Maryland Online Data Privacy Act (MODPA), Attorney General enforcement and cure period

Md. Code Ann., Com. Law §§ 14-4713, 14-4714

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 12 months, effective 1 October 2025.

An enforcement supervision rule binding private bodies.

As of 27 August 2026.

What it requires

Expect MODPA violations to be enforced exclusively by the Maryland Attorney General's Division of Consumer Protection under Title 13's unfair, abusive, or deceptive trade practice machinery, never by a private plaintiff. MODPA expressly excludes Title 13's private-action-for-damages provision, section 13-408, from its enforcement scheme.
Do not rely on an unconditional right to cure. The Division may, at its discretion, issue a notice of violation and give at least 60 days to cure only where it determines a cure is possible, and this mechanism applies only to a violation occurring on or before April 1, 2027.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A MODPA violation is an unfair, abusive, or deceptive trade practice enforced under the Maryland Consumer Protection Act's (Title 13) machinery, except that MODPA expressly excludes section 13-408, the Consumer Protection Act's private-action-for-damages provision, from its enforcement scheme, so a MODPA violation is not independently privately actionable through that route.

Section 14-4713(b) preserves any other remedy provided by law as a savings clause, not a grant of a private cause of action. Before initiating an enforcement action for a violation occurring on or before April 1, 2027, the Division of Consumer Protection may, in its discretion, issue a notice of violation where it determines a cure is possible, giving the controller or processor at least 60 days to cure; there is no unconditional right to cure, and this mechanism itself sunsets.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

official Maryland statute text, Commercial Law Article, Title 14 Subtitle 47, Maryland General Assembly statute lookup

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app