Maryland & Oregon Privacy Law Changes

What does this mean for DMOs who use Arrivalist’s location data to understand visitation?

Starting October 1, 2025, the Maryland Online Data Privacy Act (MODPA) will restrict Arrivalist’s ability to collect and process mobility data within Maryland for our location data providers. This means Arrivalist will no longer be able to include location data related to devices’ data collected in Maryland. For this date forward, Maryland will not appear as an origin market in our charts or maps. Since Maryland is a relatively small state in terms of population, this will result in an estimated reduction of 1.9% in total trips overall, per the US Census, which will vary greatly by the client’s proximity to Maryland. 

OCPA will go into effect in January 2026, but since it bans the sale rather than the collection of data, our providers are exploring options to provide some level of data but with reduced fidelity (“coarsening”) for directional use that is compliant with the new legislation. Arrivalist will keep clients informed of any anticipated impact.

Collection & purpose limitation: Both states require stronger purpose-limiting and data minimization practices — you should only collect location data that is necessary for the tourism/analytics purpose you state, retain it no longer than needed, and document that purpose. 

What Location Data Does Arrivalist Use?

Third-party mobile location datasets. Arrivalist licenses mobile location data (non-personally identifiable) from third-party providers. This includes information derived from devices, such as zip-level locations, which Arrivalist then aggregates for analytics purposes. Arrivalist uses anonymous data and aggregates that data, minimizing the risk of re-identification. We ensure our data de-identification meets the legal standard (documented technical controls and no reasonable linkability).

Aggregated device behavioral data. Arrivalist links exposures to marketing (e.g., ads) with changes in device location across places. For example:

“Device 12345 was exposed to Ad 1 and 2 in City A and moved to City B.”

Why This Matters: By handling data only at the state, DMA, and zip-level and aggregating across anonymized device IDs, Arrivalist reduces privacy risks while still delivering insights on visitor flows and marketing effectiveness.

Will my historic data for Maryland and Oregon be erased?

No, unless a full historic update will be initiated. Historic aggregate data will stay intact until it needs to be regenerated (Main Arrival Zone or Point of Interest change).

Will Arrivalist provide any predictive or modeled data for these states?

No, not for time periods after October 2025 for Maryland.

How will my Media Insights reporting be impacted?

For clients targeting Maryland and Oregon, you will see diminished ability to use movement data linking ad exposure to eventual arrival in your own destination. Clients should be aware that the Maryland and Oregon portion of DMAs that span multiple states will be impacted. The more your media mix is concentrated in these states, the less visibility you will have into performance using location data. Please see below on alternatives, such as tracking SpendLift using credit card data.

What are my alternatives to location data in Maryland and Oregon?

 Arrivalist offers a diverse portfolio of data sets spanning hotel, vacation rental, airline, and credit card transaction data. All are both anonymous and aggregated. 

For overall credit card spend data by origin state, DMA, and zip, your account manager can show you SpendInsights. Similar to location data, it shows origin markets to help support decisioning. 

For media effectiveness, Arrivalist offers SpendLift, which shows the total and incremental expenditure resulting from ad exposure. It also shows origin markets at the state, DMA, and zip* levels. Like our other data sets, it presents anonymous, aggregated, privacy-compliant data and insights.

To understand how Maryland and Oregon spend in your destination, you can set up a demo with your account manager.

Should we expect other states to pass similar legislation?

Yes. You should expect more states to follow Maryland and Oregon’s lead over the next 12–24 months. Here’s what’s happening:

Trend toward comprehensive state privacy laws: Since California’s CCPA took effect in 2020, over a dozen states (e.g., Colorado, Connecticut, Utah, Texas, Delaware, New Hampshire, New Jersey) have passed omnibus privacy laws. Each new wave tends to add stricter provisions, especially for sensitive data like precise geolocation.

Growing focus on location data: Legislators are responding to consumer and advocacy group pressure over location tracking, especially in contexts tied to health, religion, and children. Bills in states like Massachusetts, Illinois, and New York already propose prohibitions or opt-in requirements for certain location uses, similar to Oregon’s 2025 amendments.

“Patchwork” reality: With no federal privacy law passed yet, the U.S. is on a trajectory where 20–25 states could have their own frameworks by 2026, each with slightly different rules, definitions, and timelines. This will keep compliance complex, which means you’ll need partner that can flex to meet the most restrictive state standard where you operate or have visitors from.

What questions should I ask other providers in my stack or in my evaluation set? 

• How are the audiences you sell in compliance with the new law?

• How are you processing opt-out requests from consumers?

• Which of your datasets include residents of Maryland or Oregon?

• Do those datasets include precise location within ~1,750 feet?

• How do you handle data retention and deletion?

• Do you offer alternative products that shed light on Maryland or Oregon visitors to your destination?