Maine enacted "An Act To Prevent Predatory Marketing Practices Against Minors" that prohibits the collection, receipt and use of personal information and health-related information from minors for marketing purposes without first obtaining verifiable parental consent. The Act, which takes effect September 12, 2009, could significantly impact any entity, such as a sweepstakes sponsor, that collects, receives or uses personal information or health-related information, as those terms are defined, from children under 18.
Although the Act is similar to the federal Children's Online Privacy Protection Act (COPPA), it differs in several important ways. First, the Maine law applies to information of minors (i.e., children under 18), not just children under 13 as in COPPA. Second, COPPA is limited to the online collection of children's information while the Maine law applies to the online and offline collection, use and receipt of children's information. Third, the Maine law does not contain exceptions that exist in COPPA, such as allowing an entity to use a child's email address for a one-time notification. Fourth, COPPA applies broadly to the collection of children's information for any purpose while the Maine law is limited to the collection, receipt of use of information for marketing purposes.
The Maine Act is summarized below. (A copy of the Act is available on the Loeb & Loeb LLP web site at www.loeb.com/files/Uploads/AdPro_Client_Alert_Maine_Act.pdf.)
Under the Act, it is unlawful for an entity to knowingly collect or receive health-related information or personal information for marketing purposes from a minor without first obtaining verifiable parental consent of that minor's parent or legal guardian. Verifiable parental consent is defined as "any reasonable effort, taking into consideration available technology, including a request for authorization for future collection, use and disclosure described in the notice, to ensure that a parent of a minor receives notice of the collection of personal information, use and disclosure practices and authorizes the collection, use and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that minor."
It is also unlawful for an entity to sell, offer for sale or otherwise transfer to another person health-related information or personal information about a minor if that information: (a) was unlawfully collected without first obtaining verifiable parental consent; (b) individually identifies the minor; or (c) will be used in "predatory marketing."
The Act prohibits predatory marketing which is described as the use of any health-related information or personal information regarding a minor for the purpose of marketing a product or service to that minor or promoting any course of action for the minor relating to a product.
Health-related information is "any information about an individual or a member of the individual's family relating to health, nutrition, drug or medication use, physical or bodily condition, mental health, medical history, medical insurance coverage or claims or other similar data."
Personal information means "individually identifiable information, including: (1) an individual's first name, or first initial, and last name; (2) a home or other physical address; (3) a social security number; (4) a driver's license number or state identification card number; and (5) information concerning a minor that is collected in combination with an identifier described in this subsection."
Each unlawful collection of data or unlawful predatory marketing event constitutes a violation of the law. The statute provides three potential remedies for each violation: (1) relief as an unfair trade practice (enforced by both the Maine Attorney General and private rights of action specified in the Maine Unfair Trade Practices Act), (2) a private right of action for injunctive relief and/or damages, including attorneys' fees (monetary damages may be trebled if the court finds that the defendant willfully or knowingly violated the law), and (3) a civil violation with monetary fines of not less than $10,000 and not more than $20,000 for a first violation, and not less than $20,000 for each subsequent violation.