Posted: June 28, 2019
On June 6th, 2019, Maine governor Janet Mills signed LD 946 into law, taking into effect July 1, 2020. LD 946, also known as “An Act to Protect the Privacy of Online Customer Information,” the bill prevents internet providers from using, disclosing, selling or permitting access to customer personal information to advertisers without “express, affirmative consent” from the consumers allowing such use.
Providers may use and sell consumer private internet data that does not contain personal information. However, the customer can provide written notice notifying the provider that the customer does not permit the provider to such use. Additionally, the provider is not allowed to refuse to serve the customer or charge the customer a penalty or offer the customer a discount based on if the customer does or does not consent to the use of their data.
In 2017, President Trump’s FCC chair Ajit Pai nullified a similar law introduced during President Obama’s term that proposed to block ISPs from selling customers’ internet use without explicit consent. Maine’s new internet privacy law restores these privacy protections and is similar to the California Consumer Privacy Act (“CCPA”). The difference between the CCPA and LD 946 is that in California, it is an opt-out rule and in Maine, it is opt in.
US Telecom, a telecoms lobby consisting of telecom giants such as AT&T, Verizon, and Comcast, has objected to Maine’s law in fear the creation of a “patchwork” of laws regulating ISPs actions. They claim that consumers will not know what the rules are, because, “consumers are constantly buying internet connections in different states and relying on the rules from the last state to be in effect.
Following the State Senate’s unanimous 35-0 pass on the bill, Oamshri Amarasingham, advocacy director at the ACLU of Maine, made a statement praising lawmakers for passing the bill, that “. . .Today, the Maine legislature did what the U.S. Congress has thus far failed to do and voted to put consumer privacy before corporate profits.”
While is it unclear whether industry groups will be successful in challenging LD 946, the law is certain to have implications beyond the state of Maine and throughout the United States. The law could serve as a template for other states’ data privacy initiatives as well as a template for Congress.
A full draft of the ruling can be found here.
Matt Dumiak is Director of Privacy Services, Customer Engagement Compliance at CompliancePoint focused on U.S. and international direct marketing compliance regulations. He works with clients in a variety of industries and is dedicated to providing reliable and practical consulting services. Matt has earned a Certified Information Privacy Professional (CIPP/US) certification from the International Association of Privacy Professionals (IAPP), a Customer Engagement Compliance Professional (CECP) certification from the Professional Association for Customer Engagement (PACE), and has a B.S. in Economics from Georgia College.