Why Maryland Stands Out in the State Privacy Patchwork

Most US state privacy laws passed since 2021 follow a familiar template: a set of consumer rights, an opt-out for targeted advertising and sales, opt-in consent for sensitive data, and enforcement by the state attorney general. The Maryland Online Data Privacy Act (MODPA), signed in May 2024, borrows that template but tightens several of its key parts. For ad-supported publishers, the differences are not academic — they affect what you may collect, what you may never sell, and how you treat younger visitors.

The law took effect on October 1, 2025, and applies to personal data processing activities from April 1, 2026. If you have Maryland visitors, it is now part of your normal operating environment rather than a future item on the roadmap.

Who the Law Applies To

MODPA covers businesses that operate in Maryland or target products and services to Maryland residents and that, in the preceding calendar year, either:

• controlled or processed the personal data of at least 35,000 Maryland consumers (excluding data processed solely to complete a payment transaction), or
• controlled or processed the personal data of at least 10,000 consumers and derived more than 20% of gross revenue from the sale of personal data.

These thresholds are lower than those of many other states. Maryland has a population of roughly six million, so a mid-sized content site with national reach can cross the 35,000-consumer line through ordinary traffic, especially once cookie IDs and device identifiers are counted as personal data.

The Provisions That Matter Most to Publishers

Data minimisation tied to the service requested

Many state laws let a business collect whatever it discloses in its privacy notice. MODPA instead limits collection of personal data to what is reasonably necessary and proportionate to provide or maintain a product or service the consumer has requested. For sensitive data, the bar is higher: collection and processing must be strictly necessary for that purpose. In practice, this pushes publishers to justify each tag and data point against what the reader actually came for, rather than against what the notice happens to say.

No sale of sensitive data

Elsewhere, selling sensitive data usually requires opt-in consent. Maryland goes further and prohibits the sale of sensitive data outright. Sensitive data includes categories such as health information, precise geolocation, racial or ethnic origin, religious beliefs, sexual orientation, biometric and genetic data, and data of a consumer known to be a child. Health, wellness and local-news publishers should map which audience segments could be inferred from their content and make sure none of them flows to partners in a way that amounts to a sale.

Stricter rules for minors

MODPA prohibits selling personal data, or processing it for targeted advertising, when the business knew or should have known that the consumer is under 18. The “should have known” standard is broader than the actual-knowledge tests in many other states. Sites with teen-oriented content — gaming, homework help, music, sports — need a defensible approach to age signals and to which ad experiences those sections receive.

Opt-outs and universal signals

Consumers can opt out of targeted advertising, the sale of personal data, and certain profiling. Businesses must also honour universal opt-out mechanisms such as the Global Privacy Control browser signal. If your site does not yet read GPC and translate it into an opt-out for the relevant processing, Maryland is one more reason to close that gap.

Enforcement

MODPA is enforced by the Maryland Attorney General’s Consumer Protection Division. There is no private right of action under the act itself. For an initial period the Division may offer businesses an opportunity to cure a violation before taking action, but this is discretionary and temporary, so it is not a strategy to rely on.

A Practical Action Plan

1. Check the thresholds. Estimate Maryland reach from analytics and include device-level identifiers, not just logged-in users.
2. Run a minimisation review. List every tag, SDK and data field, and record which reader-requested service each one supports. Remove what you cannot justify.
3. Audit sensitive categories. Identify content verticals that could produce sensitive inferences and confirm those segments are never sold or shared for sale.
4. Review age signals. Decide how teen-heavy sections are handled and whether targeted advertising should be switched off there.
5. Wire up GPC and the opt-out link. Make sure a GPC signal or a click on your opt-out link is reflected in the signals sent to ad partners, for example through the IAB GPP string.
6. Update your privacy notice. Describe categories of data, purposes, third parties and how to exercise rights, in language a reader can follow.

How FlexyConsent Helps

FlexyConsent supports the IAB Global Privacy Platform (GPP) v1.1 with the US National section and 16 US state laws, so opt-out choices can be passed to your ad partners in the standard format they expect. The same banner, in 57 languages, can show different experiences to US, EU and other visitors, and every plan includes the full feature set, including the free plan.

Key Takeaways

• MODPA took effect on October 1, 2025, and applies to processing activities from April 1, 2026.
• Thresholds are low: 35,000 Maryland consumers, or 10,000 plus more than 20% of revenue from data sales.
• Collection is limited to what is reasonably necessary for the requested service, and strictly necessary for sensitive data.
• Sensitive data may not be sold at all, and under-18s may not be targeted when you knew or should have known their age.
• Honour universal opt-out signals such as GPC and pass opt-outs downstream through GPP.