Maryland Online Data Privacy Act (MODPA), general applicability and controller/processor duties

Md. Code Ann., Com. Law §§ 14-4701, 14-4702 (Title 14, Subtitle 47)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 12 months, effective 1 October 2025.

A comprehensive regime rule binding private bodies.

As of 27 August 2026.

What it requires

Determine whether you conduct business in Maryland or target products or services to Maryland residents, and controlled or processed at least 35,000 consumers' personal data (excluding data processed solely to complete a payment transaction) or at least 10,000 consumers' personal data while deriving more than 20% of gross revenue from selling personal data, before treating MODPA as out of scope.
Treat Maryland's 35,000-consumer applicability floor as materially lower than many peer states' 100,000-consumer floor when deciding whether MODPA reaches your Maryland-facing processing.
Allocate controller duties (determining the purpose and means of processing) and processor duties (processing on a controller's behalf) correctly before assigning any of MODPA's other duties.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

MODPA governs private-sector processing of Maryland residents' personal data.

It applies to a person that conducts business in Maryland or targets products or services to Maryland residents and, in the preceding calendar year, either controlled or processed at least 35,000 consumers' personal data (excluding data processed solely to complete a payment transaction) or controlled or processed at least 10,000 consumers' personal data while deriving more than 20% of gross revenue from selling personal data.

MODPA carries no independent revenue threshold, and its 35,000-consumer floor is materially lower than many peer states' 100,000-consumer floor. A controller determines the purpose and means of processing; a processor processes on a controller's behalf.

When LexLint raises it

automated_outreach
crawls_web
deploys_chatbot
processes_biometrics
processes_voice
trains_models

Read the law

official Maryland statute text, Commercial Law Article, Title 14 Subtitle 47, Maryland General Assembly statute lookup

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app