Maine Act to Protect the Privacy of Online Consumer Information
Prohibits ISPs from using, disclosing, or selling customer data without explicit consent. Includes breach notification requirements.
| Jurisdiction | Maine |
|---|---|
| Category | Privacy & Data Protection |
| Status | Active |
| Latest development |
Analysis
Key Requirements
- Explicit Consent for Data Use, Disclosure, or Sale: ISPs must obtain express, affirmative consent from customers before using, disclosing, selling, or permitting access to their personal information. Consent must be opt-in, and customers can revoke consent at any time. ISPs cannot refuse service, charge a penalty, or offer discounts based on a customer's consent decision. Maine Legislature – Public Law Chapter 216 Maine Legislature – Statute Text Verrill – Overview of Maine Privacy Law
- Scope of Protected Information: The law covers a broad range of personally identifying information, including names, addresses, Social Security numbers, billing data, browsing and application usage history, geolocation, financial and health information, information about children, device identifiers, and communications content. Maine Legislature – Public Law Chapter 216 TDS Telecom – Maine Consumer Privacy Act
- Breach Notification Requirements: ISPs must comply with Maine’s Notice of Risk to Personal Data Act, which requires notification to affected individuals and the Maine Attorney General in the event of a data breach involving personal information. Verrill – Overview of Maine Privacy Law Maine Legislature – Notice of Risk to Personal Data Act
- Prohibition on Discrimination: ISPs may not refuse service, charge higher rates, or offer discounts based on a customer’s decision to provide or withhold consent for data use. Maine Legislature – Public Law Chapter 216 TDS Telecom – Maine Consumer Privacy Act
Compliance Challenges
- Complex Consent Management: Maintaining systems for obtaining, tracking, and honoring explicit, revocable consent is technically and operationally challenging, especially for ISPs with legacy systems. Securiti – Maine Data Privacy Law Guide Verrill – Overview of Maine Privacy Law
- Broad Definition of Personal Information: The law’s expansive definition of personal information requires ISPs to inventory and protect a wide range of data types, increasing compliance complexity. TDS Telecom – Maine Consumer Privacy Act
- Integration with Existing Breach Notification Processes: Aligning Maine’s breach notification requirements with federal and other state laws can create operational and legal challenges. Verrill – Overview of Maine Privacy Law
- Real Example: After the law’s enactment, several ISPs reported significant costs and delays in updating their consent management and data inventory systems to comply with the new requirements. Industry reports highlight the need for robust technical solutions and staff training. Securiti – Maine Data Privacy Law Guide Verrill – Overview of Maine Privacy Law
Implementation Best Practices
- Comprehensive Data Mapping: Identify and classify all customer personal information as defined by the law. IAPP – Data Mapping Guidance
- Consent Management Platforms: Deploy tools that enable explicit opt-in consent, allow for easy revocation, and log consent status for audit purposes. OneTrust – Consent Management
- Employee Training: Regularly train staff on privacy requirements, breach notification procedures, and customer rights under the Maine law. SANS Institute – Security Awareness Training
- Incident Response Planning: Update breach notification procedures to align with Maine’s Notice of Risk to Personal Data Act. Maine Legislature – Notice of Risk to Personal Data Act NIST – Computer Security Incident Handling Guide
Recent Updates
- Pending Repeal Legislation: As of 2025, a bill (LD1284) has been introduced to repeal the current broadband privacy law, but it has not yet been enacted. Organizations should monitor legislative developments for changes to compliance obligations. Maine Legislature – LD1284 Bill Text
- New Data Privacy Acts: Maine is considering broader privacy legislation, such as the Maine Consumer Data Privacy Act (effective July 1, 2026) and the Maine Online Data Privacy Act, which may introduce additional or overlapping requirements. Maine Legislature – LD1088 Maine Legislature – HP1220
- No Major Amendments Since Enactment: The original law (Public Law Chapter 216) remains in force pending any legislative changes. Maine Legislature – Public Law Chapter 216
Related Regulations
- Notice of Risk to Personal Data Act: Governs breach notification for all entities holding personal information in Maine. Maine Legislature – Notice of Risk to Personal Data Act
- Federal Communications Commission (FCC) Rules (Repealed): The FCC previously had similar rules for ISPs, but these were repealed in 2017. Maine’s law was enacted in response to this repeal. FCC – Broadband Privacy Rules (Archived)
- CAN-SPAM Act: Federal law regulating commercial email, which preempts some state-level email privacy provisions. FTC – CAN-SPAM Act
- Other State Privacy Laws: Maine’s law is similar in intent to California’s CCPA/CPRA and Connecticut’s Data Privacy Act, but applies specifically to ISPs. California Attorney General – CCPA Connecticut General Assembly – Data Privacy Act
Industry Impact
- Increased Compliance Costs: ISPs operating in Maine have incurred significant costs to implement consent management, data mapping, and breach notification systems. Securiti – Maine Data Privacy Law Guide Verrill – Overview of Maine Privacy Law
- Enhanced Consumer Trust: The law has been cited as a model for consumer privacy, increasing trust among Maine residents regarding their online activities. TDS Telecom – Maine Consumer Privacy Act
- Potential for Regulatory Fragmentation: ISPs must navigate a patchwork of state and federal privacy laws, increasing operational complexity for multi-state providers. Securiti – Maine Data Privacy Law Guide
Sources
- Maine Legislature – Public Law Chapter 216
- Maine Legislature – Statute Text
- Verrill – Overview of Maine Privacy Law
- TDS Telecom – Maine Consumer Privacy Act
- Securiti – Maine Data Privacy Law Guide
- Maine Legislature – Notice of Risk to Personal Data Act
- Maine Legislature – LD1284 Bill Text
- Maine Legislature – LD1088
- Maine Legislature – HP1220
- FCC – Broadband Privacy Rules (Archived)
- FTC – CAN-SPAM Act
- California Attorney General – CCPA
- Connecticut General Assembly – Data Privacy Act
- IAPP – Data Mapping Guidance
- OneTrust – Consent Management
- SANS Institute – Security Awareness Training
- NIST – Computer Security Incident Handling Guide
Recent developments
- — An IAPP 2025 retrospective notes that although no new comprehensive privacy law was ultimately enacted in Maine this year, legislative activity around LD 1088 and LD 1822 reflects ongoing efforts to build on Maine’s earlier ISP-focused online consumer privacy Act and move toward a broader data protection framework affecting the wider tech sector.[3] (source)
- — An NCSL 2025 consumer privacy legislation brief lists Maine as an active state with multiple privacy bills, indicating that policymakers are considering expanding protections beyond the Maine Act to Protect the Privacy of Online Consumer Information, which currently targets broadband providers, to cover a wider set of technology and data-driven businesses.[9] (source)
- — Verrill updates its overview of Maine privacy law, noting that the broadband-specific **Maine Act to Protect the Privacy of Online Consumer Information** remains in effect alongside new, broader privacy proposals such as the Maine Consumer Data Protection Act and Maine Online Data Privacy Act, signaling a layered regulatory environment for tech and communications providers.[8] (source)
- — NCSL’s 2025 consumer privacy tracker highlights Maine’s multiple privacy initiatives and explains that the existing broadband privacy statute (the Maine Act to Protect the Privacy of Online Consumer Information) continues to operate as a sector-specific rule while the legislature pursues comprehensive online data privacy legislation.[9] (source)
Related regulations
- UK Data Protection Act 2018 — United Kingdom, Active
- Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
- General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
- COPPA (Children's Online Privacy Protection Act) — United States, Active
- Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
- Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
- New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01
- Nebraska Data Privacy Act (NDPA) — Nebraska, Active, effective 2025-01-01
Put it into practice
- Generate the policy: Privacy policy generator (generatepolicy.com)
- Buy the policy pack: State Privacy Law Checklist (cyberpolicy.shop)
- Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates