Maryland Online Data Privacy Act and MVA Updates

Below we have included reminders and updates that appeared in the most recent newsletter from Maryland MVA and have been included in full in case you missed them.  Before the MVA updates, however, we have included an overview of the Maryland Online Data Privacy Act (MODPA), how it could affect your dealership, and how it compares to its companion law in Virginia.

The Maryland Online Data Privacy Act (MODPA): What Dealers Need to Know

On October 1, 2025, the Maryland Online Data Privacy Act (MODPA) takes effect, making Maryland the latest state to enact a comprehensive consumer privacy law. With many area dealers operating in both Maryland and Virginia, it’s important to understand how MODPA compares to the Virginia Consumer Data Protection Act (VCDPA), which has been in effect since January 1, 2023.

Similarities to Virginia’s Law

Both MODPA and VCDPA create new rights for consumers and new compliance obligations for businesses. Dealers must be prepared to:

  • Provide consumers with the ability to access, correct, delete, and obtain a copy of their personal data.
  • Allow consumers to opt out of targeted advertising, the sale of personal data, or certain types of profiling.
  • Update privacy policies to clearly explain data collection and usage.
  • Implement reasonable data security practices.

Dealerships already in compliance with Virginia’s requirements will find some of the groundwork transferable to Maryland.

Key Differences Dealers Must Note

Despite the similarities, MODPA introduces important differences that may require additional adjustments:

  1. Scope of Coverage
    • Virginia: Applies to businesses that control or process the data of at least 100,000 consumers annually, or 25,000 consumers if they derive 50% of revenue from the sale of personal data.
    • Maryland: Applies to businesses that process the data of 35,000 consumers annually (with a carve-out for data processed solely for payment transactions), or 10,000 consumers if 20% of revenue comes from selling data.
      → Impact: MODPA applies to a broader range of businesses, including smaller dealerships that may not have been covered under Virginia’s law.
  1. Data Minimization & Storage Limits
    • MODPA places stronger restrictions on data minimization and storage, requiring that personal data collection be “reasonably necessary and proportionate” to the stated purpose and limiting storage to the shortest time reasonably needed.
  1. Sensitive Data Protections
    • MODPA requires opt-in consent before processing sensitive personal data (such as precise geolocation, biometric data, or children’s data). VCDPA requires opt-in consent for children’s data but is generally less restrictive.
  1. Enforcement & Penalties
    • Both laws are enforced by their respective state attorneys general. MODPA does not provide a private right of action but does authorize civil penalties of up to $10,000 per violation and $25,000 for repeat violations.

What Dealers Should Do Now

  • Audit your data practices to determine whether MODPA applies to your store.
  • Update privacy notices and consumer rights processes to reflect Maryland’s requirements.
  • Train staff on handling consumer data requests and recognizing sensitive data categories.
  • Coordinate compliance across stores if you operate in both Maryland and Virginia.

With MODPA’s October 1 effective date approaching, now is the time for dealerships to assess readiness. Those already compliant with VCDPA have a head start, but the differences in scope, consent requirements, and storage limits mean additional steps will be necessary. WANADA has prepared a compliance checklist to help you get started, which you can access here.  Please note that this checklist has not been reviewed by counsel, so any policies and procedures that you implement should always undergo a thorough legal review.

Maryland MVA Updates

Vehicle Services – Tips & Reminders

  • Please include a Transmittal Sheet (VR-205) with all uploaded transactions submitted through the MVA e-services business portal.
    • On the transmittal sheet, include the drawdown account and the courier that will pick up the work.
  • Vehicle transactions that were submitted through the MVA e-services business portal for pickup will be available at the chosen branch location up to 48 hours after the completion of the task and/or after the “Ready for Pickup” notification has been received.

Recent Bulletins

  • ERT Audit letter enhancement in the Business portal
    • The MVA has created a new report in the business portal to give the dealer community more visibility and control over the ERT audit letters they receive. Please review the linked bulletin that was issued August 12th.
  • Excise Tax credit for Plug-in electric or fuel cell vehicles
    • The MVA is notifying dealers the funds for the Electric Vehicle excise tax credit for fiscal year 2026 are depleted, but we are continuing to accept applications for the 2027 fiscal year. Please review the linked bulletin that was issued August 12th.
  • Reminder: Unused/Invalid Inventory
    • Please review this bulletin that describes the process to return any old, unused, invalid inventory to the MVA warehouse. Please review the linked bulletin that was issued August 22nd.
  • Bulletin-for-2025-Miscellaneous-Fee-Changes.pdf
    • The bulletin summarizes vehicle services and vehicle emissions fee increases due to updated regulations that took effect September 1, 2025. Please review the linked bulletin that was issued August 22nd.

If you have a topic, you’d like us to cover in a future newsletter, please send it to Kristin Orlando-Dillahunt at korlando@mdot.maryland.gov.

Download Bulletin PDF