Maryland MODPA
Maryland Online Data Privacy Act of 2024 (SB 541, Chapter 455; Md. Code, Com. Law 14-4601 et seq.)
The MODPA took effect on 1 October 2025 and applies to processing from 1 April 2026. It is the strictest state privacy law on sensitive data: collection and processing must be strictly necessary to provide the requested product or service, and sale of sensitive data is banned outright, even with consent.
Who it applies to
Persons doing business in Maryland or targeting its residents that control or process the personal data of 35,000 or more consumers (excluding payment-only data), or 10,000 or more consumers while deriving more than 20 percent of gross revenue from selling personal data.
Identity requirements
- Collect or process sensitive data, including biometric data, only when strictly necessary to provide or maintain a specifically requested product or service
- Never sell sensitive data, regardless of consent
- Do not sell, or process for targeted advertising, the data of consumers the controller knows or should have known are under 18
- Limit collection of personal data to what is reasonably necessary and proportionate
- Conduct data protection assessments, including for each algorithm used in higher-risk processing
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Identity verification (KYC/proofing) | Biometric proofing must be justified as strictly necessary for the service; consent alone is not enough. |
| Customer identity & consent (CIAM) | The 'should have known' standard for minors pushes controllers to consider age signals in account data. |
| Audit, logging & accountability | Assessments must be documented, including per-algorithm assessments. |
Penalties
Violations are unfair, abusive or deceptive trade practices under the Maryland Consumer Protection Act, with civil penalties of up to 10,000 dollars per violation and up to 25,000 dollars for each repeat violation. The Attorney General may offer a 60-day cure period until 1 April 2027.
Status and dates last verified against primary sources on 2026-10-31.
Maryland MODPA: frequently asked questions
- When does the Maryland Online Data Privacy Act apply?
- It took effect on 1 October 2025 and applies to personal data processing activities from 1 April 2026.
- How does Maryland treat biometric data?
- Biometric data is sensitive data. It may be collected or processed only when strictly necessary to provide a requested product or service, and it may never be sold.