Here we are again, folks: Maine is considering a sweeping data privacy bill.

We were last here in 2024, when legislators debated a new regulatory framework for data privacy in the state. The new bill is substantively different, reflecting enormous changes in our national political and regulatory environments in a very short time. 

Two years ago, regulating data privacy in the United States was in the frontier stage. The federal government, split between a Republican Congress and a Democratic president, was doing nothing on the issue in the midst of an election year — and it still hasn’t. At the state level, very few states had passed any data privacy laws, and none were as sweeping as the one proposed in Maine in 2024. We would have been at the forefront and, as a relatively small state, we would have shouldered the cost of litigation early.

Since then, more than a dozen states have either passed new data privacy laws or implemented and enforced them. They’ve been passed in Republican- and Democrat-controlled states alike, although the versions differ from state to state. Maine’s newest version under consideration —LD 1822, An Act to Enact the Maine Online Data Privacy Act, which has passed the Maine House in an initial vote — is more restrained than what was considered two years ago. Still, it leans more toward the California model of a data privacy law than the Texas one.

Unlike the prior iteration, this new bill does not create a whole new state agency to enforce the legislation. Enforcement is left to the Maine Attorney General, as is typical with many other consumer protection laws here. This bill works within the existing structure, and that’s important: it both reduces cost and avoids setting a new precedent that could be followed down the road in other fields. We don’t need a separate agency for every industry to enforce consumer protections in a small state like Maine.

The new version of the bill also doesn’t allow for private right of action, as the initial iteration did. That’s important, as it removes a practically challenging and legally risky component that the state would have needed to defend in court. It also doesn’t have a $5,000 minimum statutory damage or a ban on arbitration to settle disputes.

Overall, the version under consideration two years ago was just too innovative. It both went around the current system we have in place for enforcement of consumer protections in Maine and proposed policies that no other state had put in place.

This newer version, while still not ideal, is far more measured and reasonable. By fitting it within the framework of laws passed in other states, the risk of costly litigation is dramatically lowered. That’s not a trivial concern any time a state, and especially a small state like Maine, attempts to regulate large corporations.

Maine doesn’t have the legal or economic resources to go around picking fights with large corporations; states like California and Texas do. Maine picking fights like that before California or New York, as we would have been two years ago, would be like Liechtenstein trying to implement tougher policies than Germany or France. 

Now, there are still certain elements of this proposed law that are concerning: for one, it has a clause about geofencing around health care facilities. That measure would prohibit companies from using location data within 1,750 feet of any in-person health care facilities for targeted ads. That’s a provision that doesn’t exist in California’s current law, and companies would have to change their practices in order to comply with it.

Most of the rest of the bill, however, is similar to provisions already in place in California, Texas and other states that have passed such laws recently.

In 2024, the proposed law went further than any other state had yet considered; this version is much more constrained. It will still need tweaking.

The concept of data privacy rights itself is not inherently partisan. Politicians in both parties are concerned about data privacy; they simply differ in how they envision regulating it. That’s a gap that can be closed, if they elect to put in the work to do so. In Washington, that’s unlikely in the midst of a heated election year. In Augusta, hopefully, the two parties can be more reasonable and work together to overcome what differences they have to keep us all safe.