Maryland
For Maryland, law name and abbreviation is Maryland Online Data Privacy Act (MODPA); effective date is October 1, 2025; consumer volume threshold is CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR PROCESSED SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION; revenue-from-data-sales threshold is CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS REVENUE FROM THE SALE OF PERSONAL DATA; threshold combination logic is OR — during the preceding calendar year met either threshold, recorded from its source on 2026-08-12.
- State
- Maryland our reading
- Law name and abbreviation
- Maryland Online Data Privacy Act (MODPA)
- Effective date
- October 1, 2025
- Consumer volume threshold
- CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR PROCESSED SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION verified
- Revenue-from-data-sales threshold
- CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS REVENUE FROM THE SALE OF PERSONAL DATA verified
- Threshold combination logic
- OR — during the preceding calendar year met either threshold verified
- Key exemptions
- State and local government bodies and instrumentalities; national securities associations; GLBA-regulated financial institutions and affiliates; nonprofit controllers assisting law enforcement with insurance crime or first responders with catastrophic events
- Enforcement mechanism
- Division of Consumer Protection (Attorney General); civil penalty; no private right of action
- Statute citation
- Md. Code Ann., Com. Law §§ 14-4601 to 14-4614
- Notes
- Maryland bans the sale of sensitive data entirely (not just requiring consent). Maryland has relatively low thresholds (35,000/10,000 at 20%), matching Delaware and Rhode Island. Unlike many states, Maryland does not broadly exempt all nonprofits — only specific nonprofit controllers assisting law enforcement or first responders are exempt.
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
CONDUCTS BUSINESS IN THE STATE OR PROVIDES PRODUCTS OR SERVICES THAT ARE TARGETED TO RESIDENTS OF THE STATE, AND THAT DURING THE PRECEDING CALENDAR YEAR DID ANY OF THE FOLLOWING: (1) CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR PROCESSED SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION; OR 2. (II) (2) CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS REVENUE FROM THE SALE OF PERSONAL DATA.
— mgaleg.maryland.gov, retrieved 2026-08-12
Source
- mgaleg.maryland.govhttps://mgaleg.maryland.gov/2024RS/chapters_noln/Ch_455_sb0541E.pdf