Maryland Online Data Privacy Act Takes Effect
The Maryland Online Data Privacy Act (MODPA) became effective, introducing one of the most restrictive state privacy laws in the United States. Unlike most other state privacy laws that allow opt-out rights for data sales and targeted advertising, Maryland's law prohibits the sale of sensitive personal data entirely, a ban that consumer consent cannot override, and restricts the collection of personal data to what is reasonably necessary and proportionate to provide the requested service. The law also includes strong protections for minors' data and restricts targeted advertising directed at consumers under 18. By its terms MODPA did not apply to processing activities occurring before April 1, 2026; that transition window has closed and the law now applies in full.
Key Analytics
Impact Analysis
Maryland's more restrictive approach, particularly its data minimization requirements and outright prohibition on sensitive data sales, represents an escalation beyond the opt-out models adopted by most other states. Organizations that have built compliance programs around providing opt-out mechanisms may need to fundamentally restructure data collection and processing practices to meet Maryland's proportionality and necessity standards. The law's strong protections for minors signal continued regulatory momentum around children's and teens' privacy at the state level.
Recommended Actions
- Conduct a data minimization assessment to ensure all personal data collection is reasonably necessary and proportionate to the service being provided, as required by Maryland's stricter standard.
- Immediately cease any sale of sensitive personal data as defined under MODPA, and review data sharing agreements with third parties to ensure compliance with the prohibition.
- Implement age-gating or age-estimation mechanisms sufficient to restrict targeted advertising to consumers under 18, and review all data practices affecting minors for compliance with Maryland's heightened protections.
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Data minimization assessment against MODPA's necessity standard
- ›Sensitive data sale cessation and third-party agreement review
- ›Age-gating or age estimation for under-18 targeted advertising
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 75 to 165 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.