Key Facts
Overview
Maryland's MODPA is the most restrictive US state privacy law. It completely prohibits the sale of sensitive data. Not even consent can authorize it. Sensitive data may only be processed when "strictly necessary" to deliver a service requested by the consumer. Under-18 data sale and targeted advertising are prohibited regardless of consent.
What This Means for Your Website
- GPC/UOOM signals must be honored
- Sensitive data sale is completely prohibited: consent cannot authorize it
- Sensitive data processing is limited to what is "strictly necessary" for requested services
- Under 18: sale and targeted advertising prohibited regardless of consent
- The strictest data minimization requirements among all US state privacy laws
- Biometric data is covered even if not used for identification purposes
- Consumer health data includes gender-affirming care and reproductive health
Key Requirements
The Maryland AG enforces the MODPA with penalties of $10,000 per first violation and $25,000 per subsequent violations. There is no cure period. Consumer requests must be fulfilled within 45 days. The sensitive data definition is the broadest among US states, covering biometric data even without identification use, consumer health data including gender-affirming care, and precise geolocation.
How ConsentStack Handles This
ConsentStack detects Maryland visitors and applies the strictest consent model among US states, blocking sensitive data sale entirely and limiting processing to strictly necessary purposes.
Penalties
$10,000 per first violation; $25,000 per subsequent violation.
Key Requirements
- Honor GPC/universal opt-out signals
- Sensitive data: processing only when strictly necessary
- Sale of sensitive data completely prohibited even with consent
- Under 18: sale and targeted advertising prohibited regardless of consent
- Strict data minimization, most restrictive among US states
- Data protection assessments for high-risk processing
Notable Provisions
- Most restrictive US state privacy law
- Sensitive data sale completely prohibited: consent cannot authorize it
- Strictest data minimization requirements
- Under 18 sale/advertising prohibited regardless of consent
- Biometric data covered even without identification use
Data Subject Rights
Confirm whether a controller is processing your personal data and, if it is, access that data.
Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
Require a controller to delete personal data you provided or that it obtained about you, unless the law requires it to keep the data.
Where processing is done by automatic means, obtain a copy of your personal data in a portable and, where technically feasible, readily usable format you can easily transmit to another controller.
Obtain a list of the categories of third parties the controller has disclosed your personal data to or, if it does not keep that per consumer, the categories it has disclosed any consumer's personal data to.
Opt out of the processing of your personal data for targeted advertising; a controller may not process for targeted advertising the data of a consumer it knew or should have known is under 18.
Opt out of the sale of your personal data; a controller may not sell sensitive data at all, or sell the data of a consumer it knew or should have known is under 18.
Opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, such as decisions on lending, housing, education, criminal justice, employment, health care or essential goods and services.
Designate an authorized agent, including by an Internet link, browser setting, browser extension or global device setting, to opt out on your behalf of targeted advertising, sale or profiling; this agent right covers opt-outs only.
Appeal a controller's refusal to act on your rights request through a process that must be conspicuously available and similar to the request process, and receive a written explanation of the decision.
If a controller denies your appeal, it must give you an online mechanism, where available, to submit a complaint to the Attorney General's Consumer Protection Division.
Revoke consent you gave a controller through a mechanism at least as easy as the one you used to give it, after which the controller must stop processing your personal data as soon as practicable.
A controller may not discriminate against you for exercising a right under the Act, including by denying goods or services, charging different prices or rates, or providing a different level of quality.
US State Specifics
Other North America Regulations
Frequently Asked Questions
MODPA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.
Stay compliant with MODPA
ConsentStack helps you implement Opt-out consent for Maryland, United States automatically.