Maine governor signs bill banning internet providers from selling consumer data without consent

Maine Gov. Janet Mills (D) signed into law one of the nation’s strongest privacy bills on Thursday, banning internet service providers (ISPs) from using, selling or distributing consumer data without their consent.

The Act to Protect the Privacy of Online Consumer Information would prohibit any ISPs in Maine from refusing to serve a customer, penalizing them or offering a discount in order to pressure consumers into allowing the ISP to sell their data. The law will take effect on July 1, 2020.

Maine is one of the first states to take that step after California passed its own strict privacy law last year, setting off a flurry of industry lobbying and praise from privacy activists.{mosads}

Maine’s law, passed amid pushback from top ISPs, is geared toward those such as AT&T and Spectrum. California’s law, meanwhile, also applies to tech companies including Google, Microsoft, Amazon and Facebook.

Some privacy activists have described the Maine law as even stronger than California’s because it mandates that ISPs require explicit consent from customers to sell their personal data, while the California law requires consumers to request that their data not be sold by their own volition. 

Mills described the new law as “common sense,” adding that “Maine people value their privacy, online and off.”

“The internet is a powerful tool, and as it becomes increasingly intertwined with our lives, it is appropriate to take steps to protect the personal information and privacy of Maine people,” she said in a statement. “With this common-sense law, Maine people can access the internet with the knowledge and comfort that their personal information cannot be bought or sold by their ISPs without their express approval.”

The bill was approved unanimously last week by the Maine Senate, and was sponsored by Maine state Sen. Shenna Bellows (D). Bellows said in a statement that the law makes Maine “first and best in the nation in protecting consumer privacy online.”

Bellows has said previously that she is planning to introduce an internet privacy bill in the next session that would also target companies including Google and Facebook. 

The Maine law is modeled after a former Federal Communications Commission (FCC) measure that was nullified by President Trump in 2017. It blocks ISPs from selling customers’ personal data from third parties, which is not currently prevented at the federal level. 

Supporters of the bill have pointed to instances in which large ISPs have sold their customers’ real-time location data to third parties, saying the companies need to be better regulated.

The Maine privacy law comes as lawmakers on Capitol Hill seek to hammer out the country’s first comprehensive privacy bill. Republicans and top industry lobbyists have argued that any federal bill should override state laws in order to avoid a “patchwork” of privacy laws that would be difficult for tech companies to navigate. 

Democrats have said they are open to pre-empting state laws as long as the national bill offers strong privacy protections. 

Gigi Sohn, former adviser at the FCC under the Obama administration, in a statement applauded the Maine law.

“The bipartisan passage of Maine’s broadband privacy bill demonstrates that when legislators listen to their constituents rather than big corporations, the public wins,” Sohn said. “The cable and broadband industry sent a parade of high-powered and highly-paid Washington, DC-based lawyers to Augusta in an effort to defeat this bill, using the same arguments they used to kill the FCC’s sensible and popular 2016 broadband privacy rules.”

“When the federal government stands down, the states must step up, and that is what Maine has done here,” she added. 

Updated Monday at 11:00 a.m.