MODPA requirements
Maryland's law, effective October 1, 2025 and applying to processing activities from April 1, 2026, is the strictest comprehensive state privacy law yet enacted. It imposes a data-minimization standard that limits collection to what is reasonably necessary for the product or service the consumer requested, prohibits the sale of sensitive data outright regardless of consent, and bans targeted advertising to anyone the controller knows or should know is under 18. The applicability threshold is 35,000 consumers. The Attorney General enforces, with a cure period through April 1, 2027. For advertising and analytics tags the question Maryland asks is not whether the consumer opted out but whether the collection was necessary in the first place, which few tag inventories were built to answer.
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.