Quick answer
If you live in Maryland, you can ask covered companies to delete the personal information they have about you, and they must respond within 45 days. Send your request through the company's privacy form or privacy email, and keep a record of when you sent it.
Your rights under the MODPA
The Maryland Online Data Privacy Act (MODPA) gives Maryland residents the right to:
- Find out what personal information a company has about you
- Have it deleted
- Correct information that's wrong
- Get a copy of your data in a usable format
- Opt out of targeted advertising, the sale of your data, and certain kinds of profiling
What makes Maryland's law stand out
Most state privacy laws let companies collect whatever they want as long as they disclose it. Maryland goes further: companies may only collect personal information that's reasonably necessary for the service you asked for. The law also prohibits selling sensitive information, such as health or precise location data, subject to its definitions and exceptions.
It also reaches more companies than most states, because it applies to businesses with as few as 35,000 Maryland customers.
Which companies have to comply
Companies doing business in Maryland that handle the personal information of at least 35,000 Maryland residents a year (not counting information used only to process a payment), or at least 10,000 residents if they make more than 20% of their revenue from selling personal information.
That covers most large retailers, streaming services, apps, and online platforms, but not every small business. Certain health, financial, credit-reporting, and other regulated information is exempt when it's covered by specified federal or state laws, and companies can keep data they're legally required to retain.
How to ask a company to delete your data
- Find the company's privacy policy, usually linked at the bottom of its website. Look for a privacy request form or a privacy email address.
- Ask the company to delete your personal information, and say that you're a Maryland resident making the request under the MODPA.
- Expect the company to verify your identity, often by email. That's normal, and it protects you from someone else deleting or requesting your data.
- Write down the date you sent the request. You'll need it if the company misses its deadline.
How long companies have to respond
Companies must respond within 45 days. They can take up to 45 more days when reasonably necessary, as long as they tell you.
If a company ignores or refuses your request
If a company refuses your request, it has to offer a way to appeal. If the appeal is denied too, you can file a complaint with the Maryland Attorney General's Consumer Protection Division.
Make your requests in minutes, not evenings
The hard part isn't the law. It's knowing which companies have your data and writing to each one. DataTrail scans your inbox (read-only) to find every company that has your email address, writes a deletion request that cites the MODPA, and tracks the 45-day deadline for you. You review each one and send it from your own email.
Join the waitlistEnforced by the Maryland Attorney General. This page is general information, not legal advice, and laws change. For the official text, see Maryland's state legislature or Attorney General website.