Maryland Online Data Privacy Act goes into effect this October

The Maryland Online Data Privacy Act of 2024 (MODPA), passed as House Bill 567 during the 2024 Legislative Session, will go into effect on October 1, 2025. Companies should start reviewing the requirements of MODPA now and preparing to comply by the October 1, 2025 effective date. MODPA introduces comprehensive online data privacy protections for Maryland residents and establishes substantial new compliance responsibilities for companies operating in Maryland that handle Maryland consumer personal data. You can view the final passed legislation here: 2025 Regular Session – House Bill 956 Chapter. The following is a non-comprehensive summary of several of the key components of MODPA. Impacted companies are encouraged to review the legislation in detail to ensure compliance by October 1.

MODPA applies to companies that conduct business in the State of Maryland or provide products or services that are targeted to Maryland residents, that: Controlled or processed the personal data of at least 35,000 consumers (excluding personal data controlled or processed solely to complete a payment transaction); or Controlled or processed the personal data of at least 10,000 consumers and derived more than 20% of its gross revenue from the sale of personal data.

MODPA is intended as a consumer protection bill and provides for several rights that consumers may exercise to protect their personal data. Under MODPA, consumers will now have the right to access their personal data, require the deletion of personal data, correct inaccuracies in personal data, opt out of processing of personal data for functions such as targeted advertising, and several other rights. MODPA also provides a right to consumers to obtain a list of the categories of third parties to which a controller has disclosed the consumer’s personal data.

MODPA also places many new requirements on the controllers and processors of consumer data, including the following:

• Data Protection Assessments: Controllers of consumer data are required to complete, “on a regular basis”, a data protection assessment (DPA) for each activity that presents a heightened risk of harm to a consumer, including an assessment for each algorithm used. The DPA requires an analysis of the potential risks to consumers and safeguards in place to mitigate those risks. Analysis is also required on the necessity and proportionality of processing in relation to the stated purpose of the processing, among other requirements.
• Data Minimization: Under MODPA, controllers of consumer data must “limit the collection of personal data to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer to whom the data pertains.” This data minimization standard differs from the standards adopted in other state online data privacy laws and therefore, depending on how it is implemented, may present unique compliance challenges.
• Notice Requirements: Controllers of consumer data are required to provide a consumer with a reasonably accessible, clear, and meaningful privacy notice that includes the categories of personal data processed by the controller and the controller’s purpose for processing personal data.

The Maryland Office of the Attorney General is responsible for enforcing compliance with MODPA, and violating the Act constitutes an unfair, abusive, or deceptive trade practice under the Maryland Consumer Protection Act. MODPA does not provide for a new private right of action to be brought by a consumer, but the law does not prevent a consumer from “pursuing any other remedy provided by law.” MODPA provides at least 60 days for an opportunity to cure a violation of the Act after a notice of violation.

Contact Drew Vetter (dvetter@smwpa.com or 410-244-7000) with any questions or for further information regarding the requirements of this legislation.