Maryland Online Data Privacy Act
Data last verified: March 23, 2026
- Effective Date
- October 1, 2025
- Enforcement Date
- Not specified in statute
Summary
Maryland Online Data Privacy Act provides consumers the right to opt out of profiling for decisions with legal or similarly significant effects, requires data protection assessments, mandates privacy notice disclosure, and prohibits sale of sensitive data. Maryland has the most expansive biometric definition among state privacy laws (uses 'can be used' standard). 60-day cure period until April 1, 2027. Penalties via MD CPA § 13-410: up to $10K/violation, $25K repeat. Private right of action explicitly excluded (§ 13-408 carved out).
Who It Applies To
35K consumers OR 10K consumers + 20% revenue from data sales
- Min Consumers:
- 35,000
Any threshold triggers applicability
Penalties
- Penalty Range
- $0 – $10,000per violation
- Cure Period
- 60-day cure period
- Private Right of Action
- No private right of action
- Enforcement Body
- Maryland Attorney General Division of Consumer Protection
Requirements (5)
- Opt-Out§ 14-4605(B)(7)(III)
This law provides consumers the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.
- Impact Assessment§ 14-4610(A)-(B)
This law requires controllers to conduct data protection assessments for processing activities involving profiling, targeted advertising, sale of personal data, or sensitive data.
- Disclosure§ 14-4607(D)
This law requires controllers to provide a clear and accessible privacy notice disclosing data processing practices.
- Sharing Restriction§ 14-4607(A)(2)
This law prohibits the sale of sensitive data, including biometric identifiers. Maryland has the most expansive biometric definition among state privacy laws.
- Sharing Restriction§ 14-4604(3)
This law prohibits using a geofence within 1,750 feet of mental health or reproductive health facilities for collecting consumer health data.
Claire tracks 31 state and local AI laws across 23 US states. No prescriptive federal AI compliance statutes have been enacted. EU AI Act and sector-specific regulations are not covered.
Check if this law applies to your business