language: en · status: in-force · last checked: 2026-10-08

Maryland Online Data Privacy Act (MODPA)

Maryland's comprehensive consumer privacy statute, Commercial Law Title 14, Subtitle 47. It was enacted as the Maryland Online Data Privacy Act of 2024 (Chapters 454 and 455 of 2024, HB 567 and SB 541), which took effect October 1, 2025. The chapter law numbered the subtitle 14-4601 et seq.; it is codified as §§14-4701 to 14-4714. The act applies to a person that conducts business in Maryland or targets its residents and, in the preceding calendar year, controlled or processed the personal data of at least 35,000 consumers, or of 10,000 consumers while deriving more than 20% of its gross revenue from selling personal data (§14-4702). It sets consumer rights, controller duties, processor contract terms and data protection assessments. It is stricter than most state privacy laws on minors and sensitive data. The text here is the one in effect on 1 October 2026, which includes the 2026 amendments (Chapter 874, HB 711, effective July 1, 2026; Chapter 435, HB 264, effective October 1, 2026).

Applicability to EdTech

• Under-18s: no targeted advertising and no sale. A controller may not process a consumer's personal data for targeted advertising, or sell it, "if the controller knew or should have known that the consumer is under the age of 18 years" (§14-4707(a)(4), (a)(5)). There is no consent exception.
• A child's data is sensitive data, and sensitive data is "strictly necessary" only. Sensitive data includes "Personal data of a consumer that the controller knows or has reason to know is a child" (a child as COPPA defines one, §14-4701(f)). It also includes biometric data such as a voice print (§14-4701(d)) and precise geolocation (§14-4701(gg)(1)). Since 2026 it includes data a controller infers to indicate any of these ((gg)(2)). A controller may not collect, process or share sensitive data except where "strictly necessary to provide or maintain a specific product or service requested by the consumer", and may not sell it at all (§14-4707(a)(1)–(2)). Collection of any personal data is limited to what is "reasonably necessary and proportionate" to the requested product or service (§14-4707(b)(1)(i)).
• FERPA data is exempt, so the act reaches what a vendor holds outside FERPA. "Personal data regulated by the federal Family Educational Rights and Privacy Act" is exempt (§14-4703(b)(9)), and the act does not apply to a body or instrumentality "of the State or a political subdivision of the State" (§14-4703(a)(1)). The act still covers a vendor's own direct relationships, such as consumer accounts, marketing data, or data a parent or student supplies outside the school's control. COPPA-compliant verifiable parental consent satisfies the act's parental-consent obligations for a child (§14-4703(c)). A parent or guardian may exercise a child's consumer rights (§14-4705(d)(2)).
• Processors: the contract is prescribed. A controller using a processor must have a binding contract setting out instructions, nature and purpose, data types, duration and the parties' rights. The contract must require confidentiality, reasonable security, deletion or return at the end of service, information to demonstrate compliance, subcontracting only under a written flow-down after the controller can object, and cooperation with assessments (§14-4708(a)). The processor must assist with consumer requests, security and breach notification (§14-4708(b)). A processor that begins determining the purposes and means of processing becomes a controller for that processing (§14-4708(d)(4)).
• Data protection assessments are required for each processing activity with a heightened risk of harm, which includes processing sensitive data, targeted advertising, sale and risky profiling, "including an assessment for each algorithm that is used" (§14-4710(b), (a)).

Contents

Key obligations at a glance

• No targeted advertising to, and no sale of the data of, consumers known or who should be known to be under 18 — §14-4707(a)(4)–(5).
• Sensitive data (including a child's data) only where strictly necessary, and never sold — §14-4707(a)(1)–(2).
• Data minimisation and reasonable security — §14-4707(b)(1).
• Privacy notice content — §14-4707(d).
• Processor contract terms and processor duties — §14-4708.
• Data protection assessments for heightened-risk processing — §14-4710.

Enforcement

A violation is an unfair, abusive or deceptive trade practice under Title 13 of the Commercial Law Article and subject to its enforcement and penalty provisions, except §13-408 (§14-4713(a)). For alleged violations on or before April 1, 2027, the Consumer Protection Division may first issue a notice of violation with at least 60 days to cure (§14-4714). Under Section 2 of Chapter 454 of 2024, the act does not apply to processing activities before April 1, 2026 (Chapter 454 of 2024, uncodified).

Licence

The corpus reproduces Commercial Law §§14-4701 to 14-4714 verbatim from the Maryland General Assembly's Statutes Text pages (read 2026-10-08), which carry no copyright notice.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties."

Conditions: none attach to the statute text. The corpus still names the official source in its Sources section and in the fact document's {.meta} provenance lines. Its Meta section says what it changed: anchors added, whitespace collapsed, nothing reworded.

Related

• Maryland Kids Code (Com. Law §§14-4801 to 14-4813) — the companion children's design code, enacted the same year
• Maryland student data privacy (Educ. §4-131) — the operator statute for PreK-12 school purposes
• COPPA Rule (16 CFR Part 312) — the definition of "child" and the parental-consent standard this act defers to

Sources

• Maryland General Assembly — Statutes Text, Commercial Law §14-4701 (and the following sections to §14-4714), in the view of statutes in effect as of October 1, 2026
• Chapter 454 of 2024 (HB 567), Maryland Online Data Privacy Act of 2024 — enactment, effective date and the April 1, 2026 application date
• Chapter 874 of 2026 (HB 711) and Chapter 435 of 2026 (HB 264) — the 2026 amendments carried in the text