On October 1, Maryland’s law may be the last US state comprehensive privacy law to take effect in 2025, but it certainly is not least. While the Maryland Online Data Privacy Act of 2024 (MODPA) mirrors existing US state comprehensive privacy laws in many ways, certain key differences may pose unusual and operational challenges for businesses subject to the law, some of which we outline below.

1. Lower thresholds and narrower exemptions

MODPA applies to persons that do business in Maryland or target products/services to Maryland residents, and that, during the prior calendar year, either controlled or processed the personal data of at least 35,000 Maryland residents or controlled or processed the personal data of at least 10,000 Maryland residents and derived more than 20% of their gross

See Full Page