United States – Maine

Regulator And AuthorityAmber

The Maine AG is the primary state enforcer for consumer-protection and breach-notification matters; the FTC is the concurrent federal enforcer under Section 5.

Claims (1):

• The Maine Attorney General is the primary state enforcement authority for consumer data-protection matters in Maine, including breach notification and general consumer-protection statutes.

Act And InstrumentsAmber

Instruments include the Notice of Risk to Personal Data Act, the Maine Insurance Data Security Act, the Act to Protect the Privacy of Online Customer Information, and the pending LD 1822.

Claims (4):

• Maine has no comprehensive consumer-privacy statute; data protection is governed by a patchwork of the federal FTC Act Section 5, sectoral federal laws (HIPAA, GLBA, COPPA), and Maine's own sector-specific and breach-notification statutes.
• The Maine Notice of Risk to Personal Data Act, found at §1346 et seq. of Chapter 210-B, Part 3 of Title 10 of the Maine Revised Statutes, establishes the state's data breach notification requirement.
• The Maine Insurance Data Security Act (LD 51) was signed into law on 17 March 2021, establishing data-security standards and exclusive investigation/notification standards for cybersecurity events applicable to insurance licensees.
• The Maine Online Data Privacy Act (LD 1822), a comprehensive consumer-privacy bill modeled on Maryland's framework, passed the Maine Senate 20-14 on 5 March 2026 with a proposed 1 September 2027 effective date, but had not received final House concurrence or gubernatorial signature as of the most recent reporting available.

Material ScopeAmber

Material scope is defined narrowly per-instrument (e.g., computerized personal information for breach law; broadband customer information for the ISP law) rather than by a single omnibus definition.

Claims (1):

• Maine's breach-notification statute applies to computerized personal information of Maine residents held by entities that own, license, or maintain such data.

Territorial ScopeAmber

Territorial scope is instrument-specific; the ISP privacy law applies to providers billing Maine-located customers rather than to controllers generally.

Claims (1):

• The Act to Protect the Privacy of Online Customer Information applies to broadband internet access service providers serving customers physically located in and billed for service in Maine, rather than to controllers generally.

Regulator Registration And FilingAmber

No general controller registration/filing regime exists outside the insurance sector, where the IDSA imposes filing obligations to the Superintendent of Insurance.

Claims (1):

• Maine does not impose a general controller registration or filing obligation on data controllers outside the insurance sector; the Maine Insurance Data Security Act requires certain filings by insurance licensees to the Superintendent of Insurance.

Lawful BasesRed

No general enumerated lawful-basis framework exists in Maine law; processing outside the ISP-consent rule is governed only by general FTC unfairness/deception norms.

Claims (1):

• Maine has no general statutory lawful-basis framework for personal-data processing equivalent to GDPR Article 6; processing is governed by sector-specific consent/opt-in rules and general FTC Act Section 5 unfairness/deception standards.

Consent ThresholdsAmber

The ISP privacy law sets an opt-in, revocable consent standard for broadband customer data, the strongest consent standard in Maine's statutory scheme.

Claims (1):

• The Act to Protect the Privacy of Online Customer Information requires broadband ISPs to obtain a customer's affirmative, opt-in consent before using, disclosing, selling, or permitting access to customer personal information, and prohibits tying consent to financial incentives or penalties.

Special CategoriesRed

No Maine-specific sensitive/special-category data statute exists; health data is addressed federally via HIPAA.

Claims (1):

• Maine has no standalone special-category (sensitive data) statute; sensitive health data is addressed at the federal level through HIPAA rather than a Maine-specific sensitive-data regime.

Pseudonymisation And AnonymisationRed

No Maine statutory definition or safe-harbour for pseudonymised/anonymised data was identified.

Access RightRed

No general access right exists outside the ISP-consent-revocation mechanism.

Claims (1):

• Maine's Act to Protect the Privacy of Online Customer Information provides broadband customers a right to revoke previously given consent to use, disclosure or sale of their personal information, but does not establish general access, rectification, erasure or portability rights akin to GDPR/CCPA.

Rectification And ErasureRed

No general rectification or erasure right identified in Maine statute.

Restriction And ObjectionAmber

The ISP privacy law's consent-revocation right functions as a limited restriction/objection mechanism for broadband customer data only.

Claims (1):

• Maine's Act to Protect the Privacy of Online Customer Information provides broadband customers a right to revoke previously given consent to use, disclosure or sale of their personal information, but does not establish general access, rectification, erasure or portability rights akin to GDPR/CCPA.

Data PortabilityRed

No data-portability right identified in Maine statute.

Deadlines And Response WindowsRed

No general statutory response-window regime exists for consumer rights requests in Maine.

Accountability And DpiaRed

No DPIA or general accountability-principle statute identified.

Dpo RequirementsRed

No DPO appointment threshold or independence requirement identified in Maine law.

Ropa RequirementsRed

No records-of-processing requirement identified in Maine law.

Joint Controller ArrangementsRed

No joint-controller regime identified in Maine law.

Security MeasuresAmber

The ISP privacy law and the Insurance Data Security Act impose sector-specific technical/organisational security obligations.

Claims (1):

• The Act to Protect the Privacy of Online Customer Information requires broadband ISPs to implement reasonable measures to protect customer personal information from unauthorized use, disclosure or access, calibrated to the nature and sensitivity of the data and the size of the provider.

Breach NotificationAmber

The Notice of Risk to Personal Data Act and the Insurance Data Security Act together form Maine's breach-notification regime.

Claims (2):

• Maine's Notice of Risk to Personal Data Act (Title 10 §1346 et seq.) requires notification of security breaches involving unencrypted personal information of Maine residents, with additional sector-specific notification obligations for insurance licensees under the Maine Insurance Data Security Act.
• The Maine Insurance Data Security Act establishes exclusive standards for investigating and notifying the Superintendent of Insurance of a cybersecurity event affecting licensees, and requires licensees to maintain a written information security program.

Retention And DisposalRed

No general retention/disposal mandate identified outside sector-specific insurance rules.

Transfer MechanismsRed

No Maine-specific transfer mechanism identified.

Adequacy ReceivedRed

Not applicable at state level; adequacy determinations are a national/federal or foreign-regime concept, not issued by Maine.

Adequacy GrantedRed

Not applicable; Maine issues no adequacy determinations.

Sccs And BcrsRed

No Maine-specific SCC/BCR framework identified.

Transfer Impact AssessmentRed

No TIA requirement identified in Maine law.

Data LocalisationRed

No data-localisation mandate identified in Maine law.

Financial Sector OverlayAmber

Financial institutions are exempted from the ISP privacy law where already subject to the federal Gramm-Leach-Bliley Act.

Claims (1):

• Financial institutions and their affiliates subject to the federal Gramm-Leach-Bliley Act are exempted from Maine's Act to Protect the Privacy of Online Customer Information.

Health Sector OverlayAmber

Health-sector data is governed by federal HIPAA rather than a Maine-specific statute; HIPAA-regulated entities are exempted from the ISP privacy law.

Claims (1):

• Entities subject to the federal Health Insurance Portability and Accountability Act of 1996 are exempted from Maine's Act to Protect the Privacy of Online Customer Information, reflecting reliance on HIPAA rather than a Maine-specific health-privacy statute.

Telecoms And EprivacyAmber

The ISP privacy law is Maine's primary telecoms/eprivacy-style instrument, regulating broadband providers' use of customer data.

Claims (1):

• Maine's Act to Protect the Privacy of Online Customer Information regulates broadband internet access service providers' use and disclosure of customer personal information.

Employment DataRed

No Maine-specific employment-data privacy statute identified; federal HIPAA/ADA/GINA penumbral protections apply as elsewhere in the US.

Credit And ScoringRed

No Maine-specific credit-scoring privacy statute identified; federal FCRA applies nationally.

EducationRed

No Maine-specific K-12 student-data-privacy statute was confirmed in this research pass; federal FERPA applies as the baseline.

InsuranceAmber

The Maine Insurance Data Security Act imposes dedicated data-security and breach standards on insurance licensees.

Claims (1):

• The Maine Insurance Data Security Act (LD 51, signed 17 March 2021) imposes data-security, investigation and notification standards on insurance licensees operating in Maine.

Cookies And TrackersRed

No cookie/tracker-specific statute identified.

Dark PatternsRed

No dark-pattern prohibition identified in Maine law.

Opt Out SignalsRed

No statutory recognition of universal opt-out signals (e.g., GPC) identified in Maine law.

Clean Rooms And DcrRed

No clean-room/data-collaboration-room regulation identified.

Cross Context AdvertisingRed

No cross-context-advertising or 'sale'/'share' framework identified; the ISP consent rule is the closest analogue but is sector-limited.

Claims (1):

• Maine has no state-level comprehensive cookie-consent, dark-pattern, or cross-context-advertising statute; the closest analogue is the sector-specific opt-in consent regime for broadband ISPs under Title 35-A §9301, which does not extend to general online advertising or cross-context data sharing.

Direct MarketingRed

No general direct-marketing consent/suppression statute identified.

Profiling RestrictionsRed

No profiling-restriction statute analogous to GDPR Art 22 identified.

Automated Decision Making TransparencyRed

No ADM transparency/explanation-right statute identified.

Ai Risk AssessmentsRed

No AI-specific risk-assessment statute identified at Maine state level.

Biometric RegimeAmber

LD 1585 bans government departments/officials from using or possessing facial-recognition technology, with narrow exceptions; commercial biometric use remains unregulated.

Claims (2):

• Maine's LD 1585, An Act to Increase Privacy and Security by Regulating the Use of Facial Surveillance Systems by Departments, Public Employees and Public Officials, prohibits state, county and municipal departments, employees and officials from using or possessing facial recognition technology, with narrow statutory exceptions, and took effect 1 October 2021.
• Maine's facial-surveillance law applies to government use only and does not regulate private-sector or commercial biometric data collection, leaving commercial biometric processing largely unregulated at the state level.

Genetic DataRed

No Maine-specific genetic-data privacy statute identified in this research pass.

State Surveillance CarveoutsAmber

LD 1585 is itself a surveillance-limiting statute rather than a carve-out; it restricts, rather than exempts, government facial-surveillance use.

Claims (1):

• Maine's LD 1585, An Act to Increase Privacy and Security by Regulating the Use of Facial Surveillance Systems by Departments, Public Employees and Public Officials, prohibits state, county and municipal departments, employees and officials from using or possessing facial recognition technology, with narrow statutory exceptions, and took effect 1 October 2021.

Age VerificationAmber

No Maine-specific age-verification statute identified; COPPA's under-13 threshold applies federally.

Claims (1):

• Children's online-privacy protection in Maine is governed by the federal COPPA framework, which requires operators of child-directed websites/services to obtain verifiable parental consent before collecting personal information from children under 13; Maine has no state-specific parental-consent or age-verification statute supplementing COPPA.

Parental ConsentAmber

COPPA's verifiable-parental-consent requirement is the operative standard for Maine; no state-specific supplement is currently in force.

Claims (1):

• Children's online-privacy protection in Maine is governed by the federal COPPA framework, which requires operators of child-directed websites/services to obtain verifiable parental consent before collecting personal information from children under 13; Maine has no state-specific parental-consent or age-verification statute supplementing COPPA.

Minor Profiling BansRed

No minor-profiling ban currently in force in Maine; LD 1822 proposes enhanced children's-privacy protections if enacted.

Claims (1):

• The pending Maine Online Data Privacy Act (LD 1822) would introduce enhanced children's-privacy protections modeled on Maryland's comprehensive framework, but has not been enacted as of the most recent reporting available.

Education SettingsRed

No Maine-specific education-sector student-data statute was confirmed in this research pass; federal FERPA applies as baseline.

Dependent AdultsRed

No dependent-adult-specific data-protection statute identified in Maine law.

Regulator Powers And PenaltiesAmber

The AG enforces via general consumer-protection powers; the ISP privacy law lacks an explicit dedicated enforcement mechanism.

Claims (1):

• The Maine Attorney General enforces the state's consumer-protection and data-breach laws under general state consumer-protection authority; the Act to Protect the Privacy of Online Customer Information notably lacks an explicit statutory enforcement mechanism of its own.

Enforcement Activity IndexAmber

The AG actively tracks and announces large-scale breaches under the breach-notification statute.

Claims (1):

• The Maine Attorney General has previously announced large-scale data breaches, such as the Managed Care of North America breach affecting approximately 8.9 million individuals disclosed in May 2023, reflecting active use of the state's breach-notification reporting regime.

Regulator Funding And CapacityAmber

LD 1822 (if enacted) proposes updates to AG enforcement funding specific to comprehensive privacy enforcement; no current dedicated funding line was identified for existing sectoral statutes.

Claims (1):

• As of March 2026, the Maine Legislature advanced LD 1822, the Maine Online Data Privacy Act, through Senate passage (20-14) with a proposed 1 September 2027 effective date and updated AG enforcement funding provisions, representing the most significant potential change to Maine's data-protection landscape, though it had not received final enactment as of this run.

Collective Redress And Class ActionsRed

No Maine-specific collective-redress mechanism for data-privacy claims was identified beyond general state consumer-class-action rules.

Private Right Of ActionRed

Maine's ISP privacy law does not create a private right of action; enforcement is limited to AG authority.

Claims (1):

• Maine's Act to Protect the Privacy of Online Customer Information does not create a private right of action for consumers; enforcement is limited to the Attorney General's general consumer-protection authority.

Recent Developments 180DAmber

The most significant recent development is the continued advancement of LD 1822 through the Legislature (Senate passage 5 March 2026), not yet enacted.

Claims (1):

• As of March 2026, the Maine Legislature advanced LD 1822, the Maine Online Data Privacy Act, through Senate passage (20-14) with a proposed 1 September 2027 effective date and updated AG enforcement funding provisions, representing the most significant potential change to Maine's data-protection landscape, though it had not received final enactment as of this run.