Maine governor signs strict internet privacy protection bill

Law would require Maine ISPs to get customers' approval before sharing or selling their personal data.

Steven Musil Night Editor / News
Steven Musil is the night news editor at CNET News. He's been hooked on tech since learning BASIC in the late '70s. When not cleaning up after his daughter and son, Steven can be found pedaling around the San Francisco Bay Area. Before joining CNET in 2000, Steven spent 10 years at various Bay Area newspapers.
Expertise I have more than 30 years' experience in journalism in the heart of the Silicon Valley.
Steven Musil
Getty Images

Maine's governor on Thursday signed into law one of the nation's strictest internet privacy protection bills.

The Act to Protect the Privacy of Online Consumer Information will require internet service providers in Maine to get permission from their customers before selling or sharing their data with a third party. The law, which goes into effect July 1, prohibits ISPs from offering customers discounts in exchange for selling their data.

"The internet is a powerful tool, and as it becomes increasingly intertwined with our lives, it is appropriate to take steps to protect the personal information and privacy of Maine people," Gov. Janet Mills said in a statement after signing the bill into law. "With this common-sense law, Maine people can access the internet with the knowledge and comfort that their personal information cannot be bought or sold by their ISPs without their express approval."

The law is similar to FCC rules approved in 2016 that would have required broadband companies to get their customers' permission before they sell "sensitive" information about their web browsing activity, app usage or whereabouts to marketers. But federal lawmakers repealed the rules in 2017 before they took effect.

California approved a similar law in 2018, which at the time had the country's toughest privacy requirements. But unlike California's law, Maine's newly signed law doesn't require consumers to make a request for companies to stop the collection and sale of their personal data.