Maryland Online Data Privacy Act

One of the strictest state laws: no revenue threshold. Applies at 35,000+ Maryland consumers (excluding payment-only data), or 10,000+ if 20%+ of revenue comes from selling personal data, plus a near-ban on selling sensitive data and a data-minimization-first approach. Notably has no broad nonprofit exemption (only insurance-fraud/first-responder nonprofits), no higher-education exemption, and its HIPAA exemption covers PHI data only, not the whole entity. A 2026 amendment (HB 711, effective Jul 1, 2026) restricted selling personal data to government entities that within the preceding six months engaged in or supported civil immigration enforcement, expanded "precise geolocation data" to cover information identifying a consumer, mobile device, or vehicle within a 1,750-foot radius, and expanded sensitive data to include characteristics a controller infers. (Note: many secondary sources incorrectly cite this as §§14-4601 et seq. — that section is an unrelated Forensic Nurse Examiner Training Grant Program provision; the correct MODPA codification is §14-4701 et seq.)