Maine's Broadband Privacy Statute, 35-A MRSA 9301: Opt-In for ISPs and the Court Record on It

From LD 946 to Chapter 94

The Legislature's bill summary records LD 946, Senate Paper 275, "An Act To Protect the Privacy of Online Customer Information," sponsored by Senator Shenna Bellows and referred to the Energy, Utilities and Technology Committee. Both chambers passed it to be enacted on May 30, 2019, and the governor signed it on June 6, 2019 as a public law, chapter 216.

The chapter law has two sections. Section 1 enacts a new chapter 94 of Title 35-A, the public utilities title, headed "Broadband Internet Access Service Customer Privacy." Section 2 provides that "This Act takes effect July 1, 2020." The codified section 9301, as published by the Revisor of Statutes with data extracted October 5, 2026, shows no amendment since: every subsection cites only PL 2019, c. 216.

Which Providers 35-A MRSA 9301 Reaches

A "provider" is a person who provides broadband internet access service, defined in subsection 1(A) as "a mass-market retail service by wire or radio" capable of transmitting data to and from "all or substantially all Internet endpoints," excluding dial-up. A "customer" is "an applicant for or a current or former subscriber." The definition reaches applicants and former subscribers as well as current ones.

Subsection 7 limits the section to providers operating in Maine "when providing broadband Internet access service to customers that are physically located and billed for service received in the State." Both conditions appear in the text. There is no size threshold, no customer count and no exemption for small providers. The section regulates the access provider only; it does not reach websites, apps or advertising companies that receive data from other sources.

Opt-In Consent for Customer Personal Information

Subsection 2 states the core rule: a provider "may not use, disclose, sell or permit access to customer personal information," except as subsections 3 and 4, Title 16, chapter 3, subchapters 10 and 11, and 18 U.S.C. 2703 allow. The court's August 2022 order, discussed below, describes those references as law enforcement access under the Stored Communications Act and its Maine analogues.

Subsection 1(C) defines customer personal information in two parts. The first is personally identifying information, "including but not limited to" name, billing information, Social Security number, billing address and demographic data. The second is information from the customer's use of the service, again non-exhaustive:

• Web browsing history and application usage history
• Precise geolocation, financial and health information
• Information pertaining to the customer's children
• Device identifiers such as a MAC address, IMEI or IP address
• The content of communications, and origin and destination IP addresses

Under subsection 3(A), the only general route to using that information is the customer's "express, affirmative consent," which the customer "may revoke" at any time. The statute does not split customer personal information into sensitive and non-sensitive tiers with different consent levels. Every category on the list sits behind the same opt-in.

Subsection 4 lists what a provider may do without approval: provide the service the information derives from, "advertise or market the provider's communications-related services to the customer," comply with a court order, bill and collect, protect against fraudulent or abusive use, and pass geolocation to emergency responders or to database providers assisting with an emergency. Marketing of non-communications products, or sharing with third parties for their own advertising, is not on that list.

The Opt-Out Category

Information that falls outside the definition of customer personal information is treated differently. Subsection 3(C) lets a provider use, disclose, sell or permit access to it "except upon written notice from the customer" withholding permission. The customer's tool is written notice, not a link or a preference signal, and the section does not describe any information that falls into this residual category.

In the litigation discussed below, the court described the line between the two categories as copied from the Federal Communications Commission's 2016 broadband privacy order, with additions. The July 2020 order states that Maine's definition "tracks" the order's sensitive-information category "almost exactly, except that it adds" name, billing information, billing address and demographic information to the opt-in side. Congress had disapproved that FCC order in April 2017 under the Congressional Review Act, Pub. L. No. 115-22.

No Penalty for Refusing Consent

Subsection 3(B) bars a provider from refusing to serve a customer who withholds consent. It also bars charging "a penalty" or offering "a discount based on the customer's decision to provide or not provide consent." The prohibition runs both ways: a lower price for consenting customers is as prohibited as a surcharge on those who decline.

Two further duties complete the section. Subsection 5 requires "reasonable measures" to protect customer personal information, scaled to the nature and scope of the provider's activities, the sensitivity of the data, the provider's size and technical feasibility. Subsection 6 requires a "clear, conspicuous and nondeceptive notice" of the provider's obligations and the customer's rights, given at the point of sale and on the provider's public website. The section itself names no enforcing agency, sets no penalty and creates no private right of action; it does not say how a violation is remedied.

The ACA Connects v. Frey Challenge

ACA Connects, CTIA, NCTA and USTelecom, trade associations whose members include Maine ISPs, sued Attorney General Aaron Frey in the District of Maine as No. 1:20-cv-00055-LEW. According to the July 7, 2020 order of Judge Lance E. Walker, the complaint had five counts: a First Amendment claim, a vagueness claim, and three preemption theories. The plaintiffs moved for judgment on the pleadings on all five; the Attorney General cross-moved on preemption.

The order granted the cross-motion and dismissed Counts Three, Four and Five. On the Congressional Review Act theory, it held that the joint resolution's disapproval of the FCC order "creates no overarching federal policy, and enacts no scheme with which the Maine Privacy Statute can conflict." On the theory based on the FCC's Restoring Internet Freedom Order, it found no conflict between the agency's decision to leave broadband privacy to the FTC and Maine's statute. Count Five, an impossibility theory, was dismissed as moot after the plaintiffs acknowledged the state's narrowing constructions resolved it.

The plaintiffs' motion was denied on the remaining counts. The court held that the statute regulates commercial speech and is reviewed under the intermediate Central Hudson standard rather than strict scrutiny, and that the pleadings alone gave no record on which to decide whether Maine's interest was substantial or the law well tailored. On vagueness, it found the geographic scope in subsection 7 sufficiently clear, accepted the state's limiting construction tying the residual opt-out category to the FCC order's categories, and concluded that the "including but not limited to" language did not make the section vague on its face.

The second published order, dated August 18, 2022, addressed three motions to exclude expert testimony on the First Amendment question. It denied the plaintiffs' motion to exclude the Attorney General's expert, Professor Scott Jordan, a former FCC chief technologist, and reserved ruling on the Attorney General's motions to exclude the plaintiffs' experts, Professors Christopher Yoo and Adam Towvim.

Those two orders are the only documents in the GovInfo collection for the case. How the case ended after August 2022 could not be confirmed from a court or agency record for this post: CourtListener refused unauthenticated requests, and the Maine Attorney General's news site returned HTTP 403. This post therefore reports no final disposition. The codified section, as published with data extracted October 5, 2026, carries no amendment or repeal note.

Frequently Asked Questions