• by Wendy Davis , 8 hours ago

The Maine House of Representatives has narrowly passed a privacy bill that would restrict companies' ability to collect data and target ads, and would ban the sale of precise location data.

The Maine Online Data Privacy Act (LD 1822) was approved last week by a vote of 71 to 68, with nine lawmakers listed as "absent." The bill is now in the state Senate, which has until April 15 to vote.

Among other provisions, the proposed law would require companies to allow Maine residents to opt out of the use of their personal data -- meaning information that's linked or linkable to devices or consumers -- for behaviorally targeted advertising.

The bill would also prohibit companies from selling residents' sensitive data -- including data that can determine geolocation within a 1,750-foot radius. Other types of sensitive data covered by the bill include biometric information, genetic data and information revealing race, ethnicity, health data, sexual orientation and citizenship status.

The measure also would prohibit companies from collecting more non-sensitive data than what they "reasonably" need to provide a specific product or service requested by consumers. The proposed law also would limit companies from collecting sensitive data unless such data is "strictly necessary" to provide product or service requested by consumers.

Another provision would prevent companies from harnessing minors' data for ad targeting.

The bill is one of three privacy proposals introduced last year, and the most restrictive. For instance, instead of banning companies from selling sensitive data, the other bills would have allowed such sales if consumers consented.

Advocacy groups including Consumer Reports, the American Civil Liberties Union and Electronic Privacy Information Center cheered news of the bill's passage in the House.

Matt Schwartz, policy analyst at Consumer Reports, stated that the proposed law's data minimization requirements "will protect consumers by default, instead of requiring them to make endless consent choices in order to fully protect themselves."

Maine previously passed a privacy bill that required broadband access providers to obtain consumers' opt-in consent before harnessing web browsing data for ad targeting. Four groups representing broadband carriers sued to strike down the measure, but withdrew their challenge to the bill in 2022.

Around 20 states have passed comprehensive privacy laws since 2019, and at least nine others are currently considering such laws.