{
 "jurisdiction_id": "US-ME",
 "jurisdiction": "United States – Maine",
 "url": "https://dataprotection.gi/jurisdictions/united-states-maine/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-06",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 28,
  "sub_modules": 57,
  "source_register": 13
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "amber",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-maine/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "Fragmented sectoral framework with an active AG enforcer, but no omnibus statute currently in force.",
   "claims": [
    {
     "statement": "The Maine Attorney General is the primary state enforcement authority for consumer data-protection matters in Maine, including breach notification and general consumer-protection statutes.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "NAAG Attorney General Journal",
     "source_url": "https://www.naag.org/attorney-general-journal/an-internet-privacy-win-for-maine-consumers/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Maine has no comprehensive consumer-privacy statute; data protection is governed by a patchwork of the federal FTC Act Section 5, sectoral federal laws (HIPAA, GLBA, COPPA), and Maine's own sector-specific and breach-notification statutes.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Maine Notice of Risk to Personal Data Act, found at §1346 et seq. of Chapter 210-B, Part 3 of Title 10 of the Maine Revised Statutes, establishes the state's data breach notification requirement.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/maine-data-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Maine Insurance Data Security Act (LD 51) was signed into law on 17 March 2021, establishing data-security standards and exclusive investigation/notification standards for cybersecurity events applicable to insurance licensees.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/maine-maine-insurance-data-security-act-signed-law",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Maine Online Data Privacy Act (LD 1822), a comprehensive consumer-privacy bill modeled on Maryland's framework, passed the Maine Senate 20-14 on 5 March 2026 with a proposed 1 September 2027 effective date, but had not received final House concurrence or gubernatorial signature as of the most recent reporting available.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/state-of-the-states-maine-comprehensive-privacy-oregon-ai-chatbot-bills-on-the-move",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Maine's breach-notification statute applies to computerized personal information of Maine residents held by entities that own, license, or maintain such data.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/maine-data-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Act to Protect the Privacy of Online Customer Information applies to broadband internet access service providers serving customers physically located in and billed for service in Maine, rather than to controllers generally.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/maine-internet-privacy-law-enters-effect",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Maine does not impose a general controller registration or filing obligation on data controllers outside the insurance sector; the Maine Insurance Data Security Act requires certain filings by insurance licensees to the Superintendent of Insurance.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/maine-maine-insurance-data-security-act-signed-law",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "red",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-maine/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "No general lawful-basis, special-category, or anonymisation regime exists; only a narrow sectoral consent rule.",
   "claims": [
    {
     "statement": "Maine has no general statutory lawful-basis framework for personal-data processing equivalent to GDPR Article 6; processing is governed by sector-specific consent/opt-in rules and general FTC Act Section 5 unfairness/deception standards.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Act to Protect the Privacy of Online Customer Information requires broadband ISPs to obtain a customer's affirmative, opt-in consent before using, disclosing, selling, or permitting access to customer personal information, and prohibits tying consent to financial incentives or penalties.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/maine-internet-privacy-law-enters-effect",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Maine has no standalone special-category (sensitive data) statute; sensitive health data is addressed at the federal level through HIPAA rather than a Maine-specific sensitive-data regime.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "red",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-maine/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "Only a narrow, sector-specific revocation right exists; no general DSAR/erasure/portability framework.",
   "claims": [
    {
     "statement": "Maine's Act to Protect the Privacy of Online Customer Information provides broadband customers a right to revoke previously given consent to use, disclosure or sale of their personal information, but does not establish general access, rectification, erasure or portability rights akin to GDPR/CCPA.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/maine-internet-privacy-law-enters-effect",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-maine/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "Meaningful breach-notification and sectoral security duties exist, but accountability/DPIA/DPO/ROPA concepts are entirely absent.",
   "claims": [
    {
     "statement": "The Act to Protect the Privacy of Online Customer Information requires broadband ISPs to implement reasonable measures to protect customer personal information from unauthorized use, disclosure or access, calibrated to the nature and sensitivity of the data and the size of the provider.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/maine-internet-privacy-law-advances-consumer-privacy-protection-and-fills-federal-level",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Maine's Notice of Risk to Personal Data Act (Title 10 §1346 et seq.) requires notification of security breaches involving unencrypted personal information of Maine residents, with additional sector-specific notification obligations for insurance licensees under the Maine Insurance Data Security Act.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/maine-data-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Maine Insurance Data Security Act establishes exclusive standards for investigating and notifying the Superintendent of Insurance of a cybersecurity event affecting licensees, and requires licensees to maintain a written information security program.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/maine-maine-insurance-data-security-act-signed-law",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "red",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-maine/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "No state-level transfer or localisation regime exists; matters are governed only by general federal law and contract.",
   "claims": []
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-maine/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Insurance and telecoms sectors have dedicated Maine statutes; other listed sectors rely solely on federal law.",
   "claims": [
    {
     "statement": "Financial institutions and their affiliates subject to the federal Gramm-Leach-Bliley Act are exempted from Maine's Act to Protect the Privacy of Online Customer Information.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/comparing-maine-and-nevadas-new-privacy-laws-with-the-ccpa",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Entities subject to the federal Health Insurance Portability and Accountability Act of 1996 are exempted from Maine's Act to Protect the Privacy of Online Customer Information, reflecting reliance on HIPAA rather than a Maine-specific health-privacy statute.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/comparing-maine-and-nevadas-new-privacy-laws-with-the-ccpa",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Maine's Act to Protect the Privacy of Online Customer Information regulates broadband internet access service providers' use and disclosure of customer personal information.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/maine-internet-privacy-law-enters-effect",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Maine Insurance Data Security Act (LD 51, signed 17 March 2021) imposes data-security, investigation and notification standards on insurance licensees operating in Maine.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/maine-maine-insurance-data-security-act-signed-law",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "red",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-maine/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "No general adtech/commercial-privacy statute exists beyond the narrow ISP consent rule.",
   "claims": [
    {
     "statement": "Maine has no state-level comprehensive cookie-consent, dark-pattern, or cross-context-advertising statute; the closest analogue is the sector-specific opt-in consent regime for broadband ISPs under Title 35-A §9301, which does not extend to general online advertising or cross-context data sharing.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/maine-internet-privacy-law-enters-effect",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-maine/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "A notable government-use facial-recognition ban exists, but commercial biometrics, ADM transparency, and AI-risk-assessment concepts remain unregulated.",
   "claims": [
    {
     "statement": "Maine's LD 1585, An Act to Increase Privacy and Security by Regulating the Use of Facial Surveillance Systems by Departments, Public Employees and Public Officials, prohibits state, county and municipal departments, employees and officials from using or possessing facial recognition technology, with narrow statutory exceptions, and took effect 1 October 2021.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/maine-passes-statewide-facial-recognition-ban",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Maine's facial-surveillance law applies to government use only and does not regulate private-sector or commercial biometric data collection, leaving commercial biometric processing largely unregulated at the state level.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/maine-passes-statewide-facial-recognition-ban",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "amber",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-maine/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "Federal COPPA provides a baseline; state-specific enhancements remain only proposed (LD 1822).",
   "claims": [
    {
     "statement": "Children's online-privacy protection in Maine is governed by the federal COPPA framework, which requires operators of child-directed websites/services to obtain verifiable parental consent before collecting personal information from children under 13; Maine has no state-specific parental-consent or age-verification statute supplementing COPPA.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The pending Maine Online Data Privacy Act (LD 1822) would introduce enhanced children's-privacy protections modeled on Maryland's comprehensive framework, but has not been enacted as of the most recent reporting available.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/state-of-the-states-maine-comprehensive-privacy-oregon-ai-chatbot-bills-on-the-move",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "amber",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-maine/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "Active AG enforcement of breach law exists, but no dedicated data-privacy penalty schedule or private right of action.",
   "claims": [
    {
     "statement": "The Maine Attorney General enforces the state's consumer-protection and data-breach laws under general state consumer-protection authority; the Act to Protect the Privacy of Online Customer Information notably lacks an explicit statutory enforcement mechanism of its own.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/state-of-the-states-maine-comprehensive-privacy-oregon-ai-chatbot-bills-on-the-move",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Maine Attorney General has previously announced large-scale data breaches, such as the Managed Care of North America breach affecting approximately 8.9 million individuals disclosed in May 2023, reflecting active use of the state's breach-notification reporting regime.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "OneTrust DataGuidance",
     "source_url": "https://www.dataguidance.com/news/maine-ag-announces-managed-care-north-america-data",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "As of March 2026, the Maine Legislature advanced LD 1822, the Maine Online Data Privacy Act, through Senate passage (20-14) with a proposed 1 September 2027 effective date and updated AG enforcement funding provisions, representing the most significant potential change to Maine's data-protection landscape, though it had not received final enactment as of this run.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/state-of-the-states-maine-comprehensive-privacy-oregon-ai-chatbot-bills-on-the-move",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Maine's Act to Protect the Privacy of Online Customer Information does not create a private right of action for consumers; enforcement is limited to the Attorney General's general consumer-protection authority.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/state-of-the-states-maine-comprehensive-privacy-oregon-ai-chatbot-bills-on-the-move",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  }
 ]
}