Maryland
Maryland privacy law: the strictest test, on two different dates
Maryland's Act took effect October 1, 2025, but the same law says it may not be applied to processing activities before April 1, 2026. Its coverage thresholds are among the lowest in the country, and its cure right is both discretionary and time-limited.
At a glance
- Applies if
- You conduct business in Maryland or supply products or services targeted to Maryland residents and, during the preceding calendar year, you processed the personal data of at least 35,000 consumers (excluding consumers whose data was processed solely to complete a payment transaction); or at least 10,000 consumers and derived more than 20 percent of gross revenue from the sale of personal data (§14-4702). There is no standalone dollar-revenue threshold.
- Opt-out signal
- Consumers may designate an authorized agent through an internet link, a browser setting, a browser extension, a global device setting, or other similar technology, and you must comply where the consumer's identity and the agent's authority are established by commercially reasonable authentication (§14-4706(a)–(b)). The statute does not name one officially recognized signal.
- Response deadline
- Not later than 45 days after receipt, extendable by an additional 45 days when reasonably necessary with timely notice; the statute says days, not business days (§14-4705(e)(2), (f)). A response to an appeal is due not later than 60 days (§14-4705(f)).
- Right to cure
- Discretionary and time-limited. For an alleged violation occurring on or before April 1, 2027, the Division may issue a notice of violation if it determines a cure is possible, and you then have at least 60 days to cure; if you do not, the Division may bring an enforcement action (§14-4714(a)–(c)). Whether to grant the opportunity turns on the number of violations, your size and complexity, the nature of your processing, and the likelihood of injury (§14-4714(d)).
- Max penalty
- A fine not exceeding $10,000 for each violation; a merchant found in violation who then repeats the same violation faces up to $25,000 for each subsequent violation (§13-410(a)–(b)). Amounts are set by reference to severity, good faith, prior history, and deterrence (§13-410(d)).
- Consumer rights
- access · correction · deletion · portability of automatically processed data · categories of third-party recipients · opt out of sale · opt out of targeted advertising · opt out of profiling furthering solely-automated decisions with legal or similarly significant effects
Maryland Online Data Privacy Act, Md. Code, Com. Law §§14-4701–14-4714; 2024 Md. Laws ch. 454 — in force October 1, 2025.
Two dates, not one
The Act takes effect October 1, 2025, but the enacted chapter also states that it may not be applied to, or interpreted to have any effect on, personal data processing activities before April 1, 2026 (ch. 454, §§3–4). Treat the earlier date as the deadline to have mechanisms in place and the later date as the point where exposure becomes real.
A browser setting counts as a request
Maryland lets a consumer act through an internet link, browser setting, browser extension, global device setting, or similar technology, and requires you to honor it once identity and authority are established by commercially reasonable authentication (§14-4706(a)–(b)). Because no single signal is named, the practical test is whether a privacy-respecting browser arriving at your site can actually get its preference through.
You cannot make someone log in to opt out
The Act bars requiring a consumer to authenticate an opt-out request (§14-4705(e)(6)). A sale or targeted-advertising opt-out that sits behind an account wall is a defect on its face, and it is the kind of thing a scan catches in seconds.
What else Maryland requires
- Categories of third-party recipients on request (§14-4705(b)(6)).
- 45 days to respond, one 45-day extension with timely notice (§14-4705(e)(2)).
- An appeals process, with a decision not later than 60 days (§14-4705(f)).
Where Maryland sites usually break
The 35,000-consumer test is met by ordinary website traffic once payment-only records are excluded (§14-4702), so dealerships, retailers and e-commerce brands are covered sooner than they expect. Advertising pixels and lead transfers run into the sale and targeted-advertising opt-outs, and the no-authentication rule means those opt-outs have to be open to visitors who never signed up (§14-4705(b), (e)(6)).
The cure window is not promised
Maryland's cure right applies to violations on or before April 1, 2027, and only if the Division decides a cure is possible and chooses to offer it (§14-4714(a)–(b)). Finding and documenting a broken opt-out yourself, before a notice arrives, is the difference between a 60-day fix and an enforcement action.
Primary sources
- Maryland — 2024 Md. Laws ch. 454 (HB 567), Online Data Privacy Act of 2024, enacted text (PDF)
- Maryland Code, Com. Law §14-4702 — applicability
- Maryland Code, Com. Law §14-4705 — consumer rights, response deadlines, appeals
- Maryland Code, Com. Law §14-4706 — authorized agent, browser settings and similar technology
- Maryland Code, Com. Law §14-4714 — notice of violation and opportunity to cure
- Maryland Code, Com. Law §13-410 — fines for violations
Everproof provides compliance software and operations support. It is not a law firm and does not provide legal advice. Using Everproof does not guarantee compliance or prevent fines.