Governance, risk & compliance

Maryland Online Data Privacy Act of 2024 (MODPA) Comm. Law 14-4601 to 14-4614 (Ch. 455, 2024)

The Maryland Online Data Privacy Act of 2024 (Commercial Law 14-4601 to 14-4614, Chapter 455 of 2024, SB 541), effective 1 October 2025.

It applies to a person that does business in Maryland or targets Maryland residents and, in the prior calendar year, controlled or processed the personal data of at least 35,000 consumers (excluding payment-only data), or at least 10,000 consumers while earning more than 20% of gross revenue from sale. It is stricter than most state laws: a controller may collect, process or share sensitive data only where strictly necessary to provide a product or service the consumer asked for, may not sell sensitive data, must limit collection to what is reasonably necessary and proportionate, may not use or sell the data of a consumer it knew or should have known is under 18 for targeted advertising or sale, must honour an opt-out preference signal, and must assess each algorithm.

Nonprofits are generally not exempt. Consumer health data has its own rules, including a ban on a geofence within 1,750 feet of a mental or reproductive health facility.

The Division of Consumer Protection enforces it as an unfair, abusive or deceptive trade practice; there is no private action under the Act. A discretionary 60-day cure runs for violations on or before 1 April 2027.

Not verified: (1) The codified Annotated Code page could not be read; the text comes from enrolled Chapter 455 (strike-through removed by program, some word order jumbled). (2) Wording of the consumer health data sale rule in 14-4604 was garbled by amendment in the chapter; it is shown hedged.

(3) Title 13 civil penalty amounts were not read. (4) Whether 14-4612 (limitations) applies only from 1 April 2026 is taken from Section 2 of the chapter as printed; confirm in the codified text.

General information for compliance work, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Maryland Online Data Privacy Act of 2024 (MODPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Maryland Online Data Privacy Act of 2024 (MODPA) compliance

Most of Maryland Online Data Privacy Act of 2024 (MODPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Maryland Online Data Privacy Act of 2024 (MODPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Maryland Online Data Privacy Act of 2024 (MODPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Maryland Online Data Privacy Act of 2024 (MODPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.