Maryland Online Data Privacy Act (MODPA), sensitive data and biometric consent

Md. Code Ann., Com. Law §§ 14-4701(d), (gg), 14-4707(a)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 12 months, effective 1 October 2025.

A sensitive categories rule binding private bodies.

As of 27 August 2026.

What it requires

Do not collect, process, or share sensitive data, including genetic or biometric data, unless strictly necessary to provide a product or service the consumer requested. MODPA supplies no separate consent-only path around this necessity requirement.
Never sell sensitive data. MODPA bans the sale of sensitive data outright.
Treat an identifier your product derives from a public photo, video, or audio recording specifically to identify a person as covered biometric data, and therefore sensitive data, even though a bare photograph or recording by itself is excluded. The exclusion does not survive identification-purpose derivation.
Do not process a consumer's personal data for targeted advertising, or sell it, if you know or should know the consumer is under 18.

What it reaches

Excludes recording-derived identifiersNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

MODPA classifies genetic or biometric data, alongside racial or ethnic origin, religious belief, health data, sexuality, transgender or nonbinary status, national origin, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data.

A controller may not collect, process, or share sensitive data unless strictly necessary to provide a product or service the consumer requested, may never sell sensitive data, and may not process or sell a consumer's personal data for targeted advertising if it knew or should have known the consumer is under 18.

'Biometric data' means data from automatic measurement of a consumer's biological characteristics used to uniquely authenticate identity, including a fingerprint, voiceprint, or eye retina or iris image, and excludes a bare photograph or an audio or video recording, but claws that exclusion back the moment data generated from one is generated to identify a specific consumer.

When LexLint raises it

processes_biometrics
processes_voice
crawls_web
trains_models

Read the law

official Maryland statute text, Commercial Law Article, Title 14 Subtitle 47, Maryland General Assembly statute lookup

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app