Maine Data Privacy and Protections Act

The Maine Data Privacy and Protection Act (MDPPA), set to take effect on July 1, 2025, represents a significant advancement in consumer data privacy legislation in the United States.

JurisdictionMaine
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

The Maine Data Privacy and Protection Act (MDPPA) introduces several key requirements for businesses operating in Maine:

  • Data Minimization: Companies must limit data collection and processing to what is "reasonably necessary and proportionate" to provide requested services. This aims to curb unnecessary data collection. Source: Maine Legislature Bill Text
  • Consumer Rights: The MDPPA grants consumers rights including access, correction, deletion, and data portability. Consumers can also opt out of data sales and targeted advertising. Source: Maine Legislature Bill Text
  • Consent for Sensitive Data: Companies must obtain explicit consent before processing sensitive data, including biometric information, precise geolocation, and data concerning minors. Source: Maine Legislature Bill Text
  • Privacy Policy: Businesses must maintain a clear and accessible privacy policy detailing data collection practices, consumer rights, and how to exercise those rights. Source: Maine Legislature Bill Text
  • Data Protection Assessments: Companies must conduct impact assessments for high-risk data processing activities, including profiling and targeted advertising. Source: StateScoop Article

Compliance Challenges

Organizations face several challenges in complying with the MDPPA:

  • Implementing Data Minimization: Many businesses struggle to limit data collection to only what's necessary, as existing systems may be designed for broader data gathering. Source: ACLU Maine Press Release
  • Managing Consumer Rights Requests: Handling access, deletion, and correction requests can be complex, especially for companies with large volumes of data across multiple systems. Source: Global Compliance News
  • Conducting Data Protection Assessments: Many organizations lack experience in performing comprehensive risk assessments for data processing activities. Source: StateScoop Article

Implementation Best Practices

To effectively implement MDPPA requirements, organizations should:

  • Implement Consent Management: Deploy robust consent mechanisms, especially for sensitive data processing. Consider using consent management platforms (CMPs). Source: OneTrust Consent Management

Recent Updates

As of April 2024, the MDPPA has not yet been enacted:

Related Regulations

The MDPPA shares similarities with other state and federal privacy laws:

Industry Impact

The MDPPA would significantly impact businesses operating in Maine:

Sources

Recent developments

  • — Maine lawmakers again rejected a comprehensive data privacy statute, marking the second consecutive session that a robust privacy framework modeled on the Maine Data Privacy and Protections/Online Data Privacy Act failed after substantial business opposition and divisions within the Democratic caucus.[5] (source)
  • — The IAPP reported that LD 1822, the **Maine Online Data Privacy Act** (often described as Maine’s comprehensive consumer data privacy bill), had cleared both chambers but faced uncertainty due to controversy over a Senate amendment exempting political organizations, leaving its final enactment in doubt.[6] (source)
  • — Consumer Reports praised the Maine Senate for advancing LD 1822, calling it a comprehensive privacy bill that would give residents strong rights including data minimization, a ban on selling sensitive data like precise geolocation, and enhanced protections for minors’ data and targeted ads.[8] (source)
  • — ACLU of Maine announced that the Maine Senate passed LD 1822, described as a “landmark” privacy bill aimed at limiting sweeping digital surveillance through strict data minimization, biometric safeguards, and limits on long‑term data retention, with the measure heading to enactment votes in both chambers.[7] (source)
  • — ACLU of Maine reported that the House passed LD 1822, emphasizing provisions that restrict companies to collecting only the data needed to provide a service, impose strong protections around biometrics and geolocation, and curb pervasive tracking across websites, apps, and devices.[1] (source)
  • — Local news coverage showed the Maine House narrowly approving an amended version of LD 1822 after rejecting a proposal to exempt political entities, with business groups warning that the bill’s stringent requirements could raise compliance costs and burden Maine companies.[9] (source)
  • — Maine Morning Star reported that multiple privacy bills, including LD 1822 and alternatives LD 1088 and LD 1224, returned to the Legislature with differing approaches to data minimization, consent for sensitive data, and possible repeal of the existing ISP‑focused privacy law, while all proposals limited enforcement to the Attorney General without a broad private right of action.[4] (source)
  • — StateScoop covered the failure of an earlier version of Maine’s ambitious consumer data privacy act in the Senate after heavy business lobbying and removal of a private right of action, noting that the bill had been touted as potentially the strongest consumer data privacy law in the country before it died for the 2024 session.[2] (source)
  • — Maine’s existing ISP‑specific privacy law took effect, restricting broadband providers’ use and sale of customer personal information without express, affirmative consent and serving as the baseline privacy framework that later comprehensive proposals like LD 1822 sought either to replace or integrate.[3] (source)

Read the full guide to Maine Data Privacy and Protections Act

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates