Law / United States / 
Maryland
Maryland Online Data Privacy Act (MODPA), sensitive data and biometric consent
Md. Code Ann., Com. Law §§ 14-4701(d), (gg), (hh), 14-4707(a)
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Do not collect, process, or share sensitive data, including genetic or biometric data, unless strictly necessary to provide a product or service the consumer requested. MODPA supplies no separate consent-only path around this necessity requirement.NIST Privacy FrameworkCT.PO-P1
- Never sell sensitive data. MODPA bans the sale of sensitive data outright.NIST Privacy FrameworkCT.PO-P1
- Treat an identifier your product derives from a public photo, video, or audio recording specifically to identify a person as covered biometric data, and therefore sensitive data, even though a bare photograph or recording by itself is excluded. The exclusion does not survive identification-purpose derivation.
- Do not process a consumer's personal data for targeted advertising, or sell it, if you know or should know the consumer is under 18.NIST Privacy FrameworkCT.PO-P1
- Do not sell a Maryland consumer's personal data if you know or should know the purchaser seeks to use it for immigration enforcement, and do not knowingly sell it to a federal, State, or local governmental unit that engaged in or supported civil immigration enforcement through personnel or material resources in the preceding six months.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Maryland (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx
- Guidance body
- Office of the Attorney General of Maryland
- Open questions
- What must a controller show for collecting, processing or sharing biometric data to be 'strictly necessary to provide or maintain a specific product or service requested by the consumer' under § 14-4707(a)(1), and is that measured by the reasonable-consumer-expectations test the Attorney General states for 'reasonably necessary and proportionate'?
- Does a face template computed from a photograph for a purpose other than recognizing the person, such as sorting images by similarity, count as data 'generated to identify a specific consumer' under § 14-4701(d)(3)(iii)?
What it makes you log
Logging duty
The cited definitions (biometric data, sensitive data, targeted advertising) and section 14-4707(a) restrict what a controller may do with sensitive data and other personal data, and subsections (b) to (g) add data minimization, security practices, a revocation mechanism, a privacy notice and opt-out methods. None requires a log, register or consent record. The processing of sensitive data is one of the activities that triggers a documented data protection assessment under section 14-4710, which this row does not cite, so no assessment is coded. The cited provisions carry no scope clause; the applicability test is in section 14-4702, which the row does not cite, so the hook is left empty.
- Kind
- None
- As of
What this law does
MODPA classifies genetic or biometric data, alongside racial or ethnic origin, religious belief, health data, sexuality, transgender or nonbinary status, national origin, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data.
A controller may not collect, process, or share sensitive data unless strictly necessary to provide a product or service the consumer requested, may never sell sensitive data, and may not process or sell a consumer's personal data for targeted advertising if it knew or should have known the consumer is under 18.
'Biometric data' means data from automatic measurement of a consumer's biological characteristics used to uniquely authenticate identity, including a fingerprint, voiceprint, or eye retina or iris image, and excludes a bare photograph or an audio or video recording, but claws that exclusion back the moment data generated from one is generated to identify a specific consumer.
Since , sensitive data also includes data a controller infers from personal data when that inferred data indicates a sensitive attribute, and it means personal data that includes a sensitive attribute or any other personal data processed to identify one.
A controller also may not sell a consumer's personal data if it knew or should have known that the purchaser seeks to use it for immigration enforcement, and may not knowingly sell it to a federal, State, or local governmental unit that, within the preceding six months, engaged in or supported civil immigration enforcement through personnel or material resources. These changes were made by Chapter 874 of the Acts of 2026 (House Bill 711), which took effect .
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .