Understanding Act to Protect the Privacy of Online Consumer Information: A Comprehensive Guide

· About Act to Protect the Privacy of Online Consumer Information

Key Takeaways

  • Maine’s broadband internet access service privacy law applies to providers serving customers in Maine and generally requires express, affirmative customer consent before using, disclosing, selling, or permitting access to customer personal information.[14][15]
  • The law has been in force since 1 July 2020, after enactment in 2019; no 2025–2026 amendment or delay is reflected in the current statutory text for this ISP-specific law.[5][14][15]
  • A provider may not condition broadband service on consent to collect or use customer personal information beyond what is necessary to provide the service, except for limited statutory exceptions.[14][15]
  • Customers may revoke consent at any time, and providers must give clear notice of privacy practices, consent options, and the right to opt out or withdraw consent where applicable.[14][15]
  • Violations are enforced under Maine’s consumer-protection framework through the state’s Attorney General, exposing noncompliant providers to injunctive relief, civil penalties, and other remedies available under Maine law.[14][15]

What It Is

Maine’s law is titled An Act To Protect the Privacy of Online Customer Information and is codified at 35-A M.R.S. chapter 94. It is a sector-specific privacy statute aimed at broadband internet access service providers rather than a general consumer privacy law.[5][14][15]

The statute is enforced through Maine’s legal and regulatory framework, with enforcement centered on the state Attorney General and civil remedies under Maine law.[14][15]

The law was enacted in 2019 and took effect on 1 July 2020.[5][8][14][15] The current statutory text available in 2026 still reflects that effective date, and the sources reviewed do not show any later phase-in schedule, 2025 amendment, or delayed implementation for this ISP privacy law.[5][14][15]

Who Must Comply

The law applies to a provider of broadband internet access service operating in Maine and serving customers physically located in the state.[12][14][15]

The core threshold is not revenue or volume; instead, coverage turns on whether the entity is a broadband provider and whether it handles customer personal information in the course of providing broadband internet access service.[14][15]

The statute is expressly focused on customer personal information and broadband-related uses, so data processing outside the broadband relationship may fall outside the law only if another legal basis applies and the conduct is not covered by chapter 94.[14][15]

The text contains statutory exceptions, including a customer consent exception, and limited uses that are tied to providing the service or otherwise permitted by law.[14][15]

Core Requirements

  1. Obtain express, affirmative consent before use or disclosure. A provider may use, disclose, sell, or permit access to customer personal information only if the customer gives express, affirmative consent for that specific conduct.[14][15]
  1. Allow consent to be revoked at any time. Customers may withdraw consent whenever they choose, so providers need a process that stops the covered processing after revocation.[14][15]
  1. Limit use to service-related purposes absent consent. The statute prohibits using customer personal information for purposes beyond providing broadband service unless the customer has expressly agreed.[7][14][15]
  1. Maintain compliant privacy notices and operational controls. Providers must align their notices, customer-facing flows, and internal data-use controls with the statute’s consent-based framework so that collection, sharing, and sale are not broader than permitted.[14][15]
  1. Do not treat service access as blanket consent. Consent must be specific and affirmative; it cannot be inferred from mere subscription to broadband service.[14][15]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | Statute enacted | 2019 | Maine enacted the broadband customer privacy law.[5][8][14] | | Law takes effect | 1 July 2020 | Broadband providers must comply with the consent-based restrictions.[5][14][15] | | Current status in 2026 | 6 September 2026 | No later statutory phase-in or ISP-specific delay is reflected in the current text reviewed.[14][15] |

The maximum civil penalty exposure is governed by Maine’s enforcement framework for the statute and related consumer-protection remedies, which can include injunctive relief, civil penalties, and attorney-general enforcement actions.[14][15] Because the reviewed statutory excerpts do not provide a clearly stated per-violation dollar cap in the available text, any penalty assessment should be confirmed against the current enforcement provisions before relying on a specific amount.[14][15]

How to Comply

  1. Map all broadband-related data flows. Identify what counts as customer personal information, where it is collected, and every internal and third-party use case.
  1. Classify lawful versus consent-based processing. Separate processing needed to provide broadband service from advertising, analytics, resale, or sharing activities that require express consent.
  1. Build an opt-in consent architecture. Consent screens and records should be explicit, granular, and revocable, with no pre-checked boxes or bundled acceptance.
  1. Implement revocation handling. Ensure customers can withdraw consent easily and that downstream systems stop covered uses quickly.
  1. Align governance with ISO 27001. Use ISO 27001 controls for access management, supplier oversight, logging, incident handling, and evidence preservation.
  1. Add privacy engineering and risk review with NIST CSF 2.0. Use NIST CSF 2.0 to structure governance, identify risks, manage third-party exposure, and monitor control effectiveness.
  1. Use ISO 42001 where automated profiling or AI is involved. If customer data is used in AI-supported advertising, support, or analytics, ISO 42001 helps govern AI risk, accountability, and documented use constraints.
  1. Test notices, scripts, and vendor contracts. Confirm that customer notices match actual data practices and that contracts prohibit unauthorized downstream use or disclosure.

Related Regulations

Maine’s broadband privacy law overlaps with the FCC’s broadband privacy framework history, but the federal landscape has been unstable since the FCC’s 2017 rollback, leaving state law as the main sector rule.[8][12]

The Maine Consumer Data Privacy Act / Maine Online Data Privacy Act proposals in 2025–2026 are broader consumer privacy bills and are separate from this ISP-specific statute; if enacted, they would add general consumer rights rather than replace chapter 94.[1][2][3][4]

The FTC Act may also apply to deceptive privacy statements or unfair practices, so inaccurate notices or broken consent promises can create parallel federal risk.

The Maine Unfair Trade Practices Act can overlap where privacy misstatements or unfair collection practices affect consumers, increasing litigation and enforcement exposure.

FAQ

Does this law apply to broadband providers outside Maine?

Yes, if the provider serves customers physically located in Maine and qualifies as a broadband internet access service provider under the statute.[12][14][15] The law is not limited to Maine-incorporated companies; practical reach follows the customer base and service location.

Does the law allow sharing customer data for advertising?

Only with express, affirmative consent from the customer, unless another narrow statutory exception applies.[14][15] Absent consent, the provider may not use, disclose, sell, or permit access to customer personal information for that purpose.

Can a customer withdraw consent later?

Yes. The statute allows a customer to revoke consent at any time, so providers need operational controls that honor revocation promptly.[14][15] If a vendor or ad partner keeps using the data after revocation, the provider may still face compliance risk.

Is this a general consumer privacy law?

No. This is a sector-specific broadband privacy law aimed at internet access service providers, not a comprehensive statewide consumer privacy statute.[5][14][15] Maine’s broader consumer privacy proposals have been separate legislative initiatives.

Were there any 2025–2026 delays or amendments?

The statutory text reviewed in 2026 still shows the original 1 July 2020 effective date and does not reflect a later delay or ISP-specific amendment.[5][14][15] Separate 2025–2026 Maine privacy bills were introduced for broader consumer privacy, but they are not amendments to this broadband law.[1][2][3][4]

Sources

Put it into practice

More compliance guides