Maryland Has a New Online Data Privacy Law

The Maryland Online Data Privacy Act (MODPA) was signed into law in 2024, but took effect on October 1, 2025, and its enforcement authority will start in April 2026.

The MODPA applies to companies that conduct business in Maryland or target Maryland residents, and meet certain data-processing thresholds (such as controlling or processing personal data of a specified number of Maryland consumers annually), or derive a portion of their revenue from the sale of personal data. The law focuses on data controllers (who determine the purposes and means of processing) and data processors (who process data on behalf of controllers). The law expands the rights of Maryland consumers to their personal data. Marylanders will be able to:

• Access personal data held about them
• Correct inaccuracies
• Delete personal data
• Obtain a copy (data portability)
• Opt out of:
  • Targeted advertising
  • Sale of personal data
  • Certain profiling activities

Data controller businesses will be required to provide clear mechanisms to exercise these statutory rights and to respond within statutory timelines.  Violations of MODPA may be considered unfair/deceptive trade practices under the Maryland Consumer Protection Act

MODPA places particular emphasis on sensitive personal data, which can include:

• Health information
• Biometric data
• Precise geolocation
• Data about children
• Racial or ethnic origin
• Religious beliefs

If you believe that your privacy/consumer rights have been violated, our attorneys at Lewicky, O’Connor, Hunt, & Meiser can help you resolve these issues.