What does "strictly necessary" mean for health data and advertising under Maryland's MODPA?

The test concerns a specific product or service and the consumer who requested it. The law separately bars sale of sensitive data. The text does not list consent as an exception to either of these limits. It also does not define the words strictly necessary. Chapter 874, § 14-4707(a)(1)–(2).

Chapter 455 enacted the original Act. The current codification uses sections 14-4701 through 14-4714. Chapter 874 amended definitions and other provisions, including the treatment of data revealing a listed attribute through inference. The current definition of sensitive data includes consumer health data. Chapter 455, § 1; Chapter 874, § 1, 14-4701(gg).

The applicability section sets thresholds based on the prior calendar year. Coverage also depends on exemptions for specified institutions and types of data, including some health and financial data. A team can map data to its source and custodian before discussing a threshold or exemption. Chapter 455, original §§ 14-4602 and 14-4603; Maryland Attorney General, MODPA FAQ on coverage and exemptions.

The targeted advertising definition has its own boundaries. It excludes ads based on the current context or activities within the controller’s own sites or apps. It also excludes ads responding to a request for information or feedback and processing solely to measure or report ad frequency, performance or reach. Those exclusions are part of a definition, while the sensitive-data restrictions appear in a separate provision. Chapter 874, § 14-4701(ii) and § 14-4707(a).

The Consumer Protection Division can enforce the subtitle. The original enactment gave the Division discretion to offer a cure before bringing an action, with at least sixty days when it offered one. The cure section applies to alleged violations occurring on or before 1 April 2027. Maryland Commercial Law § 14-4713; Maryland Commercial Law § 14-4714(a)–(c).

Where the readings collide. The parties might agree that the consumer requested reminders while disagreeing over whether measurement is part of delivery. The dispute may also concern whether a contextual placement uses sensitive data about a visitor at all. The words of the request and the actual fields can change both analyses.

• Which thresholds and exemptions apply to the business and the data?
• What did the person request, and where are the actual words recorded?
• Which fields about the consumer does each operation use?
• What do contracts and payment records say about each transfer?
• Does the audience include people under eighteen?
• Which other state laws cover the same data?

A description of the requested service can look different in a product brief and in the text a consumer sees. A saved version of the sign-up flow gives counsel both the exact words and the point at which the consumer acted. A data map then separates delivery of that request from optimization and reporting.

Consider an example in which someone asks to get reminders about a health topic. Delivering a reminder, testing subject lines across recipients and sending campaign metrics to another company are distinct operations. Evidence about what each operation needs can help counsel test the boundaries of the requested service.

A placement can use a page category alone or add a customer key so that a buyer can match prior activity. Both can be described as contextual in a campaign brief. The capture and destination list show which design actually runs, including what happens when the buyer returns a report. A consumer’s state can matter at several points in an advertising flow. A controller might determine state at account creation and later rely on a different location signal at delivery. A record of those decisions can help counsel assess which people and data were included, without assuming a device’s current location proves the consumer’s state.

A comparison can also distinguish features that deliver the service from features added for the business. A health newsletter may need an address to reach a subscriber. A report joining opens to visits on another site can serve a separate measurement goal. The fact sheet can record those purposes as distinct even if both are implemented by the same vendor.

A useful scope record names which data the institution believes is exempt and why. An organization may hold several categories of records about the same person, with different sources and conditions. The record can link the claimed exemption to the source and use of a field rather than to a general label for the organization.

A sale analysis can start with the actual parties and what they exchange. An invoice for a service, a contract describing a transfer and a dataset delivered to another business can show different parts of the arrangement. The parties’ description of an exchange can be compared with the purpose and payload counsel is assessing.

1. Does the Act apply to us and to this data, given its thresholds and exemptions?
2. What exactly did the consumer request, and can we evidence it?
3. Is each processing step needed to deliver that request, or only useful?
4. Does any transfer in the flow amount to a sale of sensitive data?
5. How do we treat measurement and frequency capping for Maryland consumers?
6. Has the Attorney General issued guidance or taken action since this page was checked?

Bring the fact sheet from the counsel briefing kit so that counsel answers your flow, not a generic one.

Download these questions

The business value may lie in reminding people who asked for a message, selling an audience to a merchant or measuring conversions. Those aims produce different arguments about what a service includes. A single audience label or consent record cannot show what value each step provides.

The reversal cost is also different across steps. Suppressing a rule at delivery time can be quick. Restricting a report after copies have gone to recipients can take longer and depend on contracts. A dated decision record can name both the intended benefit and which parts of the data flow would change if counsel revisits the reading.

Which option fits is a business decision taken with counsel. It depends on how much the program is worth to you, how much uncertainty you accept and who signs for it.

The Maryland Attorney General’s general FAQ describes coverage, exemptions, consumer rights and enforcement. The FAQ is distinct from an advertising-specific interpretation or a ruling on a particular flow. Chapter 874 changed the statute effective 1 July 2026. Maryland Attorney General, MODPA FAQ, checked 10 November 2026; Chapter 874, effective-date clause, checked 10 November 2026.

Related references

• ad tech compliance guide
• ad tech legal checkpoints index
• counsel briefing kit
• state health privacy reference
• HIPAA and advertising reference
• mhmda
• maryland modpa sensitive data advertising
• us state privacy laws tracker
• consumer health data
• contextual targeting

1. Maryland Commercial Law § 14-4707(a)(1). Checked 10 November 2026.
2. Maryland Commercial Law § 14-4707(a)(2). Checked 10 November 2026.
3. Maryland Commercial Law § 14-4701(gg)–(hh). Checked 10 November 2026.
4. Maryland Commercial Law § 14-4701(ii). Checked 10 November 2026.
5. Chapter 455, §§ 2 and 4. Checked 10 November 2026.
6. Chapter 874 of 2026, § 14-4701 definitions and amendments. Checked 10 November 2026.
7. Maryland Commercial Law § 14-4702, applicability. Checked 10 November 2026.
8. Maryland Commercial Law § 14-4703, exemptions. Checked 10 November 2026.
9. Maryland Commercial Law § 14-4713, enforcement. Checked 10 November 2026.
10. Maryland Commercial Law § 14-4714, cure. Checked 10 November 2026.