Maryland's Online Data Privacy Act took effect October 1, 2025 and reaches processing from April 1, 2026. It applies to a site that controls or processes the personal data of 35,000 or more Maryland consumers a year (not counting data handled only to complete a payment), or 10,000 or more while taking over 20% of its gross revenue from selling personal data. It is one of the strictest in the country.
Data revealing a person's sex life or sexual orientation is sensitive - on an adult site, a viewing history, a favourites list, a chosen category. Maryland lets a site collect or process it only when strictly necessary to provide or maintain a product or service the consumer specifically asked for - consent is not enough on its own. And it bans the sale of sensitive data outright, with or without consent. A field that fails that test comes out; a field is retired with the day, never erased.