States are taking online consumer protection into their own hands given a perceived lack of sufficient protection at the federal level. Maine now has jumped in.
Indeed, Janet Mills, the Governor of Maine, just signed into law arguably one of the strongest privacy bills in the country. This law, called the Act to Protect the Privacy of Online Consumer Information and which goes into effect on July 1, prohibits internet service providers from using, selling, or distributing data from consumers without obtaining their consent. And, according to The Hill, this new state law bars internet service providers from refusing to serve consumers, penalizing consumers or offering them discounts to seek to gain their permission to sell their data.
Consumer Affairs and Privacy
This bold step by Maine follows in the footsteps of California, a state which passed a complicated online privacy law last year. That law has been both applauded by privacy activists and criticized in certain respects by the tech industry.
At first blush, the new Maine law may be even more robust than the California law. The Maine law is opt-in in nature, requiring explicit consent from consumers before internet service providers can sell their data. The California law is opt-out in effect, making consumers affirmatively request that their data not be sold.
So, what is the genesis of the Maine law? It seems patterned after a prior Federal Communications measure — a measure that was removed by the Trump administration in 2017. Perhaps it is because of this nullification that states are entering the fray to seek greater consumer protection.
This is reminiscent of when states passed laws dealing unsolicited commercial email before Congress enacted the Can-Spam Act at the federal level. It also is a reminder of the various state laws addressing data breach notifications.
Legislative Patchwork and Protection
The creation of a patchwork of different state laws is not necessarily ideal. It is difficult for internet service providers to know how to guide their practices, when their customers are located in various states with different laws.
When in doubt, in such a context, internet service providers arguably would be best served by honoring the dictates of the state with the most strict law on the books — to make sure that they are not violating any law. If they are complying with the strictest law, they then also should in compliance with more permissive laws in other states. (Internet service providers obviously should seek specific legal advice from skilled counsel).
A strict law in just one state, even a small state like Maine, can have a major impact when the federal government creates a void.
Disclaimer: This Alert has been prepared and published for informational purposes only and is not offered, nor should be construed, as legal advice. For more information, please see the firm's full disclaimer.
