# Maryland — US state consumer data privacy laws: applicability thresholds by state

For Maryland, law name and abbreviation is Maryland Online Data Privacy Act (MODPA); effective date is October 1, 2025; consumer volume threshold is CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR PROCESSED SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION; revenue-from-data-sales threshold is CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS REVENUE FROM THE SALE OF PERSONAL DATA; threshold combination logic is OR — during the preceding calendar year met either threshold, recorded from its source on 2026-08-12.

- **State:** Maryland _(our reading, not quoted from the source)_
- **Law name and abbreviation:** Maryland Online Data Privacy Act (MODPA)
- **Effective date:** October 1, 2025
- **Consumer volume threshold:** CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR PROCESSED SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION _(verified: appears in the quote below)_
- **Revenue-from-data-sales threshold:** CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS REVENUE FROM THE SALE OF PERSONAL DATA _(verified: appears in the quote below)_
- **Threshold combination logic:** OR — during the preceding calendar year met either threshold _(verified: appears in the quote below)_
- **Key exemptions:** State and local government bodies and instrumentalities; national securities associations; GLBA-regulated financial institutions and affiliates; nonprofit controllers assisting law enforcement with insurance crime or first responders with catastrophic events
- **Enforcement mechanism:** Division of Consumer Protection (Attorney General); civil penalty; no private right of action
- **Statute citation:** Md. Code Ann., Com. Law §§ 14-4601 to 14-4614
- **Notes:** Maryland bans the sale of sensitive data entirely (not just requiring consent). Maryland has relatively low thresholds (35,000/10,000 at 20%), matching Delaware and Rhode Island. Unlike many states, Maryland does not broadly exempt all nonprofits — only specific nonprofit controllers assisting law enforcement or first responders are exempt.

## What the source says

> CONDUCTS BUSINESS IN THE STATE OR PROVIDES PRODUCTS OR SERVICES THAT ARE TARGETED TO RESIDENTS OF THE STATE, AND THAT DURING THE PRECEDING CALENDAR YEAR DID ANY OF THE FOLLOWING: (1) CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR PROCESSED SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION; OR 2. (II) (2) CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS REVENUE FROM THE SALE OF PERSONAL DATA.

## Source

- https://mgaleg.maryland.gov/2024RS/chapters_noln/Ch_455_sb0541E.pdf

Last verified: 2026-08-12. Review by: 2026-11-10.
Part of [US state consumer data privacy laws: applicability thresholds by state](https://referencesource.org/state-data-privacy-applicability-thresholds/).