A new Maine statute, scheduled to take effect on September 12, could drastically limit the ability of businesses to collect or use customer information. Although intended to prohibit predatory marketing practices targeting minors under the age of 18, the law is very broadly drafted and could make many common business activities unlawful. As a result, the new law, which applies to both online and offline businesses, potentially could affect any business that either is located in Maine, has customers residing in Maine or uses websites accessible from Maine.
The law prohibits businesses from knowingly collecting or receiving a minor's health-related information or personal information for marketing purposes without first obtaining verifiable parental consent (similar to the federal Children's Online Privacy Protection Act standard applicable to children under the age of 13). In addition, businesses are prohibited from using—without any scienter requirement—any health-related information or personal information regarding a minor for the purpose of marketing a product or service to the minor.
When first introduced, the bill restricted only the collection and use for marketing purposes of health-related information about persons under the age of 18. Before passage, however, it was expanded to restrict the collection and use for marketing purposes of "personal information" about minors as well.
In doing so, the Maine legislature adopted a very broad definition of "personal information":
- An individual's first name (or initial) and last name;
- A physical address;
- A Social Security number;
- A driver's license number; and
- Information about a minor that is collected in combination with any of these identifiers.
Thus, for example, the common practice of collecting a teenager's name via a website for marketing purposes would become illegal in Maine. The law apparently also would apply to the collection of a minor's name and address on a postcard at a concert or a county fair. However, it appears that collecting only a minor's screen or other name (if not based on the minor's real name) and nothing more would not run afoul of the statute.
A business could not transfer or sell any personal information about the minor for marketing purposes if the information: (1) was obtained without parental consent; or (2) identifies the minor. Finally, the law flatly prohibits—without any scienter requirement—the use of "personal information" regarding a minor "for the purpose of marketing a product or service to that minor or promoting any course of action for the minor relating to a product."
Implications for Business
Violations of the law are unfair trade practices under Maine law. In addition, violators are subject to civil actions for actual damages or up to $250 per violation, whichever is greater. As the statute appears to create strict liability, a business could face substantial exposure to a class-action lawsuit for unwitting violations.
The law raises obvious commercial speech and Commerce Clause issues, which is particularly important because nothing about the law purports to limit its scope to intrastate businesses. There is a possibility that the law may be challenged in court before it takes effect.
The Maine law has potentially far-reaching effect. Companies doing business in Maine should be particularly watchful, and should review their data collection practices to determine the potential implications of the law for their business.