December 2, 2022

Volume XII, Number 336


December 01, 2022

Subscribe to Latest Legal News and Analysis

November 30, 2022

Subscribe to Latest Legal News and Analysis

November 29, 2022

Subscribe to Latest Legal News and Analysis

Maine’s New Internet Privacy Law: What You Need to Know

Last week, Maine enacted an internet privacy law requiring broadband internet service providers (ISPs) to obtain a customer’s express, affirmative consent before using their personal information, including browsing history. As the first state to enact such a law, Maine has generated national headlines. But the new law reflects growing interest among state legislatures around the country in protecting the privacy rights of consumers in today’s digital world, given the lack of a comprehensive federal data protection law.

What does the new law do?

The new law, An Act To Protect the Privacy of Online Customer Information (LD 946, to be codified at 35-A M.R.S. c. 94), prohibits ISPs from using, disclosing, selling, or permitting access to the vast majority of the information generated by a customer’s use of internet service. The Act protects a customer’s web browsing history, application usage history, precise geolocation information, device identifiers, the origin and destination internet protocol addresses, personal identifying information, and the content of a customer’s communications.

Before an ISP may use, disclose, sell, or permit access to this customer information, it must obtain the customer’s “express, affirmative consent.” So, rather than giving customers the right to opt out of having their data utilized, the Act prohibits ISPs from utilizing customers’ data unless and until a customer consents.

The Act requires ISPs to provide customers a “clear, conspicuous and nondeceptive notice” of the ISP’s obligations and the customer’s rights.

The Act also prohibits ISPs from refusing to serve customers who withhold consent, and bans ISPs from offering financial or other incentives for customers to opt-in. The Act also requires ISPs to take “reasonable measures” to protect customer information from unauthorized use (i.e., being hacked and stolen).

Notably, the Act applies only to ISPs, but not to other internet actors that collect and use customer information, such as search engines and social networks.

The law resembles regulations that the Federal Communications Commission implemented in 2016. In 2017, however, Congress overturned those regulations, spurring a number of state legislatures, including Maine’s, to explore their own internet privacy rules.

What does the new law mean for businesses that operate in Maine?

The Act only regulates Maine’s approximately 80 broadband internet service providers, and applies only to ISPs serving customers “that are physically located and billed for service received in the State.” 

How will the new law be enforced?

Oddly, the Act is silent as to who will enforce the law on behalf of Maine customers or what penalties apply for noncompliance. The Legislature considered, but failed to pass, an amendment that would have placed enforcement authority with the Office of the Maine Attorney General and authorized funds to hire enforcement staff.

The new law is being incorporated into the title of the Maine Revised Statutes that govern public utilities, but neither the Act itself nor existing statutes explicitly authorize the Maine Public Utilities Commission to enforce it.

Nor does the Act specifically authorize lawsuits by internet users against ISPs that fail to comply. Maine courts could read the Act to implicitly create a private cause of action against ISPs, or to provide the standard of care for a negligence claim based on breach of the Act’s requirements. However, unless and until a Maine court affirmatively decides that the Act so creates a private cause of action, this possibility remains theoretical.

What happens now?

The law takes effect on July 1, 2020.

There are at least two grounds on which the law may be susceptible to legal challenges. First, the law may be challenged on the grounds that it imposes unlawful discriminatory restrictions on the ISPs’ First Amendment rights to engage in commercial speech. Second, the law may be preempted by federal law, which also closely regulates telecommunications.

We are not aware of any legal challenges yet filed. In written comments to the Legislature in support of the Act, the Maine attorney general stated that his office believes the law is legally defensible and would vigorously defend it on behalf of Maine’s consumers.

A number of other states have considered, but failed to enact, similar legislation. California recently enacted a sweeping consumer privacy law that applies to a broad swath of for-profit businesses, including ISPs, but the California law provides that ISPs (and other covered businesses) may allow customers to opt out of allowing utilization of their data, rather than require customers to affirmatively opt-in to allowing utilization of such data, as Maine does.

©2022 Pierce Atwood LLP. All rights reserved.National Law Review, Volume IX, Number 165

About this Author

Peter J. Guffin data and privacy lawyer Pierce Atwood

As chair of Pierce Atwood’s Privacy & Data Security practice, Peter Guffin combines extensive experience in intellectual property, information technology, privacy and data protection law, with a practical appreciation of the business and legal imperatives that can determine a client's success.

Areas of focus include:

  • Information Privacy and Cybersecurity
  • Breach Preparedness, Response, Investigation, and Communication
  • Risk Management, Governance, and Compliance

Peter represents businesses and organizations across a...

(207) 791-1199
Kyle M. Noonan, Pierce Atwood Lawyer Maine Litigation

Kyle Noonan is an associate in Pierce Atwood’s Litigation Practice Group. He represents clients in complex commercial litigation, including class actions, as well as regulatory investigations. Kyle’s clients include companies in the finance, health care, construction, forest products, and telecommunications industries.

Prior to joining Pierce Atwood, Kyle worked for several years in the Washington, D.C. office of a large multinational law firm. Before law school, he worked for U.S. Representative Tom Allen of Maine. Kyle is a member of the Conservation Committee of the Sebago...