Open workspace

Guide · US state law

MODPA: Maryland's law, the strictest in the US

The Maryland Online Data Privacy Act has applied since October 1, 2025 and is considered the strictest state law in the country. In this guide you will understand strict data minimization, the ban on selling sensitive data, the rules for people under 18 and what changes for a site with AdSense or Ad Manager.

Audit my site for the USRead the guide
  • ✓Based on the text of the law and the Maryland attorney general's website
  • ✓Practical examples for sites with ads
  • ✓Read-only scan, no changes to the site
35,000Maryland consumers per year: the main threshold of the law
10,000consumers are enough if more than 20% of gross revenue comes from selling data
$10,000maximum fine per violation
$25Kmaximum fine for a repeat violation

What it is

A law that changes the question from can they opt out to do you need to collect

The Maryland Online Data Privacy Act, or MODPA, is Maryland's general privacy law. It was passed in 2024 and took effect on October 1, 2025. The law itself says it does not reach data processing activities before April 1, 2026, the date from which enforcement gains strength.

The visitor's rights look like those in other states: access, correction, deletion, portability and opt-out of targeted advertising, sale and profiling. The difference is in the company's obligations. In most states, the site can use data until the visitor opts out. In Maryland, the collection must be necessary for the service the visitor asked for.

The law also prohibits the sale of sensitive data, with no consent exception, and limits the processing of such data to what is strictly necessary. For young people under 18, targeted advertising is prohibited when the company knew or should have known the age.

For a site with ads, Maryland is the state that demands the most review. Third-party scripts, the data they receive and the way health, finance or community sites handle sensitive information need to be looked at carefully.

Checklist

What you need to meet

If your site exceeds the MODPA thresholds, these points need to be working.

  1. Collect only what is needed

    Data collection must be reasonably necessary and proportionate to the product or service the visitor asked for.

    Example

    Before installing an ad script, note which data it receives and why the site needs it.

  2. Never sell sensitive data

    Selling sensitive data is prohibited. Collecting or sharing this data is only allowed when strictly necessary for the requested service.

  3. No targeted ads for under 18

    If you knew or should have known that the visitor is 13 to 17 years old, you cannot use their data for targeted advertising. Selling this data requires consent.

  4. Respect the universal opt-out signal

    Since October 1, 2025, the visitor can opt out of targeted advertising through a preference signal, such as GPC, and the site must respect it.

    Example

    Visitor with GPC turned on: the site turns on Google's restricted data processing for them only.

    <!-- AdSense: anúncio sem dados de comportamento -->
<ins class="adsbygoogle" ...
     data-restrict-data-processing="1"></ins>

// GPT (Ad Manager)
googletag.pubads().setPrivacySettings({
  'restrictDataProcessing': true
});

  5. Say clearly that there are targeted ads

    If the site sells data or does targeted advertising, it must say so clearly and visibly and explain how to opt out.

    Example

    We use your data for targeted ads. To opt out, click Do Not Sell or Share My Personal Information.

  6. Policy with the sentences Google requires

    AdSense requires the privacy policy to warn about the ad cookies of Google and other vendors. It must also say how the visitor opts out of personalized ads.

    Example

    Third-party vendors, including Google, use cookies to serve ads based on a user's previous visits to your website or other websites. You can opt out of personalized advertising in Google's Ads Settings.

  7. Secure channel for requests

    Offer a secure and reliable way to make rights requests. Do not require the visitor to create a new account.

  8. Risk assessment

    Before high-risk processing, such as targeted advertising, sale and sensitive data, do an assessment. Each risk algorithm must also be assessed.

In practice

Right and wrong

Official tools

Certified CMPs and official links

Google does not require a certified CMP or GPP for Maryland, so you can use Google's own message or a CMP with GPP.

Who must comply and definitions

MODPA thresholds and the law's key terms

The law applies to those who do business in Maryland or offer products and services directed to residents of the state and, in the prior calendar year, exceeded one of the thresholds below. Nonprofits have no general exemption, and processors working for covered companies also have duties.

35,000 consumers

Controlled or processed data of at least 35,000 Maryland consumers. Data used only to complete a payment does not count.

10,000 and data sales

Controlled or processed data of at least 10,000 consumers and earned more than 20% of gross revenue from selling personal data.

Sensitive data

Racial or ethnic origin, religious belief, consumer health data, sex life and sexual orientation, transgender or nonbinary status, national origin, immigration status, genetic or biometric data, children's data and precise geolocation.

Consumer health data

Personal data used to identify the person's physical or mental health condition, including data linked to gender-affirming care and reproductive or sexual health care.

Sale

The exchange of personal data for money or other valuable consideration. Transfers to processors and at the consumer's request are excluded.

Targeted advertising

An ad chosen with data obtained or inferred from the visitor's activity on other companies' sites and apps. Contextual ads, ads on the company's own site and performance measurement are not included.

Strict minimization

Only what is necessary for what the visitor asked for

The central rule of MODPA is minimization. The company can only collect personal data to the extent reasonably necessary and proportionate to provide or maintain a specific product or service the consumer asked for. It is not enough to state the purpose in the privacy policy, as in other states.

For sensitive data, the bar is higher. Collecting, processing or sharing sensitive data is only allowed when strictly necessary to provide or maintain the requested product or service. And selling sensitive data is prohibited, even with consent. The Maryland attorney general repeats both rules on its page about the law.

For people under 18, the law prohibits using data for targeted advertising when the company knew or should have known the age, and also restricts the sale of these young people's data. The should have known test is broader than the actual knowledge test used in other states.

In practice, a health site that lets ad scripts read each article's topic and pass it to partners, or a finance site that passes along a simulator's answers, needs to reassess this flow. Contextual ads and measurement without profiling remain possible.

People's rights

What the Maryland resident can ask for

The response must go out within 45 days, with a further 45-day extension if notified within the initial period. The first request in each 12 months is free, and an appeal needs a written response within 60 days.

Confirm and access

Find out whether the company processes their data and get access to that data.

Correct and delete

Correct wrong data and request deletion of personal data, with the law's exceptions.

Portability

Receive a portable copy of the data processed automatically.

List of third parties

Receive the list of categories of third parties that received their data, or all consumers' data, if the company does not record it per person.

Refuse targeted ads and sale

Ask that data not be used for targeted advertising and not be sold, including through a universal signal such as GPC or an authorized agent.

Opt out of profiling and withdraw consent

Opt out of certain automated profiling and withdraw consent given. After withdrawal, the company has up to 30 days to stop.

Site obligations

What a covered site must have working

  1. Full privacy noticeThe notice must include the categories of data processed, including sensitive, the purposes, how to exercise rights, appeal and withdraw consent, the categories of third parties and the type of business of each, the categories of data shared and an active email or other online contact.
  2. Disclose sale and targeted adsIf the site sells data, does targeted advertising or certain profiling, it must say so clearly and visibly and explain how to opt out.
  3. Accept the universal signalSince October 1, 2025, opt-out of sale and targeted advertising sent by a preference signal, such as GPC, must be accepted.
  4. Secure channel for requestsThe company offers a secure and reliable way to make requests and cannot require the consumer to create a new account.
  5. Assessment for each algorithmHigh-risk processing, such as targeted advertising, sale, sensitive data and certain profiling, requires regular assessment. The law also asks for an assessment of each algorithm used. The rule applies to processing from October 1, 2025.
  6. Contracts with processorsVendors that process data need a contract with instructions, type of data, duration, confidentiality, security, deletion or return and cooperation in assessments.

Enforcement and fines

Who enforces it and what a mistake costs

The law is enforced by the Consumer Protection Division of the Maryland attorney general. A violation is treated as an unfair, abusive or deceptive trade practice under the state's consumer protection law.

Up to $10,000 per violation

The fine can reach $10,000 per violation.

Up to $25,000 for repeat violations

Repeat violations can cost up to $25,000 each. The attorney general can also seek a court order, restitution and disgorgement of gains.

Optional cure period

For violations until April 1, 2027, the Division may give notice and allow at least 60 days to cure, if a cure is possible. This is its decision, not a guarantee.

Division criteria

To decide on the period, the Division considers the number of violations, the size of the company and whether the failure was human or technical, among other factors.

Timeline

The MODPA dates

As of November 2026, the law is in effect, reaches processing since April 2026 and still has the optional cure period.

  1. 2024

    Law passed

    Maryland passes the Online Data Privacy Act.

  2. October 1, 2025

    Entry into force

    The law takes effect, with a mandatory universal signal and assessments for processing started from this date.

  3. April 1, 2026

    Processing covered

    The law does not reach processing activities before this date, which marks the effective start of enforcement.

  4. April 1, 2027

    End of the optional cure period

    The period ends in which the Division can give at least 60 days to cure before acting.

Sites with AdSense and Ad Manager

Required GPC and the opt-out path to Google

Since October 1, 2025, a covered site must accept the opt-out of sale and targeted advertising sent by a preference signal, such as Global Privacy Control, or GPC. The mechanism cannot be on by default and must make it possible to confirm that the visitor lives in the state.

Google offers in AdSense and Ad Manager a US state regulations message, under Privacy & messaging, and Maryland is among the states covered. The message shows the Do Not Sell or Share link. The opt-out turns on restricted data processing, called RDP, and Google stops using previous behavior to choose ads.

On the GPC, Google says the partner that implemented the signal can choose to turn on RDP when it receives an opt-out GPC. The setup is up to the site or the CMP, and can be done in the tag, with the restrictDataProcessing parameter in GPT or the data-restrict-data-processing attribute in AdSense.

The IAB Tech Lab has already published a Maryland-specific GPP section, but it is not on the list of sections accepted by Google. For Google, the path is the US National section. Remember that the opt-out is only one part: in Maryland, minimization and the ban on selling sensitive data apply even to those who never opted out of anything.

In practice

What is and is not allowed in Maryland

Examples for a site with Maryland traffic that monetizes with programmatic ads.

Allowed

  • Showing contextual ads, chosen by the page subject
  • Apply the opt-out when the visitor's browser sends GPC
  • Passing the opt-out to Google through the GPP US National section or Google's message
  • Using health data provided by the visitor to deliver the service they asked for, if strictly necessary
  • Listing in the policy the business type of each category of third party, such as ad network or measurement

Not allowed

  • Selling precise geolocation or health data, even with consent
  • Showing targeted advertising to someone you know or should know is under 18
  • Passing to ad partners the health topic each visitor read
  • Collecting extra data in forms just because it might be useful someday
  • Ignoring GPC and continuing to request personalized ads

Common errors

Where sites stumble with MODPA

Settings that are enough in other states may not be enough in Maryland.

Thinking the opt-out solves everything

The site offers an opt-out, but keeps collecting data that is not necessary for the requested service. In Maryland, minimization applies to everyone.

Pixels on health pages

Ad and measurement scripts receive the address of articles about diseases or pregnancy. This can reveal consumer health data.

Sale of sensitive data with consent

The site asks for consent to pass precise geolocation to partners. In Maryland, this sale is prohibited even with consent.

Ignoring age signals

The site has content aimed at teens, but shows targeted advertising to everyone. The should have known test can weigh against it.

GPC only in California

The CMP applies GPC only for California and ignores the signal from Maryland visitors.

State section alone in the GPP

The CMP sends only the Maryland section, which Google does not read. Without US National, the opt-out does not reach Google.

In ConsentMode

What the audit checks for Maryland

  • Opens the site as a visitor from the United States and looks for the opt-out link in the footer, the menu and the privacy message.
  • Turns on the GPC signal in the audit browser and compares the page and the ad requests with and without the signal.
  • Reads the GPP string and checks that the US National section exists and records the opt-out.
  • Lists the scripts and partners that load on pages with sensitive topics, such as health and finance, and shows what is sent to them.
  • Checks whether the privacy page includes data categories, purposes, types of third parties, rights, appeal, consent withdrawal and contact.
Run an auditSee everything that is checked

Frequently asked questions

Why is Maryland called the strictest law?

Because, besides the opt-out, it limits collection to what is necessary for the requested service, prohibits selling sensitive data even with consent and prohibits targeted advertising to people under 18 when the company knew or should have known the age.

Can I keep personalized ads in Maryland?

The law does not prohibit targeted advertising to adults. The visitor can opt out, including through GPC, and collection must respect minimization. For people under 18, targeted advertising is prohibited when the company knew or should have known the age.

Do I have to honor the GPC?

Yes, if the law applies to your site. Since October 1, 2025, an opt-out sent by a preference signal must be accepted.

When did enforcement actually begin?

The law has applied since October 1, 2025, but does not reach processing activities before April 1, 2026. Until April 1, 2027, the Division can still offer a cure period, if it chooses.

My association is a nonprofit. Am I exempt?

Not necessarily. Maryland only exempts nonprofits that process data exclusively to help police with insurance fraud or first responders in disasters.

Does ConsentMode make my site compliant?

ConsentMode is not a CMP or a law firm. The audit shows what the site actually does with the opt-out, GPC, GPP, third-party scripts and the privacy page, so you can fix it with your provider and your lawyer.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See what your site hands over to partners in Maryland

The audit opens the site as a US visitor, with and without GPC, and shows what to fix, without changing anything.

Start the audit