Maryland Online Data Privacy Act (MODPA)
A practical compliance guide for website owners. Learn what Maryland's privacy law requires and how to implement it on your site.
Who Must Comply
Conducts business in Maryland or targets Maryland residents AND controls/processes personal data of 35K+ consumers (excl. payment transactions), OR controls/processes data of 10K+ consumers and derives 20%+ of gross revenue from selling personal data
What Your Website Must Do
| Requirement | Status |
|---|---|
| Cookie consent banner | Recommended |
| Do Not Sell link | Required |
| Do Not Share link | Required |
| Honor GPC browser signals | Required |
| Universal opt-out mechanism | Required |
| Sensitive data opt-in consent | Required |
Checked against the MODPA on August 29, 2026. Read the source This is a summary, not legal advice.
Required Links & Notices
The MODPA requires the following links or notices to be visible on your website:
- 1Do Not Sell or Share My Personal Data
- 2Privacy Policy
Enforcement & Penalties
Key Things to Know
The Maryland Online Data Privacy Act (MODPA) has applied in Maryland since October 1, 2025.
Who it covers: Conducts business in Maryland or targets Maryland residents AND controls/processes personal data of 35K+ consumers (excl. payment transactions), OR controls/processes data of 10K+ consumers and derives 20%+ of gross revenue from selling personal data.
Maryland is the strictest of the group on collection itself. It limits processing to what is reasonably necessary for the service the consumer asked for, rather than to whatever the privacy notice discloses.
Do Not Sell and opt-out rights: residents may opt out of the sale of their personal data and opt out of targeted advertising. MODPA expects the choice to be reachable from your site under the heading “Do Not Sell or Share My Personal Data”, and you may not degrade the service of someone who exercises it.
Global Privacy Control: MODPA requires you to honour a universal opt-out mechanism sent by the visitor’s browser. A GPC signal has to be treated as the opt-out itself — not as a request to show someone a banner — and it applies to that browser without any further action from the person.
Cookie banner: MODPA is an opt-out law, so it does not require the opt-in banner the GDPR does. What it does require is that the tracking you run for advertising can be switched off on request, which in practice means a preference control that actually blocks tags rather than a notice that only records a click. Sensitive data is the exception: that needs consent before you process it.
Recently amended. MODPA changed on July 1, 2026. The summary above reflects the amended law.
Enforcement: $10,000 per violation, $25,000 for subsequent violations. No cure period. Enforced by the Maryland Attorney General + Division of Consumer Protection.
How to Configure LegalBanner for MODPA
- 1
Create your site
Sign up for free and add your website domain in the dashboard.
- 2
Set consent mode to "Opt-out"
In Settings, select the consent mode that matches Maryland's requirements.
- 3
Install the snippet
Add the one-line script tag to your website. The banner, opt-out links, and GPC support are automatic.
- 4
Generate your Privacy Policy
Use the built-in policy wizard to generate a MODPA-compliant privacy policy.
Set up MODPA compliance in 5 minutes
LegalBanner handles Maryland privacy requirements automatically — cookie banner, opt-out links, and GPC support included.
Frequently Asked Questions
What makes Maryland's privacy law the strongest?
Maryland has no cure period (immediate enforcement), requires data minimization, prohibits sale of sensitive data entirely (not just opt-in), and has escalating penalties ($10K first, $25K subsequent). It is the most consumer-protective state privacy law.
What is the data minimization requirement?
Maryland requires businesses to collect only personal data that is 'reasonably necessary and proportionate' to the disclosed purpose. This is a higher standard than other states, which generally allow any collection with notice and opt-out.
When does the Maryland MODPA take effect?
The MODPA takes effect October 1, 2025.
Does Maryland require honoring GPC signals?
The MODPA does not explicitly require GPC support, but given the law's strict approach to data minimization, implementing GPC is strongly recommended.
What are the penalties for MODPA violations?
$10,000 per violation for first offenses, escalating to $25,000 for subsequent violations. There is no cure period — the AG can take immediate enforcement action.