Maryland's New Privacy Regulation Sets A New Standard For Data Minimization

The Maryland Online Data Privacy Act (MODPA) raises the bar for data minimization in the United States, placing clear boundaries on how businesses may collect and process personal information. Unlike many other state privacy laws, MODPA ties data practices directly to consumer expectations, making it one of the most consumer-centric privacy frameworks in the country. Companies have recognized this and are now scrambling to make sure that they address these new requirements in a way that can be documented and shared if a regulator asks them to demonstrate compliance.

Consumer-Centric Scope

Under MODPA, businesses can collect and process only the personal data that is "reasonably necessary and proportionate" to provide or maintain a specific product or service explicitly requested by the consumer. This means companies cannot rely on broad consent or general business needs to justify excessive data collection.