Maryland Online Data Privacy Act (MODPA) and sensitive data: what advertisers can and cannot do

What changed. Chapter 874 of 2026 (HB 711) took effect on 1 July 2026 (Maryland General Assembly, HB 711). It renamed the listed traits "sensitive attributes" and added that the definition includes data a controller infers that, "alone or in combination with other data, is used to indicate" any of them. It then defined sensitive data as personal data that includes a sensitive attribute "or any other personal data processed for the purpose of identifying a sensitive attribute" (Chapter 874, 14-4701(gg)-(hh)).

It also extended "precise geolocation data" to the location of "a mobile device, or a vehicle" within 1,750 feet (Chapter 874, 14-4701(x)). Other sections added limits on selling data for immigration enforcement. The bill record says it was "Enacted under Article II, Section 17(c) of the Maryland Constitution".

Why it matters for ads. Before July 2026, a company could argue that an interest segment such as "researching arthritis care" was not data "revealing" a health status. The new text reaches data inferred from behaviour and any data processed to identify a health trait. That describes how most health interest segments are built.

On 9 November 2026 the statute database still displayed the pre-amendment definition. The chapter text is the source this page relies on for the amendment.

What the statute says. A controller may not collect, process or share sensitive data except where it is "strictly necessary to provide or maintain a specific product or service requested by the consumer to whom the personal data pertains" (14-4707(a)(1)). The statute does not define "strictly necessary". Consent appears elsewhere in 14-4707, for new purposes and revocation, but not as an alternative in paragraph (a)(1).

Each row below applies the text to a common use. The last column is a reading of the text, not a ruling.

Targeted advertising, defined. The term covers ads "displayed to a consumer or on a device identified by a unique identifier", selected from activity across unaffiliated sites or apps. It excludes ads based on the current page or search, ads based on activity within the controller's own sites, and processing solely to measure frequency, performance or reach (14-4701(hh)). That exclusion for measurement does not lift the separate limit on sensitive data.

Minors. A controller may not process personal data for targeted advertising, or sell it, if it "knew or should have known" the consumer is under 18 (14-4707(a)(4)-(5)).

What practitioners do (practice, not law). Many advertisers treat Maryland residents as excluded from health-interest and health-lookalike audiences and serve them contextual targeting instead. Some move health measurement into a clean room that returns only aggregates.

Even outside sensitive data, a controller must "limit the collection of personal data to what is reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer" (14-4707(b)(1)(i)). Using data for a purpose that is neither reasonably necessary to, nor compatible with, the disclosed purposes needs consent (14-4707(a)(8)).

Controllers that sell data or run targeted ads must disclose it clearly and explain the opt-out (14-4707(e)). The text provides for opt-out preference signals from 1 October 2025 (14-4707(f)(3)). Targeted advertising, sales and sensitive data processing each need a documented data protection assessment (14-4710).

What the statute says. Section 14-4704 binds any "person", not only controllers that meet the thresholds. A person may not use a geofence "within 1,750 feet of any mental health facility or reproductive or sexual health facility" for listed purposes (14-4704(3)). The purposes are to identify, track, collect data from or notify a consumer about the consumer's health data. A covered facility is one where at least 70% of services are mental health, or reproductive or sexual health, care (14-4701(v) and (ee)).

The same section requires confidentiality duties for staff and contractors with access to consumer health data. It also bars giving a processor access unless both sides comply with the processor contract rules in 14-4708.

Thresholds. The act applies to a person that does business in Maryland, or targets its residents, and in the prior year handled personal data of at least 35,000 consumers. It also applies at 10,000 consumers where more than 20% of gross revenue came from selling personal data (14-4702). Data handled only to complete payments does not count toward the first threshold. A consumer is a Maryland resident (14-4701(h)).

Exemptions. Financial institutions and their affiliates under GLBA are exempt as entities. Protected health information under HIPAA is exempt as data, not the covered entity itself (14-4703). A hospital's marketing data that is not PHI, such as website analytics, can therefore fall under MODPA. PHI itself follows the HIPAA marketing rule.

Retail media. A pharmacy chain's front-store loyalty data is personal data; its prescription data may be PHI. Any segment that reveals or infers a health trait is sensitive data under MODPA. The pharmacy retail media guide covers how networks separate those sources.

The statute. A violation is an unfair, abusive or deceptive trade practice under Title 13. It is subject to Title 13's enforcement and penalty provisions "except for § 13-408", the private damages action (14-4713). The section adds that it "does not prevent a consumer from pursuing any other remedy provided by law". Title 13 sets civil penalties of up to $10,000 per violation and $25,000 for each repeat (13-410).

The cure period. For violations occurring on or before 1 April 2027, the Consumer Protection Division "may" issue a notice of violation where it finds a cure possible, with at least 60 days to cure (14-4714). The cure is discretionary.

What enforcers have done. We found no public MODPA enforcement action as of 9 November 2026.

Connecticut keeps a consent route for the same data; compare Connecticut's consumer health data rules. California offers a right to limit instead; see California CMIA and CCPA health data rules. The ad tech compliance hub lists the federal and state pages together.

1. Maryland General Assembly, SB 541 (2024 Regular Session), Maryland Online Data Privacy Act of 2024, bill record (Chapter 455, effective 1 October 2025). https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541?ys=2024RS
2. Maryland General Assembly, Chapter 455 of 2024 (text, including uncodified Sections 2 to 4). https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_455_sb0541e.pdf
3. Maryland Code, Commercial Law 14-4701, Definitions (statute database), checked 9 November 2026. https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4701&enactments=false
4. Maryland Code, Commercial Law 14-4702, Applicability. https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4702&enactments=false
5. Maryland Code, Commercial Law 14-4703, Exemptions. https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4703&enactments=false
6. Maryland Code, Commercial Law 14-4704, Consumer health data and geofencing. https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4704&enactments=false
7. Maryland Code, Commercial Law 14-4707, Controller duties. https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4707&enactments=false
8. Maryland Code, Commercial Law 14-4708, Processor contracts. https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4708&enactments=false
9. Maryland Code, Commercial Law 14-4710, Data protection assessments. https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4710&enactments=false
10. Maryland Code, Commercial Law 14-4713, Enforcement. https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4713&enactments=false