What the Maryland Online Data Privacy Act means for you

The new Maryland privacy law – called the Maryland Online Data Privacy Act – passed in May 2024. Most of the law goes into effect October 1, 2025. A second part – the global opt-out mechanism – goes into effect April 2026.

What is the Maryland Online Data Privacy Act?

The Maryland Online Data Privacy Act is a consumer privacy law that puts meaningful limits on what data companies can collect about you and what they can do with it. Unlike in many other states, companies can only collect what data is actually necessary to deliver a service you’re expecting to get. No more fast food loyalty apps to collecting your location 24/7 or your VR game app collecting your social security number.  Even more importantly, the law bans companies from selling sensitive data, like information about your health or religious beliefs, to anyone.

This means the burden is not completely on you to protect your information.

What does the Maryland privacy law do for consumers?

In addition to putting good upfront rules on what data companies can collect in the first place, the Maryland privacy law also grants you some basic rights regarding your personal information:

• Right to Access: You can request a copy of the personal information businesses have collected about you.
• Right to Correct: You can request a business correct inaccuracies in the personal information it has collected about you. 
• Right to Delete: You can request a business delete the personal information it has collected about you. 
• Right to Opt Out: You can opt out of businesses selling your personal information to advertisers and other third parties.
• Right to request a list of specific third parties a company has shared your personal data with. Maryland is one of the few states with this right. It means you can access a concrete list of where you should submit deletion requests. 

Starting in April 2026, Maryland residents will gain another important protection: the ability to more easily opt-out of data collection and sales. You will be able to automatically tell websites you don’t want them to collect new personal data from you by downloading a tool called a universal opt-out mechanism.

What is a universal opt-out mechanism and how do I get it?

A universal opt-out mechanism is a piece of technology that helps you automatically opt-out of data collection online. Once you’ve downloaded the tool, the mechanism will broadcast to every site you visit that you don’t want your data collected or sold. That way you don’t have to individually contact every website you visit to opt out. 

You will, however, need to do a bit of work to get the tool working.

How to use the Global Privacy Control

The Global Privacy Control is currently the most widely recognized version of universal opt-out mechanism. There are a number of tools available that incorporate the Global Privacy Control (GPC).

Find your web browser below for our recommendations of tools that include GPC signals. 

Global Privacy Control in Google Chrome

To automatically opt-out of data collection on websites while using your Chrome browser, you need to download a special browser extension. You have a couple of options. 

• Our favorite is Privacy Badger made by our friends at Electronic Frontier Foundation. You can download Privacy Badger from the Chrome Web Store here. Once you download it, Privacy Badger will do the rest, and you shouldn’t have to take any more steps. We like this one because it has other privacy tools that will further protect your data built in, and it won’t disrupt your browsing experience.
• Another good option is DuckDuckGo Privacy Essentials. You can download DuckDuckGo Privacy Essentials from the Chrome Web Store here. In addition to using the GPC, this extension will change your default browser to DuckDuckGo. DuckDuckGo collects a lot less data about you than Chrome, but some people may not want to make the switch.

Global Privacy Control in Apple Safari

To automatically opt-out of data collection on websites in Safari, you need to download a special browser extension. Apple currently doesn’t allow our favorite tool – Privacy Badger – in Safari, but there is another option you can use.

• DuckDuckGo Privacy Essentials. You can download it from the Apple App Store here. In addition to using the GPC, this extension will change your default browser to DuckDuckGo. DuckDuckGo collects a lot less data about you than Safari, but some people may not want to make the switch.

Global Privacy Control in Microsoft Edge

To automatically opt-out of data collection on websites in Edge you’ll need to download a special browser extension. You have a couple of options:

• Our favorite is Privacy Badger made by our friends at Electronic Frontier Foundation. You can download Privacy Badger from the Microsoft store here. Once you download it, Privacy Badger should do the rest, and you shouldn’t have to take any more steps. We like this one because it has other privacy tools that will further protect your data built in. 
• Another good option is DuckDuckGo Privacy Essentials. You can download DuckDuckGo Privacy Essentials from the Microsoft store here. DuckDuckGo collects a lot less data about you than Edge, but some people may not want to make the switch. 

Global Privacy Control in Mozilla Firefox

Firefox is the only major browser that has a GPC signal built into it automatically, so you don’t have to download any special tools. But you do have to go turn it on.

How to enable GPC on Firefox

1. Make sure you have a recent version of Firefox. Firefox started carrying the GPC in November 2023. If you haven’t updated your browser since then, do that first.
2. In FireFox, click the menu button that’s 3 horizontal lines stacked on top of each other
3. Go to Privacy & Security
4. Scroll down to “Website Privacy Preferences”
5. Click “Tell websites not to sell or share my data”
6. Then close out of your Settings page. The change is saved automatically

The Global Privacy Control isn’t perfect – but it’s worth going ahead and downloading a universal opt-out mechanism now, even before companies are required to listen to opt-out signals in 2026.

How do I exercise my Maryland privacy law rights?

To exercise your other core rights – accessing, correcting or deleting the data a company has already collected on you – you must submit a request directly to each business. Companies must tell you how to send a request in their privacy policy.

Read: How to read a privacy policy

Where can I find instructions for exercising my rights in a privacy policy?

When looking at a privacy policy, search for a section titled “Your Privacy Rights,” “Your Rights and Choices,” or something similar. Use ctrl+f for the term “privacy”, “rights”, or “opt” to find this information more quickly. In this section, the business should give you instructions for how to access, correct, or delete your personal data. It will typically be a web form or an email address you need to send a request to.

If you run into problems during this process — like an invalid email address, or a web form where Maryland isn’t available in a dropdown menu — make sure to log a consumer complaint with the AG’s office. That way the AG knows which companies need a talking to.

What companies should I start with?

There are lots of companies that likely have your data. The worst actors are shadowy companies called data brokers that specialize in collecting, buying, combining, and reselling data that it bundles into profiles about you. They get data from all kinds of places and sell it to practically whomever is looking to buy. They’re terrible for your personal security.

We recommend starting with some of the biggest data brokers below. You can submit an access request if you want to see what data they have on you, or jump straight to deleting your data and opting out of future data collection.

Epsilon

Acxiom

LiveRamp

Oracle

How could the Maryland Online Data Privacy Act be better?

Maryland’s privacy law is pretty good – second only to California nationwide. It’s great that it moves more responsibility for data collection and use on companies automatically, so your information being protected isn’t dependent on you spending a lot of time exercising your rights.

There are things it could do better. For example, it’d be stronger and better for your privacy and security if the law banned companies from selling any of your information, and not just your sensitive data like about your health. It’d also be better if enforcement of the law didn’t reside solely with the Attorney General and instead allowed consumers to take companies to court for violating their privacy rights directly.

Still, Maryland residents are now some of the best protected in the nation. Other states should take the cue.

What else can I do to protect my data?

If you want to ensure that your data is as protected as possible, there are other steps you can take besides relying on your Maryland data rights. We’ve got simple ways you can boost your data security here.

See below for even more tips to put you more in control of your information online.

Social media privacy tips

How to request and download your Facebook data

How to request and download your Instagram data

Stop Instagram from harvesting so much of your data