A website user weighs whether to accept or deny cookies, small data files websites store on a user’s browser to remember their preferences. (Photo by Lauren McCauley/ Maine Morning Star)
The Maine Legislature has debated how aggressive the state should be in protecting consumer privacy online for the past several years. But competing proposals — along with sizable behind-the-scenes influence from lobbyists — have left the state still without a comprehensive data privacy law.
When lawmakers return in January, the issue will again be in play. However, this time, they will have insight into how the more stringent version of such law actually works in practice.
Deviating from the more than a dozen states that have adopted a model favored by industry groups, Maryland passed a version that places stricter standards on what data companies can collect or sell, similar to the proposal in Maine that has been favored by the majority of the Judiciary Committee. That law will take effect on Oct. 1.
In an interview with Maine Morning Star, Maryland Sen. Sara Love (D-Montgomery), one of the lead sponsors of the soon-to-be law, said it took several years and intentional countering of a sizable lobbying effort to get it passed. Quoting Maine Morning Star’s 2024 article on lobbying in Maine and across the country, Love said it was like “death by a thousand cuts” with trade organization lobbyists backed by Big Tech asking for more and more amendments.
“A legislator wants to work with groups and compromise with them, but all of a sudden you realize, if you do that, you have nothing — you have a bill that is not worth the paper it’s written on,” Love said. “So we decided ahead of time, what are the most important things to us? Where can we compromise, and where are we drawing the line?”
What ultimately got the bill over the finish line, Love said, was supportive committee chairs and “I think for us, the tech community overplayed their hand.” Another effort to undermine the Maryland law was attempted this year with a bill that Google explicitly supported, though it failed.
In Maine, there is still steep opposition from some lawmakers and local businesses to the proposal most similar to Maryland’s law. Some of the resistance is similar to that seen in Maryland, including concerns about untested language, but an uncertain economic landscape is now also part of the picture, including impact from President Donald Trump’s tariffs.
The proposals in Maine
Lawmakers started 2025 with three separate proposals.
The one favored by the Judiciary Committee was carried over into next year and, despite not actually making it to a vote in the Maine Senate or House of Representatives, it drew the most lobbying spending. This bill, LD 1822 sponsored by Rep. Amy Kuhn (D-Falmouth), would make Maine have some of the strictest consumer protections in the country.
The committee nixed a competing plan that was the favorite of business interests, LD 1224 sponsored by Rep. Tiffany Roberts (D-South Berwick), unanimously voting it down in an attempt to limit the number of proposals considered by the full Legislature.
A similar plan, LD 1088 sponsored by Rep. Rachel Henderson (R-Rumford), did make it to the floor but died upon adjournment after the House rejected it. But Henderson plans to propose her version again as an amendment to LD 1822 next year.
Disagreement over what the fundamental framework of such a law should be remains.
Kuhn’s bill relies on a data minimization standard, which broadly means limiting the collection of personal information to only what is necessary to fulfill the consumer service. This is the standard Maryland’s law uses.
The version businesses favor uses what’s referred to as an opt-in model, allowing companies to collect data as long as consumers agree to it.
“The whole point of a data privacy law is to reduce the amount of data overall that is collected about us, and this, in fact, would do that,” Kuhn said of her proposal.
Whereas Henderson said, “I know for sure that it does not go too far,” referring to her proposal’s regulations on businesses, “and that isn’t something I can say for LD 1822.”
Roberts did not respond to Maine Morning Star’s request for comment.
How will the proposals impact small businesses?
In both 2024 and 2025, a key point of pushback from businesses to the stricter proposal was that it would limit their ability to do targeted advertising, a tactic opponents say is disproportionately relied on by small businesses with limited marketing dollars.
Rep. Amy Kuhn (D-Falmouth), co-chair of the Judiciary Committee, answers questions about her data privacy legislation during a work session. (Photo by Emma Davis/ Maine Morning Star)
Kuhn built her bill off of one considered in the 131st Legislature and said she met with small businesses to try to address remaining concerns before the 132nd Legislature began.
She preserved exemptions that had already been negotiated, including for entire companies whose data collection is already regulated by federal laws. She also made a handful of tweaks based on feedback from businesses.
Notably, she eliminated data identifying an individual’s “online activities over time and across 3rd party websites or online services” from the definition of sensitive data, which would have reduced the ability to track cookies.
“It is critically important that Maine small businesses have access to these digital marketing tools,” Kuhn said. “That question is not in dispute.”
However, business interests are not satisfied.
Targeted advertising
Kuhn’s proposal wouldn’t restrict a business’ ability to do targeted advertising to existing customers, Curtis Picard, CEO of the Retail Association of Maine, which testified against LD 1822, told Maine Morning Star.
But Picard said it would place limits on how they can target new customers — a claim that Kuhn argues is false.
Picard gave the example of someone coming across an ad on social media that they engage with and then after the company pushes an ad or an email giving that person a discount on their first purchase.
“This is an example of a commonly stated generic concern — ‘businesses won’t be able to reach future customers’ — that has been frequently made without any substantiation,” Kuhn said.
Kuhn pointed out that, in that scenario, if a consumer is presented with an ad on social media and then clicks on the link, the consumer has requested a product or service — in this case, access to the website — and received it. Therefore, she said, cookies can be attached and subsequent ads are permitted.
Kuhn’s proposal sets two thresholds for data collection.
It would restrict the collection of personal data (information that can be reasonably linked to a consumer) to only what’s “reasonably necessary and proportionate” to provide the service requested by a consumer. It would also restrict the collection of sensitive data (such as race, citizenship, genetic and other information as defined in the bill) to only what’s “strictly necessary” in that scenario, and outright ban such information from being sold.
“A lot of well meaning small businesses are saying it’s going to hurt them but they can’t articulate how,” Rep. Adam Lee (D-Auburn), a co-sponsor of Kuhn’s bill who also sits on the Judiciary Committee, told Maine Morning Star. “The only answer we’re getting back is uncertainty, which is, in Augusta speak, we don’t actually have any policy concerns with the bill anymore.”
At a work session on May 23, Kuhn asked Stacy Stitham, managing partner at Brann & Isaacson who was working on behalf of the Maine State Chamber of Commerce, “Where in the bill is there a barrier to reaching a new customer?”
Stitham responded, “You have to go back to basically the first sentence of the statute which limits the collection of data to what’s reasonably necessary and proportionate to provide or maintain a specific product or service requested by the consumer,” which is the data minimization standard.
This mirrors the Maryland law. Stitham added, “As we know, the Maryland law is not in effect yet. We don’t know how that’s being interpreted, but it’s much different than the standard that’s used by other states which talk about disclosed purposes.”
During the final work session for the bill this year on May 30, Maine Assistant Attorney General Brendan O’Neil from the consumer protection office said, “I don’t see a restriction on targeted advertising in the bill.”
There is currently a patchwork of state laws and parts of federal legislation governing internet privacy, as there remains no one overarching federal law, despite several proposals. Connecticut was the fifth state to enact an omnibus privacy law in 2022 but its version, the one favored by industry groups, has been the model adopted by most states that followed.
In the work session, O’Neil pointed to the Connecticut’s attorney general’s recommendation for its state Legislature to amend the law to strengthen data minimization provisions rather than rely on its current “exploitable” consent model.
Reading from the officer’s report, O’Neil summarized, “‘serious privacy and data security concerns could have been offset, if not fully alleviated, if companies had properly minimized the data they collected and maintained.’ That’s really what LD 1822’s data minimization standard aims to do.”
Connecticut tweaked its law in several ways this spring, but did not ultimately adopt the data minimization standard as seen in Kuhn’s proposal and the Maryland law.
Consumer consent
On May 29, a coalition of business groups including the Maine State Chamber of Commerce sent a letter to the Judiciary Committee outlining their major concerns, notably the data minimization standard.
But the letter also took issue with the sensitive data restrictions — which mirror those in Maryland’s law — arguing instead that data use should be tied to consumer consent, not based on data type.
Republican Rep. Rachel Henderson of Rumford (middle) discusses her data privacy proposal with Judiciary Committee analyst Janet Stocco (left). (Photo by Emma Davis/ Maine Morning Star)
This was another common argument brought up by those who favored Henderson’s version.
“They want to completely remove consent so that a consumer can’t even consent to have their information used to get discounts or to be marketed to and I want to keep that consent piece,” Henderson said.
Stitham, representing the Maine State Chamber of Commerce, made a similar point this spring.
“While clearly intended to be more consumer protective,” Stitham said, “by shifting the focus from consumer consent to disclosed purposes to whatever the business can characterize as needed to provide or maintain a requested product or service, the bill actually eliminates consumer choice and control, and potentially leaves room for businesses to justify broad data collection practices without the consumer’s clear, informed consent.”
Kuhn and lawmakers who favor her proposal said this argument rests on a false contention that Maine consumers engage in informed and voluntary consent now.
Sen. Anne Carney (D-Cumberland) said Henderson’s bill “was essentially preserving the status quo with regard to the protections that consumers currently have in the absence of any data privacy law.”
It would take the average person more than 40 hours per month to read the privacy policies that an American consumer typically encounters each month, according to testimony given to the committee and affirmed by recent studies.
Kuhn gave the example of health tracker apps that require consumer consent to the terms and conditions in order to use the product when saying, “That’s not voluntary consent. It’s a mandatory threshold.”
Henderson drew a distinction between lengthy terms and conditions and what would be required in her bill. “It has to be clear, conspicuous, bold,” she said of the privacy notice allowing consumers to opt out of having their data sold or used in marketing.
SUPPORT: YOU MAKE OUR WORK POSSIBLE
When asked to comment on their latest stance on Kuhn’s bill, L.L. Bean deferred to the company’s testimony, in which legal counsel Christy van Voorhees argued LD 1822’s data minimization standard effectively bans the vast majority of personalized, targeted advertising.
This testimony echoed that of many businesses, but also underscored that the current political landscape is another key factor.
“These restrictions are being proposed at a historically challenging time for Maine retailers,” van Voorhees said. “The ongoing retreat of Canadian customers from U.S. businesses, coupled with the increased costs associated with new universal and threatened reciprocal tariffs, is squeezing marketing budgets. That means that the marketing investments we do make have to be efficient. Personalized, targeted ads are among our most efficient marketing investments.”
Concern of economic uncertainty — which was also raised by industry associations such as HospitalityMaine and individual businesses like Union River Lobster Pot restaurant — makes Kuhn believe the decision to carry over her bill to the next session was the best choice, as well as opportune timing with the start of Maryland’s law.
With an effective date of Oct. 1, Maryland’s law will provide three months of results by the time the Maine Legislature returns in January, though there is also a cure period, giving entities 60 days to adhere after a notice of violation from the Maryland Attorney General on or before April 1, 2027.
“We’ll be able to see, what impact did this phrasing, this language, have on small businesses in Maryland?” Kuhn said. “Were they able to continue to draw ads just as they can now?”
As Maine has considered a data privacy law, businesses have stressed the importance of interoperability between states.
“I’m getting tired of Maine being this petri dish for national groups trying to get first-in-the-nation type of legislation,” said Picard, of the retail association. “I do think Representative Kuhn was trying to make it work, but ultimately it ends up being convoluted and complex language that has been untested.”
Now, Kuhn and supporters of her proposal say Maryland’s law will provide that test, affording a preview of how passing such a law would go in Maine.
But others say it’ll be too soon to tell.
“You’re not going to see the sky fall in a few months,” Henderson said.
Kuhn and Henderson said if either version of a data privacy law is finally passed next session, continuous adjustments will still be needed. Both of their bills would require annual reviews by the state attorney general, similar to those required in other states.
Currently, LD 1822, Kuhn’s bill that was carried over, is still in possession of the Maine House. It’s unclear whether the body will recommit it to committee or take action on the floor when lawmakers return.
Other than shifting the implementation date back, Kuhn doesn’t plan to amend her proposal, but she said she’s leaving the possibility open if any glaring need for changes become apparent once Maryland’s law is in effect.
There is also a concept draft, LD 595 sponsored by Carney, being carried over into next year. It currently reads that it could “further update certain consumer privacy laws in response to recent developments in federal and state consumer privacy laws.”
Carney said she originally filed the placeholder bill not knowing what the changes would be made to Connecticut’s law or possible federal law. The legislation will now serve a similar purpose next year as a way for the Judiciary Committee to address the moment — whatever it may look like — if needed.
– This articlel first appeared in Maine Morning Star, which is part of States Newsroom, a nonprofit news network supported by grants and a coalition of donors as a 501c(3) public charity. Maine Morning Star maintains editorial independence. Contact Editor Lauren McCauley for questions: info@mainemorningstar.com.
