Enforcement of Maine’s landmark online privacy law, which bans internet service providers from collecting and selling customers’ personal data without their permission, began this month after clearing a major legal hurdle in July.

Still, state officials can not provide a clear picture of what will happen to providers in Maine if they don’t comply.

The law dictates that internet providers must gather express, affirmative consent from customers before collecting any of their identifying data, such as location, browsing history or device identification. Providers also must give customers “clear, conspicuous and non-deceptive notice” of their rights at the point of sale, and are not allowed to offer promotions to customers who choose to give consent to have their data collected or refuse service to those who do not.

Customers can expect to see posted notices of their rights on their internet provider’s website, and new customers will be asked for consent if their provider wants to collect their data. It remains unclear whether providers must actively provide existing customers with notice of their newly gained privacy rights.

The law, which was modeled after an Obama-era Federal Communications Commission rule that was repealed in 2017, is one of the strictest in the country and the first of its kind to explicitly require providers to get customers’ permission before collecting and selling their data.

The law was signed in June 2019 and went into effect July 1. Maine Attorney General Aaron Frey agreed to postpone enforcement because of the coronavirus pandemic and a pending lawsuit over the law brought by four internet industry groups. However, most of the plaintiffs’ arguments were rejected by a federal judge on July 7, including their claim that the privacy law violates internet companies’ First Amendment rights.

“I think it does fundamentally change how (internet service providers) are dealing with consumer data,” Ariel Pardee, an attorney who works in the privacy and data security practice group at New England-based law firm Pierce Atwood, said of Maine’s law. “We haven’t had an opt-in law.”

Though enforcement of the law began Aug. 1, it remains unclear how providers will be held accountable.

Pardee said the law is unusual in that it includes no enforcement provision, and that without one, the responsibility for enforcement has fallen to Frey and the state Office of the Attorney General.

Frey, whose office supported the legislation, said he intends to rely partially on the good faith of internet companies to obey the law.

“We have an open dialogue with attorneys for the (providers), and they don’t want their client to be in trouble, so you can use that relationship and make sure there’s no problems, and (we can) look to see whether or not the notice requirements are being complied with,” Frey said.

He noted that he’s spoken with representatives from many of the companies, and they’ve told him that they don’t collect and sell consumer data.

“It’s my hope that they were being forthright with me that they’re not using consumer data in this way now,” Frey said.  “So it should be pretty easy for them to comply with if they were representing (themselves) accurately.”

However, given the lawsuit, it’s clear that not all internet providers support the law.

Joe Francoeur is a technician for GWI, a small internet company based in Biddeford. The company’s CEO, Fletcher Kittredge, said most Maine-based internet providers favor the privacy law because their business is providing internet service, not advertising.  Derek Davis/Staff Photographer

Fletcher Kittredge is the CEO of GWI, a small provider based in Biddeford. Kittredge said he lobbied for passage of the bill because he supports online privacy and his company doesn’t collect or sell personal data for advertising purposes. He said most Maine-based internet providers were in favor of the bill because their business is providing internet service, not advertising.

“If you look at the the list of the people who have sued to block the implementation, it’s the big, national companies,” Kittredge said. “I don’t think any local companies joined that. There’s pretty much a breakdown: The Maine companies think the Maine law is great, the national companies don’t.”

Frey said he also intends to rely on consumer awareness to enforce the law – should consumers suspect that their personal data has been collected or sold without their consent, they should contact the attorney general’s office.

That could be difficult, said Pardee, an expert in internet privacy law.

Barring technological advancements that make the monitoring of data collection accessible to the everyday consumer, Pardee said whistle-blowers at the companies would most likely be the way that noncompliance would come to light, not consumer complaints.

“That’s often how these sorts of things get brought to our attention as consumers – somebody inside the company finds out and blows the whistle,” Pardee said. “As for the everyday consumer, I just don’t see how they would know.”

Frey also pointed out that while the new law regulates providers, the state has little power to regulate what data websites or other internet companies – such as Google or Facebook – can and cannot collect.

Though states have some agency to fill the hole left by the repealed federal regulations, Frey said the federal government must act more broadly.

“When an individual chooses to go (to a website) and that information is collected … that’s something that the federal government is in the best position (to regulate),” Frey said.

California’s Consumer Privacy Act extends beyond the Maine law in that it mandates a level of transparency from not only internet service providers but also other businesses that collect customer data online, such as Facebook and Google.

But while the California law empowers consumers to learn what information is being collected, it also requires that they ask for it to be deleted and opt out of future data collection. It does not employ a model in which customers must agree in advance to have their data collected, as Maine’s law does.