Maryland Online Data Privacy Act

Most state laws let you collect data if you disclose it. Maryland’s Online Data Privacy Act limits collection itself: personal data must be reasonably necessary and proportionate to what you provide, and sensitive data may be collected or shared only when strictly necessary for a product or service the consumer asked for. Selling sensitive data is banned outright, with no consent exception.

The law took effect on October 1, 2025. It applies to businesses that handled the personal data of 35,000 or more Maryland consumers (not counting payment-only data), or 10,000 or more while making more than 20% of gross revenue from selling personal data.

Nonprofits aren’t exempt, says the Attorney General, apart from narrow insurance-fraud and first-responder cases. Financial institutions under the Gramm-Leach-Bliley Act are exempt; HIPAA-protected health information is exempt, but not the rest of a health business’s data.

If you knew or should have known a consumer is under 18, you may not sell their personal data or use it for targeted advertising.

• Rights to confirm, access, correct, delete, get a portable copy, get a list of the categories of third parties, and opt out of targeted advertising, sale and profiling.
• Respond within 45 days, extendable by 45 more with notice. One free request every 12 months.
• Appeals: answer in writing within 60 days.
• Opt-out signals: since October 1, 2025, the law lists opting out through a signal the consumer turned on, such as Global Privacy Control, as a way to honor opt-outs. Honoring it is the safe course.

The Attorney General’s Consumer Protection Division enforces the law as an unfair, abusive or deceptive trade practice. Penalties are up to $10,000 per violation and $25,000 per repeat violation, plus restitution and other remedies. There’s no private right of action under this law. For violations on or before April 1, 2027, the Division may offer at least 60 days to cure, at its discretion.