Does the Maryland Online Data Privacy Act apply to your business?

Maryland's Online Data Privacy Act, known as MODPA, went into effect on October 1, 2025, and it is one of the stricter state privacy laws to reach the books. Two features set it apart: a low entry threshold, and a much shorter exemption list than most states offer. The result is that organizations other state laws would wave through, including many nonprofits and universities, can be fully covered in Maryland.

Who the Maryland Online Data Privacy Act covers

Under Commercial Law Section 14-4602, MODPA applies to a person that conducts business in Maryland, or provides products or services targeted to Maryland residents, and that during the immediately preceding calendar year controlled or processed the personal data of at least 35,000 consumers, excluding data used solely to complete a payment transaction, or at least 10,000 consumers while deriving more than 20 percent of gross revenue from selling personal data. The counts include only Maryland residents acting in a personal capacity.

Why the exemptions are narrower than usual

Most state privacy laws exempt nonprofit organizations and institutions of higher education outright. Maryland does not. Section 14-4603 carves out state bodies, national securities and futures associations, and GLBA financial institutions, and it exempts only nonprofits that process data solely to assist with detecting insurance fraud. That means a covered nonprofit or a university that meets the consumer thresholds is generally inside MODPA, which is a real departure from laws like Virginia's. MODPA also adds a strict data-minimization duty and tight limits on collecting and selling sensitive data.

When the obligations bite

The act took effect October 1, 2025, but it applies prospectively and does not reach data processing activities before April 1, 2026. In practice that gives covered businesses until that date to bring their notices, consent flows, and data-minimization practices into line before the substantive duties attach. The 35,000 and 10,000 figures match Delaware's Personal Data Privacy Act and Rhode Island's Data Transparency and Privacy Protection Act, so if you have mapped those you already know the volume test. The US state privacy laws hub shows the full comparison.

Next step

Maryland's low threshold, narrow exemptions, and data-minimization rules make it a law that catches businesses other states miss. The free 2-minute Obligation Scan runs the Section 14-4602 test against your business and flags MODPA's notice, consent, and minimization duties, so you can prepare before the obligations attach in April 2026.