Does Maryland's Online Data Privacy Act Ban the Sale of Sensitive Data?

Yes. Maryland's Online Data Privacy Act (MODPA), effective October 1, 2025, prohibits the sale of sensitive personal data outright — a stricter rule than any other state privacy law, since it applies even when the consumer has given consent, with only a narrow exception for data strictly necessary to provide something the consumer specifically requested.

What Counts as Sensitive Data Under MODPA

MODPA's sensitive data category covers the categories most state privacy laws recognize — health information, precise geolocation, biometric and genetic data, data revealing racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status — and Maryland additionally extends heightened protection to the personal data of consumers it defines as "known children," which the law sets at anyone under 18, a broader age band than the under-13 standard most other states use.

Why Consent Doesn't Unlock the Sale

Most other state privacy laws let a business sell sensitive data as long as the consumer opts in (Colorado's model) or at least gets a chance to opt out (closer to California's approach) — Maryland removed that lever entirely for the sale of sensitive data specifically. A signed consent form or an in-app opt-in flow that would satisfy Colorado's or California's rules does not create a legal basis to sell that same data to a third party under MODPA.

The One Narrow Exception

The ban isn't completely absolute: MODPA permits collecting, processing, or sharing sensitive data when doing so is strictly necessary to provide or maintain a specific product or service the consumer has requested. That's a necessity test tied to fulfilling the transaction itself, not a general business-purpose or marketing-optimization justification — it doesn't open a path to selling sensitive data for ad targeting or audience enrichment just because a consumer used the product.

How This Differs From Colorado and California

Colorado's privacy act lets controllers process and even sell sensitive data with the consumer's opt-in consent. California's framework generally lets businesses sell personal data, sensitive categories included, subject to the consumer's right to opt out or limit use. Maryland's MODPA breaks from both models by removing the sale option for sensitive data as a category, regardless of which consent mechanism a business offers.

What This Means for Data Minimization More Broadly

MODPA pairs the sale ban with a stricter data minimization standard than most states: processing of personal data generally has to be limited to what's reasonably necessary for the specific purpose disclosed to the consumer, not just avoid being "excessive." For marketing teams that enrich customer profiles with third-party sensitive-category data for targeting Maryland residents, that standard constrains both the sale and the broader collection of that data, not just the sale transaction.

Bottom Line

If sensitive personal data on Maryland residents touches your data-monetization or ad-targeting pipeline, treat it as unsellable under MODPA regardless of the consent mechanism you use, and limit any collection of it to what's strictly necessary to deliver the product or service the consumer asked for.

Sources: Hunton Andrews Kurth's analysis of Maryland's privacy bill and its broad application threshold, and legal reporting summarizing MODPA's October 1, 2025 effective date and its ban on selling sensitive data without a consent-based exception.