Data Privacy in Maryland 

Online Protection Comes with Economic Burden

On October 1, 2025, the Maryland Online Data Privacy Act (MODPA) officially took effect, adding yet another layer to the rapidly evolving landscape of state-level data privacy laws across the country. For businesses and marketers — especially those operating near state borders like Purplegator in Delaware County, Pennsylvania (DELCO) — this law is more than just another compliance checkbox. With many of our clients located in Maryland, understanding how MODPA affects digital advertising, targeting strategies, and consumer engagement is critical. While protecting personal data is an important and understandable objective, the practical implications of this law will significantly reshape how businesses connect with Maryland consumers — and may have broader economic consequences than many residents may realize.

A Dizzying Landscape for Marketers

Across the United States, states are increasingly enacting their own comprehensive online privacy laws. States like California, Colorado, Oregon, Connecticut, and now Maryland have joined a growing list that give consumers rights to access, correct, delete, and port their personal data — and to opt out of targeted advertising and data sales. Maryland’s Online Data Privacy Act (MODPA) went into effect on October 1, 2025, with operational enforcement beginning in April 2026.

While consumer privacy protections are vital and desired by much of the public, the result for marketers who will actually attempt to follow the laws has been a patchwork of inconsistent regulations that vary by state and often conflict in their requirements. It is reminiscent of the hodgepodge of state laws that we need to navigate when it comes to sweepstakes! It’s enough to make a marketer cry for (gulp) federal legislation instead. 

• • Different thresholds for businesses to comply

• • Varying definitions of what constitutes “sensitive data”

• • Diverse rules on consumer rights and opt-out mechanisms

This inconsistent state-by-state regulatory environment makes it challenging for national and regional advertisers to build scalable, compliant marketing campaigns. Each state law requires its own compliance playbook, and what’s permitted in one state might be restricted in another.

For local businesses near state borders — like Purplegator in Delaware County, PA — this medley mishmash is especially problematic. It affects not only how to advertise within Maryland but also how to run campaigns that reach cross-border consumers without violating another state’s law.

This increasing complexity has a hidden cost: less effective advertising raises costs overall. If advertisers can’t precisely reach interested audiences, they must broaden targeting or over-invest to hit performance goals. As if tariffs aren’t enough already, ultimately higher advertising expenses get passed on to consumers, meaning everyday residents will pay more for goods and services as advertisers seek to cover new compliance burdens brought on by legislation that didn’t think of the economic impact of the new privacy laws. 

What Is the Maryland Online Data Privacy Act?

The Maryland Online Data Privacy Act (MODPA) is one of the newest — and in several respects one of the strictest — state consumer data privacy laws in the country. It applies to businesses that either:

• • Control or process the personal data of at least 35,000 Maryland residents per year (most other states set that threshold at 100,000 residents in an attempt to help struggling small businesses); or

• • Control or process the personal data of 10,000+ Maryland residents and derive 20% or more of revenue from the sale of personal data.

Core Rights for Consumers

Under MODPA, Maryland consumers gain:

• • The right to know what personal data is collected and how it’s used

• • The right to access, correct, or delete that data

• • The right to opt out of the sale or sharing of personal data

• • The right to opt out of profiling and targeted advertising based on personal data

• • Protections against discrimination for exercising rights under the law

Sensitive Data Rules

MODPA takes an especially stringent stance on sensitive personal data, which includes things like race, ethnicity, health status (including reproductive and gender-affirming care), sexual orientation, biometric data, and precise geolocation. Businesses are prohibited from collecting, processing, or sharing sensitive data unless it’s strictly necessary to provide a specific product or service requested by the consumer — a higher standard than similar laws in other states.

Minors and Teens

MODPA goes beyond many existing privacy laws in its treatment of minors’ data. It prohibits controllers from selling or processing personal data for targeted advertising if the business “knows or should have known” the consumer is under 18 years old. Historically, advertising has been restricted in targeting those under 13 via the Children’s Online Privacy Protection Act (COPPA), not 18. The new law was intended to protect teens online, but it also dramatically impacts marketing to an important age group in Maryland that is economically active, relevant, and influential.

Here’s where all marketers have a legitimate concern: while nearly everyone can agree that health data should be strongly protected — particularly given HIPAA’s framework — restrictions on teen targeting reach well beyond privacy and into decreasing legitimate economic participation. Maryland teens work, pay taxes, spend money, and are key audiences in sectors like video games, entertainment, retail, dining, and local services. Restricting advertising to this audience will unintentionally hamper Maryland businesses that rely on reaching these consumers.

Enforcement Challenges

While MODPA has teeth under Maryland’s Consumer Protection Act and the enforcement authority rests with the Maryland Attorney General, enforcement presents real, and seemingly insurmountable challenges:

• • Consumers generally have no visibility into the algorithms, bidding strategies, or data inputs that place ads in front of them.

• • Modern ad tech uses hundreds of signals to determine relevance — many of which are proprietary or obscured by platform terms.

• • It is virtually impossible for an average consumer — or even many marketers — to explain definitively why a specific ad was served or whether it violated the new statute.

In other words, compliance failures will simply be invisible and will not readily trigger regulatory scrutiny. 

Alternative Marketing Strategies for Maryland Audiences

With traditional strategies like geolocation targeting, geo-conquesting, and certain audience-level targeting becoming restricted under MODPA, marketers must, and will, adapt, even if it means increasing budgets that will ultimately hurt product and services sales and increase costs to the general public. 

Here are some compliant, effective alternatives that Purplegator is leveraging more in Maryland and in other states with similar restrictions:

Native Advertising

Native ad placements, also known as contextual targeting, are ads that match the look, feel, and content of the platform on which they appear — remain powerful and are increasing in use by savvy marketers. Because they’re contextually relevant instead of behaviorally targeted, they generally do not trigger sensitive data restrictions but can still reach Maryland consumers with engaging content that is more likely to result in a click or tap through that results in lead generation. 

Third-Party Data with Clear Consent

Third-party data obtained from data providers can still be used so long as you ensure it’s obtained and processed with clear consumer consent. We call this zero-party data and it can potentially be obtained from a data provider or from the advertiser itself.  Zero party data is information consumers willingly provide. It is, without a doubt, the strongest signal for relevance without privacy risk.

First-Party Data Assets

I know what you are thinking here. Isn’t the accumulation of first party data the whole basis of the Maryland law? Yes, and no. While first-party data is not automatically allowed under MODPA, when collected transparently, used for limited purposes, and aligned with consumer expectations, it is generally more compliant and less risky than relying on third-party behavioral targeting ecosystems. When used responsibly, limited to reasonable business purposes, and paired with proper disclosure and opt-out options, first-party data allows companies to maintain meaningful marketing efforts while staying within the framework of Maryland’s new privacy requirements.

Campaign Segmentation

Rather than demographic or age-based microtargeting, which is clearly restricted under MODPA, segmentation based on geography, interests discovered while on site, and transactional history can help businesses stay compliant and target valuable Maryland consumer segments. Of course, a business website will need a sizable amount of statistically significant data to make this effort worthwhile and profitable.

What Maryland Residents and Marketers Need to Know

While we understand that consumer privacy is important, restrictions on targeting will have three real consequences that Marylanders will recognize:

1. Higher Costs for Consumers

When online targeting techniques become less effective, advertisers must spend more to find interested buyers. Those increased costs don’t disappear — ultimately the consumer pays through higher prices, reduced offers, or more expensive services. Think tariffs. Eventually, the consumer pays. 

2. Impact on “Free” Media

Platforms like Facebook, Instagram, and free news sites are free because their business model is advertising-driven. If targeting becomes less efficient or more costly, that revenue model suffers as advertisers pull back due to increased costs and diminished return on investment. Reduced advertising effectiveness could mean platforms show more irrelevant ads, or put more content behind paywalls. Who pays for paywalls? You. The consumer.

3. Less Relevant Advertising for You

Relevance Raises Response. Receiving ads that are relevant — not random — benefits consumers. Think of how often irrelevant ads are served to you. You don’t drink alcohol, but you still get served that beer advertisement. That’s inefficient for the advertiser and annoying for the consumer. Effective, interest-based ads help brands serve consumers better, save money, and fund free services. So, please show me an ad for a new putter and not a feminine hygiene product. 

About the Author

Bob Bentz is president of Purplegator Marketing Agency & Consultants. He has worked in media, marketing, and advertising for over 4 decades and is a frequent contributor as a featured speaker at numerous trade shows and conferences including Social Fest and INTEGRATE. Bentz is the author of three books on marketing, including Relevance Raises Response. He has been an adjunct professor at the University of Denver for five years and he currently teaches a graduate level course at West Virginia University.