AL-PDPA
Alabama Personal Data Protection Act
Alabama Attorney General
← Back to laws in United States
Maryland Online Data Privacy Act is part of the United States state privacy-law framework. It regulates covered processing of personal data about Maryland residents and must be assessed separately from federal sectoral laws and other states' statutes.
Effective status: October 1, 2025
Citation: Md. Code, Commercial Law ss. 14-4601 through 14-4614
Source basis: Maryland Chapter 455 of 2024 and the current Commercial Law provisions.
The Act applies to persons conducting business in Maryland or targeting Maryland residents that meet the statutory 35,000-consumer threshold or the lower threshold combined with more than 20 percent of gross revenue from sale. Exemptions are narrower than in several peer statutes.
Thresholds must be calculated using the law's defined consumer population and lookback period. Exemptions should be recorded at entity, data and processing-activity level; an exemption covering one regulated dataset should not automatically be applied to unrelated marketing, website, workforce or customer-support data.
Consumers may access, correct and delete personal data, obtain portable data, obtain a list of third parties to which data was disclosed and opt out of targeted advertising, sale and qualifying profiling. Appeals and authorized-agent opt-outs are required.
The operational workflow should authenticate requests without collecting excessive new data, meet the applicable response period, document extensions and denials, propagate deletion and opt-out decisions where required, and preserve evidence of the response and any appeal.
Controllers must limit collection to what is reasonably necessary and proportionate, restrict sensitive-data collection and sale, avoid discriminatory processing, publish notices, secure data, contract with processors and assess high-risk processing.
Processor agreements should identify instructions, purpose, duration, data types, confidentiality, subprocessor controls, deletion or return, audit information and assistance with rights, security, breach response and assessments to the extent required by the statute.
Maryland is stricter than the common state-law model. It limits collection rather than merely requiring disclosure, prohibits sale of sensitive data, limits sale of data to what is necessary to provide or maintain a requested product or service, and restricts targeted advertising to consumers known or reasonably known to be under 18.
The Maryland Attorney General enforces the Act through the Maryland Consumer Protection Act. A violation is an unfair, abusive or deceptive trade practice; the Act does not itself create a private right of action.
Maintain an applicability memorandum, data map, notice versions, request and appeal logs, consent and opt-out records, processor contracts, assessment records, security evidence and a dated record of the official statutory version used. Recheck the official legislature and regulator sources before each scheduled legal review.
Use a shared multi-state privacy operating model, but configure it for this law's exact scope, exemptions, rights, deadlines, consent rules, opt-out signals, assessment triggers and enforcement provisions. Do not substitute a generic US privacy checklist for the state-specific controls.
Alabama Attorney General
California Privacy Protection Agency
California Privacy Protection Agency
California Privacy Protection Agency
Federal Trade Commission
United States Department of Justice
Colorado Attorney General
U.S. Department of Health and Human Services, Office for Civil Rights
Connecticut Attorney General
Federal Trade Commission
Federal Communications Commission
Delaware Department of Justice
United States Department of Justice and federal courts
United States Department of Justice
Consumer Financial Protection Bureau
U.S. Department of Education, Student Privacy Policy Office
Federal Trade Commission
Florida Department of Legal Affairs
U.S. Equal Employment Opportunity Commission and federal health agencies
Federal Trade Commission
U.S. Department of Health and Human Services, Office for Civil Rights
U.S. Department of Health and Human Services Office for Civil Rights
Illinois Attorney General and private enforcement
Indiana Attorney General
Iowa Attorney General
Kentucky Attorney General
Louisiana Attorney General
Minnesota Attorney General
Montana Attorney General, Office of Consumer Protection
Nebraska Attorney General
Nevada Attorney General
New Hampshire Attorney General
New Jersey Attorney General and Division of Consumer Affairs
Oklahoma Attorney General
Oregon Attorney General
U.S. Department of Justice, Office of Privacy and Civil Liberties
Rhode Island Attorney General
Federal Communications Commission
Tennessee Attorney General
Texas Attorney General
Texas Attorney General
Utah Attorney General and Division of Consumer Protection
Vermont Attorney General
United States Department of Justice and federal courts
Virginia Attorney General
Washington Attorney General
Washington Attorney General