On September 2, 2022, trade associations for the nation’s largest telecommunication services dropped a federal lawsuit that challenged a landmark Maine privacy law. The law provides some of the strongest protection for broadband internet customers in the country, according to PBS Newshour and other media outlets.1

The law – Title 35-A M.R.S.A. § 9301 – was passed by Maine’s legislature in 2019 as LD 946, sponsored by then-Senator Shenna Bellows (now Maine’s Secretary of State).  With limited exceptions, the law prohibits broadband Internet Service Providers (ISPs) from using, disclosing, selling, or permitting access to their customers’ personal information without affirmative consent.  The law defines customer personal information to include both personally identifying information, and information from a customer’s use of broadband internet. The law likewise provides opt-out protection for all other information pertaining to a customer.

The law buttresses the integrity of its opt-in requirement by prohibiting ISPs from tying it to financial incentives or penalties and protecting consumers’ right to revoke their consent.  The law also requires ISPs to implement data security measures and to provide a clear, conspicuous, and non-deceptive notice to its customers of the provider’s obligations and the customer’s rights.

LD 946 became law on July 1, 2020. Shortly thereafter, a group of telecommunications trade associations sued the state in federal court (20-cv-55-LEW (D. Me.)). The trade associations alleged that Maine’s law violated the First Amendment, was unconstitutionally vague, and was preempted by federal law.

Two pivotal decisions in the case led to the trade associations dismissing their suit. First, early in the case, the trade associations moved for judgment on the pleadings pursuant to Rule 12(c), and Maine cross-moved for judgment on the trade associations’ preemption claims. 2 The court denied the trade associations’ motion and granted Maine’s motion. With respect to preemption, the trade associations had alleged that Maine’s law was preempted by a 2017 Joint Resolution of Congress that revoked the Federal Communication Commission’s (FCC’s) 2016 ISP Privacy Order, which contained similar protections to those in Maine’s law, and the FCC’s subsequent Restoring Internet Freedom Order (“RIF Order”), in which the FCC determined that it lacked most authority to regulate ISPs.

The court concluded that Maine’s law was not preempted. As to the Joint Resolution, the court reasoned that Congress’s “‘disapproval’ of an individual FCC order neither creates a broad federal policy nor speaks to what states might do in the ISP Privacy Order’s absence. After the Joint Resolution, therefore, Maine had the same freedom to legislate to protect its citizens’ privacy that it had before the ISP Privacy Order went into effect.” As to the FCC’s RIF Order, the court determined that it did not conflict with Maine’s law, writing, “[t]he idea that the FCC’s relinquishment of authority over ISPs creates a federal scheme prohibiting state privacy regulation of ISPs blinks reality.”

The trade associations fared no better with their First Amendment argument, which the court determined should be given intermediate scrutiny under Central Hudson Gas & Electric Corporation v. Public Service Commission of New York, 447 U.S. 557, 561 (1980). Applying this standard, the court ruled that the record in the case was not yet sufficiently developed. As the court explained in the opening of its First Amendment analysis, “[h]aving decided that federal law does not preempt Maine’s Privacy Statute, I will consider Plaintiffs’ shoot-the-moon argument that the few uncontested facts in the record entitle them to final judgment on Count One, the claim that the Privacy Statute is a facially unconstitutional violation of the First and Fourteenth Amendments. Like Harold with a purple crayon, Plaintiffs have drawn themselves a steep mountain to climb by filing for judgment on the pleadings.”

Finally, the court denied the trade associations’ claim that Maine’s law was unconstitutionally vague, specifically with respect to its geographic scope and definition of “customer personal information,” largely because of the procedural posture.  As to geographic scope, the law applies “to providers operating within the State when providing broadband Internet access service to customers that are physically located and billed for service received in the State.”

As to “customer personal information,” the law defines it as “[p]ersonally identifying information about a customer,” including a customer’s name, billing information, social security number, billing address, and demographic data, as well as information from a customer’s use of broadband internet access service.

The court determined that a “less strict vagueness test” applied to commercial regulation like Maine’s law, and the test is still less strict when there are no criminal penalties. Therefore, based on the limited information available in the pleadings, the court reasoned that the law’s geographic scope is sufficiently clear, and that ISPs had ‘fair warning’ of Maine’s definition of “customer personal information” given its resemblance to the FCC’s ISP Privacy Order itself.

Thereafter, litigation continued for another two years. Following discovery, both the trade associations and Maine filed competing motions to exclude expert witnesses. In August 2022, the court denied the trade associations’ motion to exclude the testimony of Maine’s expert witness and reserved making a final decision on Maine’s motion to exclude the testimony of the trade associations’ two expert witnesses, while expressing deep skepticism about their admissibility.3

With respect to Maine’s expert—a computer science professor and former Chief Technologist for the FCC—the court concluded that he had significant relevant technical expertise in the field. Among other relevant information, Maine’s expert provided a detailed analysis of (1) how the internet ecosystem operates; (2) ISPs’ crucial gatekeeping role within the internet ecosystem; and (3) ISPs’ ability to leverage their position to access customer personal information.  The trade associations offered two experts—a law professor and a digital advertising executive. The law professor attempted to set forth a constitutional legal analysis of how Maine’s law compares to other states’ consumer privacy statutes, while the digital advertising executive claimed—with little evidence—that ISPs need not be regulated because they do not play a unique role in the internet ecosystem and that customers’ personal information is less valuable to an ISP than it is to other companies such as search engines or social networks. The court reasoned that their testimony was likely either inadmissible outright (e.g., the expert’s opinion as to the proper application of Central Hudson), of limited relevance to the constitutional questions at issue, or beyond the scope of their expertise. Nonetheless, because the court deemed it possible that some limited portion of the experts’ testimony would be admissible, it reserved judgment.

Following the court’s decision regarding expert testimony, the trade associations dismissed their lawsuit and agreed to reimburse Maine for over $55,000 in costs.

While Maine is pleased with the result, the Maine Attorney General’s Office continues to keep a close eye on other attempts to undermine Maine’s law and others like it.  Current federal privacy legislative efforts, for example, threaten the hard-fought progress Maine has made on behalf of its consumers. Maine will continue to work to ensure that Mainers receive the full benefit of LD 946.

Other articles in this edition include:

NAAG-NAGTRI Center for Consumer Protection logo

  1. Internet service providers drop challenge to Maine’s ‘opt-in’ privacy law, PBS Newshour, September 6, 2022; Maine Passes Nation’s Strictest Internet Privacy Protection Law, U.S. News & World Report, June 7, 2019. [↩]
  2. ACA Connects – America’s Communications Association, et al. v. Frey, Case No. 1:20-cv-00055-LEW, Order on Cross Motions for Judgment on the Pleadings, (July 7, 2020). [↩]
  3. ACA Connects – America’s Communications Association, et al. v. Frey, Case No. 1:20-cv-00055-LEW, Order on Motions to Exclude Expert Testimony, (August 18, 2022).[↩]

Related Posts