Maine Legislators Dive Into 3 Competing Comprehensive Privacy Bills

Later, the committee agreed to a motion that another bill (LD-1284) repealing the state's 2019 ISP privacy law "ought not to pass." Members said they weren't comfortable potentially facing a situation where the legislature repealed the ISP law without replacing it with something covering all kinds of companies. The committee could still decide to repeal the ISP law within one of the other privacy bills.

“I can't imagine everybody's going to be ready to digest this” and vote by the end of the meeting, said Kuhn as the committee’s privacy discussion began, and it’s “possible -- maybe even likely -- there could be one or more amendments.”

The three sweeping privacy measures would all take effect July 1, 2026. They are: (1) LD-1822, which is legislation from Kuhn that includes data-minimization requirements similar to Maryland’s privacy law, (2) LD-1088 by Rep. Rachel Henderson (R); and (3) LD-1224 by Rep. Tiffany Roberts (D). The second and third bills hew closer to the common state model prior to Maryland’s law, though Henderson’s bill differs from Roberts’ by including a repeal of the ISP privacy law.

“These bills’ protections include, depending on the bill, either prohibiting the use of personal data for certain purposes -- for example, the use of personal data or sensitive data for targeted advertising or profiling of Maine residents or the sale of Maine residents’ personal data -- or requiring that a consumer either affirmatively consent to the controller’s use of their data for that purpose or that the consumer be offered the option to opt-out of the controller’s use of their data for that purpose,” said a legislative analysis comparing the trio of comprehensive privacy bills.

“None of the bills would authorize a private action, or a private class action, to enforce their provisions,” notes the analysis. All the bills have the attorney general exclusively enforcing violations under Maine’s Unfair Trade Practice Act. Only LD-1822 would additionally give the AG rulemaking authority.

At a May 5 session, the committee heard testimony for and against each of the three comprehensive privacy bills (see 2505050025). At that hearing, Kuhn called for abandoning the notice-and-consent model of data privacy laws used in most other states in favor of the data-minimization approach of her LD-1822.

At Wednesday’s meeting, Maine Assistant Attorney General Brendan O’Neil supported minimization. “With less data that is collected about consumers, there's less that's able to be put at risk for those consumers.” Responding to concerns it would make a Maine law less compatible with other state privacy laws, O’Neil said, “Interoperability can be kind of ... a trap for legislatures because it prevents legislatures from progressing and moving action forward [in] a consumer- protective way."

Comprehensive privacy bills with Maryland-like data-minimization rules are also advancing in Massachusetts (see 2505130041) and Vermont (see 2504250033). In addition, Connecticut lawmakers are weighing a possible update that would include minimization (see 2505140067).

Later in the hearing, Sen. Rachel Talbot Ross (D) asked if Kuhn would reconsider omitting a private right of action in her bill. The House chair said she wasn't sure she'd support reviving that type of enforcement mechanism, since she was honoring where negotiations ended up last year and felt she had made a commitment. Even so, another committee member, Rep. David Sinclair (D), pointed to support for a PRA from the attorney general's office and the American Civil Liberties Union. Sinclair asked if the "sky has fallen" after the mechanism was included in laws elsewhere.