On April 6, 2024, the Maryland legislature passed the Maryland Online Data Privacy Act of 2024 (MODPA) (SB 541). The passage of this bill marks a significant shift in state privacy law landscape toward laws that meaningfully limit personal data collection and abuse. Should it be enacted, the law will come into effect on October 1, 2025.
Additionally, the Maryland Kids Code is planned to go into effect on October 1, 2024. This law would prohibit certain social media, video game and other online platforms from tracking people under 18 and from using manipulative techniques, such as auto-playing videos or displaying excessive notifications.
Scope of MODPA
Assuming this law goes into effect, Maryland will be the sixteenth state to pass broad consumer data privacy legislation. However, Maryland will be the first state to pass the Washington Privacy Act variant that contains unique provisions regarding data minimization, sensitive data, minor’s data privacy and unlawful discrimination.
The bill would apply to a person who conducts business in the State of Maryland or provides services or products that are targeted to residents of the State of Maryland who during the immediately preceding calendar year have met the criteria discussed in this article from Data Guidance.
The bill prohibits a person from:
- Granting employees or contractors permission to view consumer health data unless they are bound by a contractual or statutory obligation of confidentiality, or confidentiality is mandated as a term of their employment;
- allowing processors to access consumer health data unless both the provider and processor adhere to the regulations outlined in Section 14-4608 of the legislation; and
- employing a geofence to delineate a virtual perimeter within 1,750 feet of a mental health, reproductive, or sexual health facility.
Maryland Kids Code
The bill would apply to covered entities that provide an online product reasonably likely to be accessed by children. Covered entities, according to the bill, are defined as a sole proprietorship, limited liability company, corporation, association or any other legal entity that meet the criteria outlined in this article from Data Guidance.
The Maryland Kids Code will aim to help mitigate the tactics that are typically deployed to keep children glued to their screens and encourage them to remain online. It will also help ensure the content that children are seeing is age-appropriate, and make the online environment generally safer for them to navigate.
Reach out to an Advisor
Staying informed about these legislative developments is crucial for withstanding the intricate landscape of data privacy compliance.
As organizations grapple with the complex web of state and federal privacy regulations, the RCM&D Cyber Practice is committed to providing tailored solutions to mitigate risks and achieve compliance objectives. Reach out to a trusted advisor for more information on how the RCM&D Cyber Practice can support your organization’s privacy and security initiatives.
RCM&D’s Cyber Practice shares timely and pertinent information in the Cyber News Bytes newsletter, distributed bi-monthly.
