• by Wendy Davis  @wendyndavis, June 3, 2019

Lawmakers in Maine have passed a privacy bill that would require Internet service providers to obtain consumers' opt-in consent before drawing on their web activity for ad targeting.

The measure, which awaits Governor Janet Mills' signature, largely re-creates a set of privacy rules passed in 2016 by the Federal Communications Commission, but revoked by Congress the following year.

The Maine law, which would take effect in 2020, specifically prohibits broadband carriers from “using, disclosing, selling or permitting access to customer personal information” without people's explicit consent. The law also would prohibit carriers from either refusing service to people who don't consent to tracking or charging different rates to people based on whether they consent to tracking.

The law's definition of “personal information” is relatively broad. It includes web-browsing history, precise geolocation information, IP addresses and device identifiers.

If enacted, the Maine bill will only apply to companies that offer broadband access, like AT&T, and not to so-called “edge” companies like search engines or social networking platforms.

The broadband industry (and other business groups) have often argued that internet access providers shouldn't be subject to tougher privacy rules than companies like Facebook or Google.

But privacy advocates have countered that there are good reasons to treat Internet service providers differently -- including that ISPs have access to more information about subscribers' Web activity than any one content company, social media service, or ad network.

If Mills signs the bill, Maine will join California in attempting to regulate online privacy. California's new privacy law, set to take effect next year, applies to a broader range of companies than the Maine measure. But California's measure takes an opt-out approach -- often seen as more business-friendly than the opt-in regime created by the Maine law. The California law allows consumers to learn what personal information about them is held by businesses, request deletion of that information, and to opt out of its sale.

Dan Jaffe, executive vice president for government relations at the Association of National Advertisers, says the move in Maine shows a need for a national privacy law.

“It's another example of how we're going to get a totally balkanized regulatory framework,” Jaffe says.

He adds that a multitude of state laws will “create an ever-greater regulatory nightmare for people who are operating on the internet.”

“This drip by drip approach to privacy is going to be counterproductive for everybody,” he says.