What does the Maryland Online Data Privacy Act mean for advertisers?
Part of US and Canada targeting
The short answer
The Maryland Online Data Privacy Act took effect October 1, 2025. It limits collection to what is reasonably necessary and proportionate to provide a product or service the consumer requested, bars selling sensitive data, and bars targeted advertising and sale where the controller knew or should have known the consumer is under 18. Ads based on current context are excluded.
Key takeaways
- MODPA was approved May 9, 2024 as Chapter 455 and took effect October 1, 2025, according to Maryland's Attorney General.
- It applies to businesses serving Maryland that processed data of at least 35,000 consumers, or 10,000 consumers with more than 20 percent of gross revenue from data sales.
- Collection is measured against a specific product or service the consumer requested, and sensitive data against what is strictly necessary for it.
- Targeted advertising and sale are barred where the controller knew or should have known the consumer is under 18, and the statute gives no consent route for that bar.
- A violation is an unfair, abusive or deceptive trade practice, with civil penalties up to $10,000 per violation and $25,000 for repeats.
What does Maryland's Online Data Privacy Act require?
The act sits in Title 14, Subtitle 47 of Maryland's Commercial Law article. The Maryland Office of the Attorney General (opens in a new tab) says MODPA went into effect October 1, 2025 and that the Attorney General has authority to enforce it. Under section 14-4702 (opens in a new tab) it applies to a person that conducts business in Maryland or provides products or services targeted to Maryland residents and that, during the preceding calendar year, met one of two tests.
| Test | Statute wording | Detail |
|---|---|---|
| Volume | Controlled or processed the personal data of at least 35,000 consumers | Excluding personal data processed solely to complete a payment transaction |
| Data sales | Controlled or processed the personal data of at least 10,000 consumers | And derived more than 20 percent of gross revenue from the sale of personal data |
| Who is a consumer | An individual who is a resident of the State | Not an individual acting in a commercial or employment context |
| Nonprofits | No general nonprofit exemption | The Attorney General says nonprofits are not exempt if they meet the threshold |
Section 14-4705 lists the consumer rights, including opting out of processing for targeted advertising, for sale, and for profiling in furtherance of solely automated decisions with legal or similarly significant effects. A controller must answer within 45 days and may extend once by 45 more with notice.
Definition
- Targeted advertising (Commercial Law 14-4701)
- Displaying advertisements to a consumer or on a device identified by a unique identifier, where the ad is selected from personal data obtained or inferred from the consumer's activities over time and across nonaffiliated websites or online applications, to predict preferences or interests.
The definition in section 14-4701 (opens in a new tab) names a device identified by a unique identifier, so an ad served to a device ID counts without a named person. It excludes ads based on the context of the current search, website visit or app, ads based on activity within the controller's own sites or apps, requested ads, and measurement of frequency, performance or reach.
What does data minimization mean under the Maryland act?
Data minimization is the duty to collect no more personal data than a purpose needs, and Maryland ties that purpose to the consumer's own request. Section 14-4707 (opens in a new tab) requires a controller to limit collection to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer to whom the data pertains.
A business can determine what is “reasonably necessary and proportionate to provide or maintain a specific product or service” based on the expectations of the reasonable consumer about how the data that is collected will be used.
| Data or use | Standard in the statute | What the text allows beyond it |
|---|---|---|
| Collection of any personal data | Reasonably necessary and proportionate to provide or maintain a specific product or service the consumer requested | No consent exception is written into this duty |
| Collection, processing or sharing of sensitive data | Strictly necessary to provide or maintain a specific product or service the consumer requested | No consent exception is written into this duty |
| Sale of sensitive data | A controller may not sell sensitive data | None in the subsection |
| A new purpose for data already held | Neither reasonably necessary to nor compatible with the disclosed purposes | Allowed with the consumer's consent |
Sensitive data in Maryland includes data revealing racial or ethnic origin, religious beliefs, consumer health data, sex life, sexual orientation, status as transgender or nonbinary, national origin, and citizenship or immigration status, plus genetic or biometric data, precise geolocation within 1,750 feet, and personal data of a consumer the controller knows or has reason to know is a child. Data inferred to indicate any of those categories is sensitive too.
How does the Maryland act limit targeted advertising to minors?
Section 14-4707(a) lists what a controller may not do. Item four bars processing personal data for targeted advertising if the controller knew or should have known the consumer is under 18, and item five bars selling that consumer's data. Neither item has a consent exception, unlike item eight on new purposes.
The standard in the text is "knew or should have known", not actual knowledge alone. For children under 13, the act borrows COPPA's definition, treats their personal data as sensitive data, and says in section 14-4703 that a controller following COPPA's verifiable parental consent rules meets any parental consent obligation in the subtitle. The federal rule is covered on the COPPA programmatic advertising page.
The minors bar attaches to targeted advertising as defined, so the context exclusion still applies. An ad chosen because a page about homework help or school sports matches the product is not targeted advertising under section 14-4701, whatever the reader's age. The bar reaches segments, retargeting and device ID audiences built from activity across nonaffiliated sites.
Facts a plan can record where Maryland readers may be under 18
- Whether any line uses personal data from activity across nonaffiliated sites or device identifiers.
- What the advertiser or its partners hold that indicates a consumer's age, such as a birth date or school year.
- Which lines choose placements only from the current page or search.
- Whether any audience segment is described by its provider as teen or student.
- Whether any data from the campaign is sold or passed to a third party for value.
When did the Maryland Online Data Privacy Act take effect?
Chapter 455 of 2024 (opens in a new tab), Senate Bill 541, was approved by the Governor on May 9, 2024. Its Section 4 moved the effective date from October 1, 2024 to October 1, 2025. Section 2 says one section of the act, numbered 14-4612 in the bill, applies only prospectively and may not be applied to processing activities before April 1, 2026.
Section 14-4707(f) lists, as a method a controller may use, allowing consumers on or before October 1, 2025 to opt out of targeted advertising or sale through an opt out preference signal sent with the consumer's consent. The signal may not use a default setting, and a controller that recognizes signals approved by other states is considered in compliance. How those signals work is covered on the Global Privacy Control page.
Section 14-4713 makes a violation an unfair, abusive or deceptive trade practice under Title 13, with its enforcement and penalty provisions except section 13-408. The Attorney General lists civil penalties up to $10,000 per violation and up to $25,000 for each repeat, plus injunctive relief, restitution and disgorgement. Under section 14-4714, for violations on or before April 1, 2027, the Consumer Protection Division may offer at least 60 days to cure.
How is Maryland's law stricter than other state privacy laws?
The difference shows when the same provision is read side by side. The table sets Maryland beside Texas and Colorado on four points, using statute text and the Colorado Attorney General's summary only.
| Provision | Maryland (Commercial Law 14-4707) | Texas (Business and Commerce Code 541.101) | Colorado (Attorney General summary of the act) |
|---|---|---|---|
| Collection limit | Reasonably necessary and proportionate to a specific product or service the consumer requested | Adequate, relevant and reasonably necessary for the purposes disclosed to the consumer | Collect and store only information they need |
| Sensitive data processing | Only where strictly necessary for a requested product or service | Allowed with the consumer's consent | Allowed with consent |
| Sale of sensitive data | Prohibited | Allowed with consent, plus a required notice | Allowed with consent |
| Targeted ads to minors | Barred where the controller knew or should have known the consumer is under 18 | No separate under 18 rule in section 541.101; known child data follows COPPA | Consent required where the controller actually knows or willfully disregards the consumer is under 18 |
Maryland's thresholds are also lower in raw numbers: 35,000 consumers, where Texas relies on a small business test and Colorado on 100,000 consumers. Lower numbers bring in businesses with smaller Maryland customer bases. Other state laws in force are listed on the state privacy laws page.
What does a Maryland review look like on a campaign with teenage readers?
Fictional example. Unnamed brand, no results implied.
A Pennsylvania formal wear shop plans a prom season flight into Maryland
An unnamed formal wear and prom dress retailer based in Lancaster, Pennsylvania plans spring display ads for shoppers in Baltimore and Annapolis, who include high school students and their parents. The brief asks for placements beside prom planning and formal fashion articles, plus a retargeting line for past site visitors.
The planner builds the first line from article content, which section 14-4701 excludes from targeted advertising. For the retargeting line, the planner notes that the client's checkout collects a graduation year field and records that section 14-4707 bars targeted advertising where the controller knew or should have known the consumer is under 18. The client's privacy lead decides how the line is built; the plan records the facts and the statute text.
How can PlacementGraph supply the contextual line of a Maryland plan?
Choosing placements from page content is the part of such a plan PlacementGraph handles.
Frequently asked questions
Are nonprofits covered by the Maryland Online Data Privacy Act?
The Attorney General says nonprofits are not exempt and must comply if they meet the personal data threshold and no other exemption applies. Section 14-4703 exempts a nonprofit that processes data solely to assist law enforcement or first responders responding to catastrophic events.
Does a privacy notice need a separate Maryland section?
The Attorney General says a Maryland specific section is not required and that one section may describe rights for residents of several states. It must be unambiguously clear which rights apply to Maryland residents, especially where those rights differ from other states.
Can a business charge Marylanders for answering data requests?
Section 14-4705 requires a controller to respond free of charge once in any 12 month period. For requests that are manifestly unfounded, excessive, technically infeasible or repetitive, the controller may charge a reasonable administrative fee or decline to act.
Does MODPA require a data protection assessment for targeted advertising?
The Attorney General lists assessments before processing that presents a heightened risk of harm, and names processing for targeted advertising, selling personal data, processing sensitive data and certain profiling. It adds that each algorithm presenting a heightened risk of harm must be assessed.
Sources
- Data Privacy in Maryland (MODPA) (opens in a new tab)Maryland Office of the Attorney General
- Commercial Law 14-4701, Definitions (opens in a new tab)Maryland General Assembly
- Commercial Law 14-4702, Applicability (opens in a new tab)Maryland General Assembly
- Commercial Law 14-4707, Controller duties (opens in a new tab)Maryland General Assembly
- Commercial Law 14-4713, Enforcement (opens in a new tab)Maryland General Assembly
- Commercial Law 14-4714, Notice and cure (opens in a new tab)Maryland General Assembly
- Chapter 455 of 2024 (Senate Bill 541), Maryland Online Data Privacy Act of 2024 (opens in a new tab)Maryland General Assembly
- Texas Business and Commerce Code, Chapter 541 (opens in a new tab)Texas Legislature
- Colorado Privacy Act (CPA) (opens in a new tab)Colorado Attorney General
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.