Maryland Online Data Privacy Act (MODPA): your rights and how to use them

Who has to follow MODPA

The law covers businesses that operate in Maryland or target Maryland residents and that handled personal data of at least 35,000 consumers in the previous calendar year. Data used only to complete a payment doesn't count toward that number. A smaller business is covered too if it handled data of at least 10,000 consumers and earned more than 20% of its gross revenue from selling personal data.

Most nonprofits are covered. Only nonprofits that process data solely to help law enforcement with insurance crime, or to help first responders in a catastrophe, are exempt.

Maryland's stricter rules on sensitive data

Maryland goes further than a plain opt-out. A business may not sell sensitive data at all, and it may collect, process or share sensitive data only when that's strictly necessary for a product or service you asked for. It also may not sell, or use for targeted advertising, the data of anyone it knew or should have known is under 18.

The dates that matter

• October 1, 2025: the law took effect, and businesses had to start honoring opt-out preference signals.
• April 1, 2026: the enacting law says one section, the list of things the law doesn't restrict businesses from doing (Com. Law § 14-4712), has no effect on processing before this date.
• April 1, 2027: the cure period ends. For violations up to that date, the Consumer Protection Division may give a business at least 60 days to fix a problem before acting.

Why a company can say no

Some organizations and some data sit outside the law. State government bodies and political subdivisions are exempt, as are financial institutions covered by the Gramm-Leach-Bliley Act (GLBA) and registered securities and futures associations. Data covered by federal laws is exempt too, including HIPAA (health), the Fair Credit Reporting Act (credit reports), FERPA (school records) and the Driver's Privacy Protection Act. Employment records and data collected by insurance-regulated businesses in the business of insurance are also outside it.

So if a company tells you your data falls under the FCRA or GLBA, that's the likely reason it's declining. You can still appeal, and complain to the Consumer Protection Division if you think the refusal is wrong. Our guide on what to do when a company won't delete your account covers the next steps.

Where Serus fits

MODPA works one company at a time, and you first have to know which companies hold your data. Serus finds the data brokers that operate where you live, sends the deletion and opt-out requests for you, and checks whether your data shows up again. The steps above are free if you'd rather do them yourself.