Maine defends privacy

One state’s law is model legislation

Lawmakers in Maine recently passed a groundbreaking privacy bill that requires internet service providers to obtain consumers’ optin consent to sell their personal data. The bill is a necessary step forward in the fight for digital privacy.

In the larger conversation surrounding privacy online, most people think first of companies like Facebook and Google. But the Maine bill, which was sponsored by state Sen. Shenna Bellows, is unique in that it targets ISPs because, as Ms. Bellows explained to the Portland Press Herald, “You can use the internet without using Facebook. You can’t use the internet without using your internet service provider.”

ISPs have access to an inordinate amount of information about users’ online behavior, far more than any one website could collect. Yet there are no laws regulating how these providers share or sell the information that is tracked through their services.

“When you put a letter in the post office, you assume that the letter belongs to you,” Ms. Bellows said. “You would never assume that the post office would say, ‘That letter now belongs to me. I can sell the contents of that letter.’”

The law, which will take effect in 2020 if Maine Gov. Janet Mills signs it, has a number of other smart features that will protect consumers from either unwanted intrusion or unjust punishment for protecting their own privacy.

Taking more than a few cues from Europe’s General Data Protection Regulation, enacted in 2018, the Maine law requires that companies still provide services to consumers who do not approve the sharing or selling of their personal data. This protection ensures that consumers still have access to necessary online services without having to sacrifice some of their privacy.

The law also requires that consumers explicitly opt in to companies’ data sharing programs. Many companies collect, share and sell data by default. A user would have to seek out ways of stopping this — known as an opt-out. But years of intrusions have created mass apathy, and few people go out of their way to protect their privacy. Maine’s law will instead make privacy the default.

There is one issue, however: Companies will still be able to bury opt-in consent within lengthy privacy policies, coating it in layers of legalese that will be impenetrable to the average user. Europe’s GDPR counteracted this by requiring that companies’ data sharing consent requests be presented in clear, concise language that is easily understood by the consumer. Maine lawmakers might consider an amendment to the bill to that same effect, and other legislatures around the country should keep it in mind.

But Maine’s law is still far and away the most impressive and impactful digital privacy law in the United States. It is encouraging to see individual states taking on this issue, as the federal government is AWOL on the obliteration of privacy.