Maryland Privacy Compliance Checklist

Maryland Online Data Privacy Act — Step-by-step guide to compliance

Reviewed by PrivacyLawMap editorial teamLast verified: July 28, 2026

What is the MODPA compliance checklist?

The MODPA compliance checklist is a 13-step plan for meeting the Maryland Online Data Privacy Act (MODPA), Maryland's consumer privacy law, which took effect October 1, 2025. It is enforced by the Maryland Attorney General (Consumer Protection Division), with civil penalties up to $10,000 per violation and a 60-day cure period to fix violations before a fine. Work through every step below, then confirm your specific obligations with the free applicability calculator.

Compliance Steps

Effective: October 1, 2025 | Cure period: 60 days

1
Assess applicability — determine if, during the preceding calendar year, you controlled or processed data of 35,000+ Maryland consumers (excluding data used solely for payment transactions) OR 10,000+ Maryland consumers while deriving more than 20% of gross revenue from the sale of personal data. Unlike Virginia/Colorado/Connecticut, the MODPA has no standalone revenue threshold — small companies hit the 35,000-consumer trigger on their own.
2
Check exemption status at both the entity and data level — HIPAA-covered entities and business associates are exempt at the entity level; GLBA-regulated financial institutions receive an entity-level exemption; nonprofits, government entities, and higher-education institutions are exempt. Data-level exemptions cover HIPAA PHI, FCRA data, GLBA financial data, Driver's Privacy Protection Act data, and research data.
3
Conduct a data inventory and apply the MODPA data minimization standard — the standard is "reasonably necessary and proportionate" to the specific product or service the consumer requested, NOT to any disclosed business purpose. This is stricter than Virginia/Colorado/Connecticut. Eliminate any data collection that cannot be directly tied to the consumer's requested service, and document a proportionality justification for each data category retained.
4
Implement Global Privacy Control (GPC) recognition from day one — the MODPA requires businesses to honor universal opt-out signals for data sales and targeted advertising. Configure server-side detection (not just client-side), ensure signals propagate to downstream ad-tech and analytics vendors, test across Firefox/Brave/DuckDuckGo and the GPC browser extensions, and log GPC hits for AG audit defense.
5
Immediately cease all prohibited processing — do not sell sensitive data under any circumstance (not even with opt-in consent), do not sell precise geolocation data, and do not sell or use for targeted advertising the personal data of any consumer the controller knew or should have known was under 18. These are outright bans, not opt-in requirements.
6
Obtain explicit opt-in consent before collecting or processing sensitive personal data — Maryland's sensitive categories include racial/ethnic origin, religious beliefs, health diagnosis, sexual orientation, citizenship/immigration status, biometric data used for identification, genetic data, consumer health data, and precise geolocation (within 1,750-foot radius). Consent must be "freely given, specific, informed, and unambiguous" and cannot be obtained through dark patterns.
7
Update your privacy notice with all MODPA-required disclosures: categories of personal data collected and processed, purposes of processing, categories sold or shared for targeted advertising (or an affirmative statement that you do not sell or share), consumer rights and how to exercise them, a contact method, and an effective date. Post a conspicuous link titled "Your Maryland Privacy Choices" (or equivalent) from every page that collects data.
8
Build or update consumer rights intake mechanisms — controllers must respond to access, correction, deletion, portability, and opt-out requests within 45 days, with one 45-day extension permitted upon written notice to the consumer. Establish identity verification procedures proportionate to the request sensitivity, and document an appeal process with a 60-day response window.
9
Conduct and document Data Protection Assessments (DPAs) for high-risk processing activities — required for targeted advertising, sale of personal data, profiling that creates a reasonably foreseeable risk of harm, processing of sensitive data, and any processing that presents a heightened risk. DPAs must be retained and produced upon AG request.
10
Prepare for the April 1, 2027 cure period sunset — until April 1, 2027 the AG must offer a 60-day cure opportunity before seeking penalties. After that date, cure periods become entirely discretionary. Document every remediation step during any cure period in writing and retain for at least three years after the cure certification.
11
Implement processor/sub-processor contract updates — execute MODPA-compliant data processing agreements with every vendor, require flow-down obligations to sub-processors, mandate deletion/return of data at contract termination, and obtain audit rights. Maintain a current processor register.
12
If you operate as a data broker, comply with Maryland's separate data broker registration and transparency obligations layered on top of MODPA, including registration with the relevant state authority and publication of consumer rights disclosures.
13
Establish an ongoing MODPA compliance monitoring program — monthly GPC detection testing, quarterly privacy notice review, annual DPA refresh, employee privacy training, a documented complaint intake log, and an AG-inquiry response playbook. Maryland AG complaints typically arrive with a short response deadline once the cure period sunsets.

Key Enforcement Details

Enforced By

Maryland Attorney General (Consumer Protection Division)

Penalty / Violation

$10,000

Cure Period

60 days

Private Right of Action

Related Resources

Maryland Privacy Law — Full Guide
Compare Maryland with Other States
Maryland Enforcement Actions & Privacy Fines
2026-2027 Privacy Law Compliance Deadlines
All State Privacy Laws

MODPA Compliance Checklist FAQ

What is the MODPA compliance checklist?

It is a 13-step plan organizations use to meet the Maryland Online Data Privacy Act (MODPA), which took effect October 1, 2025. The steps below cover consumer-rights request handling, privacy-notice disclosures, opt-out mechanisms, data-processing agreements, and security safeguards required under Maryland law.

Who has to comply with the Maryland Online Data Privacy Act?

The MODPA generally applies to organizations that handle Maryland residents' personal data above the law's revenue and data-volume thresholds. Whether it applies to you depends on the specifics — check your exact obligations with the free applicability calculator at /calculator rather than assuming.

What is the penalty for MODPA non-compliance?

The Maryland Attorney General (Consumer Protection Division) can impose civil penalties of up to $10,000 per violation and a 60-day cure period to fix violations before a fine. There is no private right of action, so enforcement comes from the state, not individual lawsuits. Figures verified July 28, 2026.

Put MODPA Into Practice on Your SiteSponsored

Termly builds and maintains a Maryland-ready privacy policy, a consent banner that recognizes universal opt-out signals like GPC, opt-in consent capture for sensitive data, and a workflow for the access, deletion and correction requests MODPA grants.

Start Free with Termly

Does this law apply to you?

Use our free calculator to check if Maryland Online Data Privacy Act applies to your business.

Check Applicability

Official Resources

Maryland Attorney General Consumer Protection Division
MODPA Full Text — SB 541 (Maryland Legislature)
MODPA Companion Bill — HB 567 (Maryland Legislature)
Maryland Consumer Protection Act (MCPA)
File a Consumer Complaint with the Maryland AG
Attorney General Anthony G. Brown — Office Homepage