Last year, the Maine Legislature adopted 10 MRSA c. 1055, which, among other things, attempted to extend COPPA-like protection to all minors (that is, children under the age of 18). The law was plagued by a number of issues, including questions regarding its constitutionality, and ultimately caused the Maine attorney general to promise not to enforce the law as written. Based on this, it was generally understood that the Maine Legislature would revisit the law in the 2010 legislature session.
The legislature did not wait long. On January 7, 2010, a new children's privacy bill was referred to the Maine Senate Committee on Business, Research, and Economic Development. The new bill, currently listed as LD 1677, would repeal the existing children's privacy law, but would enact a new prohibition on the collection and use of personal information that is: (a) collected and used on the Internet; (b) about a minor; or (c) for the purposes of pharmaceutical marketing.
Although this bill is narrower in scope than the law it seeks to replace, there are still problems with it. First, the bill applies to any personal information about a person under the age of 18, regardless of whether that information is related to health. Therefore, any information about a minor, including name, e-mail address, etc., would be covered. Second, the law seems to apply only to information collected on the Internet; it is unclear whether this information would apply to information collected through other means such as offline collection, mobile device, etc. Third, the text of the prohibition is poorly worded. The prohibition states that "any person may not collect and use information collected on the Internet ..." (emphasis added). Thus, by a literal reading of the text of the bill, a company could collect information about a minor for the purpose of pharmaceutical marketing and avoid liability if it does not use the information. Alternatively, a company could use information that is collected on the Internet by someone else since it would neither have collected nor used the information.
Of course, it is unlikely that the Maine attorney general would interpret the law in this way because this would create a substantial loophole. Instead, it is more likely that the law would be interpreted as creating two strict liability offenses—one for collection of information if the reason for the collection is to promote pharmaceutical sales, and one for the use of any information about a minor to promote pharmaceutical sales, whether or not the information was originally collected for that purpose.
Why This Matters: If enacted, this bill would place a higher burden on companies that sell either over-the-counter or prescription drugs, including pharmaceutical manufacturers and retailers. Such companies will have to be very careful with any marketing program that could conceivably collect or use information about a minor. For example, an e-mail blast with weekly offers that includes discounts on over-the-counter products could violate the bill's prohibition on marketing to children if a minor's e-mail address was included in the recipient list. Companies that sell pharmaceutical products should watch the progress of this bill closely to determine what kinds of systems should be created to avoid liability. There may be an opportunity to comment on rules that must be promulgated by the Maine attorney general within a year after enactment of the law.