Governor Mills signed, “An Act To Protect the Privacy of Online Customer Information,” (LD- 946) which requires Internet service providers (ISPs) to obtain opt-in consent prior to, “using, disclosing, selling or permitting access to [a consumer’s] prohibited personal information.”  LD- 946, goes into effect July 2020.

An Act To Protect the Privacy of Online Customer Information (LD- 946)

“Internet service providers should not be able to sell or share everything that they know about you — including your most private and sensitive personal information — without your consent,” said Sen. Shenna Bellows, D-Manchester. Accordingly, Maine has passed LD- 946, which requires ISPs to obtain the consent of a consumer before selling, sharing or giving away that consumer’s sensitive personal data or information.

LD-946 defines “personal information” to include both personally identifying information (such as billing information and social security number) as well as information from a customer’s use of broadband Internet services including:

• The customer’s web browsing history;
• The customer’s application usage history;
• The customer’s device identifier, such as a media access control address, international mobile equipment identity or Internet protocol address;
• The content of the customer’s communications; and
• The origin and destination Internet protocol addresses.

 LD-946 also states that an ISP may not:

• Refuse to serve a customer who does not provide consent under paragraph or
• Charge a customer a penalty or offer a customer a discount based on the customer’s decision to provide or not provide consent.

The law also requires the provider to:

• Take reasonable measures to protect personal information from unauthorized use, disclosure or access; and
• Provide customers a “clear, conspicuous and nondeceptive” notice at the point of sale and on the provider’s publicly accessible website of the provider’s obligations and a customer’s rights.

However, there are exceptions that allow for the sharing of personal information including:

• To provide the service from which such information is derived;
• To advertise the provider’s communications-related services to the customer;
• To comply with a lawful court order;
• To initiate, render, bill for and collect payment for broadband Internet access service;
• To protect users from fraudulent, abusive or unlawful use of or subscription to such services; and
• Certain geolocation services.

The law only applies to broadband providers operating within Maine when providing services to individuals physically located in Maine and becomes effective on July 1, 2020.