If your team is grappling with privacy questions from product, engineering, or compliance departments, you're not alone. With Maryland's law in effect as of October 1st and three more states set for January 1st, 2026, operational questions are mounting quickly.
These questions arise from real implementation challenges. Your team needs to know whether to build state-specific logic, how often to update the privacy policy, and if the expanding rights landscape means offering universal access and correction. Here's what we're hearing from the field.
Can We Use Our California Privacy Policy for Maryland?
No, and here's why that's a mistake.
Maryland has specific content requirements for privacy policies, similar to other states with comprehensive laws. While there's overlap in core disclosures like categories of personal information collected and third-party sharing, the exact wording and structure requirements differ.
More importantly, you're at risk under deceptive trade practice laws if your policy is inaccurate or incomplete. Maryland's Attorney General can enforce these laws even if you're within the 60-day cure period for MODPA violations. Note that this cure period ends on April 1, 2027.
Set up a regular review schedule tied to your legal calendar. When a new state law takes effect, audit your policy against that state's requirements. If you're operating in multiple states, maintain a matrix that maps each disclosure requirement to the relevant policy section. This way, when you update one, you'll know which other states require similar language.
Should We Offer Access and Correction Rights to Everyone?
Probably, yes. Here's why many organizations are moving toward universal rights.
There are now 17 states (or 16, depending on how you count Florida) with comprehensive privacy laws. Indiana, Kentucky, and Rhode Island go live January 1st. Each grants access and correction rights, though the exact scope and timelines vary.
Building state-detection logic to determine who gets which rights creates ongoing technical debt. Every new state means updating geolocation rules, testing edge cases, and training your support team on request routing.
The operational cost of maintaining this patchwork often exceeds the cost of honoring access and correction requests universally. You'll need the infrastructure for states that require it, so extending it to all US residents simplifies your code, training, and customer communication.
One caveat: if you process large request volumes or have complex data architectures, run the numbers first. But for most organizations, universal rights are becoming the simpler path.
How Often Should We Update Our Privacy Policy?
At a minimum, review it every time a new state law takes effect that applies to your operations.
You also need to review whenever you change data practices, such as new third-party integrations, new categories of sensitive information collected, or changes to data sales or targeted advertising practices. If the policy doesn't match your operations, you're at risk under deceptive trade practice laws in every state where you do business.
Put it on a quarterly schedule. Assign someone to own the review, with input from legal, product, and engineering. Use a change log to track what shifted and why. When Maryland's law took effect on October 1st, did you verify your policy covered data minimization practices? What about your treatment of sensitive information under Maryland's definitions?
If you're waiting for a complaint to check your policy's accuracy, you've already missed the window.
What's the Deal with Data Minimization?
Data minimization means collecting and retaining only what's necessary for your disclosed purposes.
Maryland includes data minimization requirements, as do most other comprehensive state laws. The key question is: can you justify each data element you're collecting and each retention period you've set?
Start with your data inventory. For each category of personal information, document its specific purpose. If you can't articulate why you need it or you're keeping it "just in case," that's a red flag.
Then audit your retention schedules. Are you keeping customer data for seven years because that's your policy for financial records, even though the customer relationship ended after six months? That's likely not necessary.
This doesn't require aggressive deletion but intentional collection and defensible retention tied to business purposes. Document the reasoning. When a regulator asks why you kept something, "we always have" isn't an answer.
Are Cure Periods Enough to Keep Us Safe?
No. Cure periods help but don't cover all your risks.
Maryland's 60-day cure period ends April 1, 2027. Even while active, it only applies to MODPA violations. It doesn't protect you from deceptive trade practice claims, which can be brought by the Attorney General based on inaccurate privacy policies or misleading consent practices.
Not all privacy risks in the US stem from comprehensive state laws. There are sector-specific laws (health data, biometric data, children's privacy), federal laws (COPPA, FCRA), and common law claims (intrusion upon seclusion, breach of confidence). None of these come with cure periods.
Treat cure periods as a limited safety net for good-faith mistakes, not as a license to delay compliance. If you're relying on cure periods as your primary risk-mitigation strategy, your compliance posture is too reactive.
What Should Be on Our 2026 Privacy Roadmap?
Three priorities:
First, build a sustainable policy review process. Tie it to state law effective dates, product release cycles, and vendor contract renewals.
Second, decide your approach to consumer rights. Are you going state-by-state or universal? Make that call now, before Indiana, Kentucky, and Rhode Island go live. If you're going universal, you need time to build and test the infrastructure.
Third, audit your data minimization and sensitive data practices. The patchwork is getting more detailed on what counts as sensitive (biometric data, precise geolocation, health information) and what obligations attach. Map your current practices against the growing matrix of state requirements.
The growth of US privacy law isn't slowing down. The question isn't whether you'll need robust privacy operations, it's whether you'll build them proactively or reactively.
Where to Go for More
Track upcoming state law effective dates and specific requirements using a maintained state law tracker. When reviewing policy language or rights implementation, compare your approach against the specific statutory text, not summaries. If you're making build-versus-buy decisions on privacy infrastructure, factor in the ongoing maintenance cost of keeping up with this patchwork.
