Maryland Online Data Privacy Act

Three things set Maryland apart

The Maryland Online Data Privacy Act is Chapter 455 of 2024 (Senate Bill 541), approved by the Governor on 9 May 2024 and in effect from 1 October 2025. Most of it reads like the Virginia family of laws: the same controller and processor roles, the same opt-outs, a 45-day request clock. Three provisions do not, and they are the ones that change what a product team may build.

The first two are the reason this law draws so much attention. Virginia, for one, lets a business process sensitive data once the consumer consents (§ 59.1-578(A)(5)). Maryland measures the data against the product the consumer asked for instead, and takes the sale of sensitive data off the table. The third is why it reaches firms that never cleared a 100,000 line anywhere else; the US state privacy laws table shows where it sits among the rest.

The chapter enacted the subtitle as §§ 14-4601 to 14-4614; the Commercial Law Article as posted today numbers the same sections 14-4701 to 14-4714, and this page cites the current numbers. Chapter text: Ch. 455 (S.B. 541).

The lower lines, and who counts toward them

The subtitle applies to a person that conducts business in Maryland or offers products or services targeted to its residents and, during the preceding calendar year, met one of two tests: ≥35,000 consumers (excl. payment-only); or ≥10,000 consumers + over 20% of gross revenue from sales. Here is the count that is enough on its own, beside the states this site covers in depth.

Who is a consumer

A consumer is “an individual who is a resident of the State” (§ 14-4701(h)). The definition leaves out anyone acting in a commercial or employment context, and anyone acting as an employee, owner, director, officer or contractor of a company, partnership, nonprofit or government unit whose dealings with you happen only in that role. A B2B tool counts the buyers at their desks as zero; the same firm’s newsletter sign-ups from home addresses count in full.

What sits outside

Two gaps matter more than the list. There is no general nonprofit exemption: a charity or association with a large Maryland supporter file is judged like a retailer. And the health exemption is for HIPAA protected health information, not for the clinic: whatever a practice holds that is not protected health information, often its newsletter and marketing lists, is not covered by that line. Full text: § 14-4703.

Data minimisation: two necessity tests

Data minimisation is not new: Virginia’s law has a clause too. What makes Maryland’s different is the yardstick. The collection limit for ordinary personal data and the stricter limit for sensitive data both measure the field against “a specific product or service requested by the consumer”, not against the purposes a business chose to list in its own privacy notice.

Under the Virginia wording, a business that discloses a purpose in its notice can usually collect what that purpose needs. In Maryland, a privacy notice cannot make a field necessary; only the product the consumer asked for can. Analytics, ad audiences and model training are usually purposes of the business rather than the product, so a field collected mainly for them has to be argued back to the product, and for sensitive data the bar is “strictly”.

Questions to put to every field

1. Which product or service did this consumer request? Name it; “our platform” is not specific.
2. Does that product work, or keep working, without this field? “Maintain” covers support, security and keeping an account running.
3. Is the field sensitive data under § 14-4701(gg)? If so, could you provide the product at all without it?
4. Write the answer down. For sensitive data it belongs in the data protection assessment § 14-4710 already requires.

The law does keep the usual room to work. Nothing in the subtitle restricts processing to prevent fraud and security incidents, defend legal claims, perform a contract with the consumer, or run internal operations the consumer would reasonably expect (§ 14-4712(a), (b)). But a business relying on one of those exceptions must be able to show it qualifies, and the data used must be “reasonably necessary and proportionate” to that purpose (§ 14-4712(f)–(g)). Text: § 14-4712.

Run each field through the tests

The worksheet below holds seven fields a small studio’s booking app really collects. Change what each is used for and the reading follows the statute: the collection limit for personal data, the strictly necessary bar for sensitive data, the sale ban, and the rules for anyone under 18.

Sensitive data, and the sale Maryland forbids

Maryland’s list of sensitive data is longer than most readers expect. It names status as transgender or nonbinary, national origin and citizenship or immigration status, and its health category covers any personal data a controller uses to identify a consumer’s physical or mental health status, not only records from a clinic.

What a sale is, and is not

A sale is the exchange of personal data by a controller, a processor or an affiliate “to a third party for monetary or other valuable consideration” (§ 14-4701(ff)(1)). Six disclosures are not sales: to your processor for its processing, to a third party to provide a product the consumer affirmatively requested, to your own affiliate, where the consumer directs it or uses you to interact with a third party, data the consumer made public through mass media without restricting the audience, and assets moving in a merger or acquisition (§ 14-4701(ff)(2)).

So a member asking the studio to send injury notes to a physiotherapist is not a sale. Handing the same notes to a supplement brand for a referral fee would be, and for sensitive data Maryland has no consent form that makes it lawful.

Three guardrails for consumer health data

• Staff and contractors may see consumer health data only under a contractual or statutory duty of confidentiality, or where confidentiality is a condition of employment (§ 14-4704(1)).
• A processor may see it only where both sides comply with the processor-contract rules in § 14-4708 (§ 14-4704(2)).
• No geofence within 1,750 feet of a mental health facility or a reproductive or sexual health facility to identify, track, collect data from or send a notification to a consumer about their health data (§ 14-4704(3)).

Under 18: no targeted ads, no sale

Two age rules run side by side. Data of a consumer the controller knows or has reason to know is a child, as COPPA defines one, is sensitive data and takes every rule above. Separately, for anyone under 18, a controller may not process personal data for targeted advertising, and may not sell it, where the controller “knew or should have known” the consumer’s age (§ 14-4707(a)(4)–(5)).

“Should have known” is the operative phrase. A teen yoga class, a school-year product, a birthday field or an audience segment built on age all put the knowledge in your own systems. Neither rule has a parental-consent route.

Seven rights and a 45-day file

Maryland gives consumers the rights a privacy lead will recognise from Virginia, plus one that Virginia’s list (§ 59.1-577(A)) does not carry: the categories of third parties their data went to (§ 14-4705(b)(6)).

The clock

The response clock is 45 days + 45: answer within 45 days of receipt, with one further 45 days where the complexity and number of the consumer’s requests make it reasonably necessary, provided you say so, and why, inside the first 45 (§ 14-4705(e)(2)).

The rules around the clock

• Free once in any 12 months. For requests that are manifestly unfounded, excessive, technically infeasible or repetitive you may charge a reasonable fee or decline, and the burden of showing it is yours (§ 14-4705(e)(4)).
• You may not make a consumer create a new account to use a right; you may ask them to use an existing one (§ 14-4707(f)(2)).
• Authenticate access, correction, deletion and portability requests with commercially reasonable efforts; you may not be required to authenticate an opt-out (§ 14-4705(e)(5)–(6)).
• A browser setting, extension or global device setting can act as the consumer’s authorised agent for opt-outs (§ 14-4706(a)(2)).
• For data you bought or received from elsewhere, a deletion can be met by keeping a record of the request and the minimum data needed to keep it deleted and unused (§ 14-4705(e)(7)).

The privacy notice, the link and the signal

The notice has to be reasonably accessible, clear and meaningful, and it has six required contents (§ 14-4707(d)). Two of them go further than the usual “categories of third parties”: the detail must let a reader understand what kind of business each recipient is, and the notice must carry a working contact route. The privacy policy checklist lists the GDPR and CCPA items a notice already carries; check the six Maryland contents against it.

If you sell personal data, run targeted advertising, or profile people toward decisions with legal or similarly significant effects, you must disclose that clearly and conspicuously, with how to opt out, and state in plain words whether the consumer’s information will be sold or shared with a third party (§ 14-4707(e)). The guide to the opt-out link covers wording and placement.

The link and the signal

Section 14-4707(f)(3) lists two methods a controller may use to take requests: a clear and conspicuous link to a page where a consumer, or their agent, can opt out of targeted advertising or sale, or an opt-out preference signal. It is a list of options, not a stand-alone duty to honour signals, and “on or before” gives the signal no clear start date. The whole clause reads:

In this site’s state table Maryland’s signal column reads “Optional method, not a stand-alone duty: a controller “may utilize” an opt-out link or a signal (“on or before 1 Oct 2025”), § 14-4707(f)(3)”. The statute sets conditions for the mechanism: easy for an average consumer, plain language, an affirmative and voluntary choice by the consumer, never on by default, and enough for you to tell whether the person is a Maryland resident making a real request (§ 14-4707(f)(4)–(5)). Two more clauses help in practice. Where a signal conflicts with an account setting or a loyalty programme the consumer joined, you may tell them and let them confirm (§ 14-4707(g)(1)). And “a controller that recognizes signals approved by other states shall be considered in compliance with this section” (§ 14-4707(g)(2)): Colorado’s Department of Law recognises Global Privacy Control.

Assessments for each algorithm, and the processor contract

A controller must conduct and document, on a regular basis, a data protection assessment for each processing activity that presents a heightened risk of harm, “including an assessment for each algorithm that is used” (§ 14-4710(b)). The last phrase is the one to plan for: a recommendation model, a lead score or an audience-matching tool each gets its own record. Four activities count as heightened risk.

Each assessment weighs the benefits to the controller, the consumer, others and the public against the risks to the consumer as reduced by safeguards, and against the necessity and proportionality of the processing for its stated purpose (§ 14-4710(c)(1)). That second limb ties the assessment back to the minimisation tests above. It must also factor in de-identified data, consumers’ reasonable expectations, the context, and your relationship with the consumer (§ 14-4710(c)(2)).

• The Division may require an assessment relevant to an investigation; it stays confidential and exempt from public-records requests (§ 14-4710(d)).
• One assessment may cover a comparable set of operations; one written for another law counts if reasonably similar in scope and effect (§ 14-4710(e)–(f)).
• The duty applies to processing on or after 1 October 2025, not to processing before it (§ 14-4710(h)).

The processor contract

Every processor works under a binding processor contract (§ 14-4708(a)). It must set out the instructions, the nature and purpose of processing, the type of data, the duration and both sides’ rights and obligations, and bind the processor to:

1. Put everyone who processes the data under a duty of confidentiality
2. Keep reasonable administrative, technical and physical security
3. Stop processing when you ask, in line with a consumer's authenticated request
4. Delete or return the data at the end of the service, unless the law requires retention
5. Give you the information needed to show compliance
6. Subcontract only after you can object, under a written contract carrying the same duties
7. Allow and cooperate with reasonable assessments of its policies and measures

A processor that starts deciding purposes and means of its own becomes a controller for that processing (§ 14-4708(d)(4)). Text: § 14-4708.

Enforcement, the cure window and the dates

A violation is an unfair, abusive or deceptive trade practice under Title 13, the Maryland Consumer Protection Act, and is subject to its enforcement and penalty provisions “except for § 13-408” (§ 14-4713(a)). Section 13-408 is the provision that lets any person sue for injury or loss under Title 13, so that route is carved out; the next subsection adds that the section “does not prevent a consumer from pursuing any other remedy provided by law” (§ 14-4713(b)). The enforcer is the Consumer Protection Division, Office of the AG.

Title 13’s civil penalty is up to $10,000 for each violation, and up to $25,000 for each repeat of a violation already found (§ 13-410).

On 1 April 2026: in the chapter as signed, § 14-4612 is the section listing what the subtitle does not restrict (legal compliance, fraud and security, internal operations). Read Section 2 of the chapter with counsel before relying on that date for anything else.

Questions