ISPs must now ask for permission before selling your data, Maine rules

Internet providers will not be able to penalize those who refuse, either.
Written by Charlie Osborne, Contributing Writer

The state of Maine is taking a stand against Internet service providers (ISPs) that are monetizing customer information without consent by voting to pass a bill which will require express permission for such data harvesting.

On Thursday, the Maine Senate voted 35-0 to pass the bill, LD 946, which will require consumer consent before ISPs can sell their private information to third-parties.

ISPs, as the gatekeepers to our Internet access, are able to collect a vast array on our online activities if protections such as the use of virtual private networks (VPNs) are not in place. This may include website visits, browser histories, location data, and usage.

See also: Unsecured database exposes 85GB in security logs of major hotel chains

By creating a digital profile of our activities, ISPs can then sell this information on to advertisers and data brokers which are able to use this information in targeted business campaigns and tailored advertising.

LD 946 demands that ISPs secure the "express consent" of customers before "using, disclosing, selling or permitting access to customer personal information."

TechRepublic: Android Q: Cheat sheet

There may be the concern that ISPs could attempt to force the issue and apply pressure on customers in Maine by capping bandwidth or otherwise penalizing them if they refuse. However, the bill specifically prohibits this -- as well as offering a carrot in the form of discounts in return for permission.

The bill does make allowances for some exceptions, such as when consent is granted, the sale of data which is not personal, or when court orders have been issued, or also in cases of emergency.

Under the terms of LD 946, customers are able to withdraw their permission for data gathering by their ISP at any time.  

The decision builds upon earlier approval in the house, with votes rolling in at 96-45 in favor, and now only requires Governor Mills to agree and sign for the proposal to become law in the state.

Maine's decision flies in the face of US Congress overturning the same rule in 2017, promoted by the Federal Communications Commission (FCC) statewide, which would have ensured ISPs gained customer approval for the monetization of their information. This decision was considered a major loss for consumer privacy in the United States and also hamstrung the FCC by preventing the commission from being able to regulate the sale of data gathered by ISPs in the future.

CNET: Huawei scientists reportedly banned from reviewing IEEE science papers

"Today, the Maine legislature did what the United States Congress has thus far failed to do and voted to put consumer privacy before corporate profits," said Oamshri Amarasingham, advocacy director at the ACLU of Maine. "Nobody should have to choose between using the Internet and protecting their own data. Lest we forget, internet providers work for us. We pay them -- a lot -- for their services, and it is outrageous that they would turn around and sell our most private information without our consent."

The worst cyberattacks undertaken by nation-state hackers

Previous and related coverage

Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0

Editorial standards