next generation of AI

Explore the value, risks, and privacy implications of AI agents. Learn how they work, common myths, blind spots, and key concerns for privacy professionals.

July 25, 2025

Privacy Automation

Optimize privacy operations: Scale and manage risks effectively

This session will explore strategies for scaling privacy automation and risk management as well as overcoming compliance and automation challenges.

July 17, 2025

Privacy Management

OneTrust Using OneTrust: Managing data privacy