An Act to Enact the
Maine Legislature, Session 132, LD 1822
Committee Amendment CA_B_H717 (House)

COMMITTEE AMENDMENT '0~" to H.P. 1220, L.D. 1822, "An Act to Enact the 
Maine Online Data Privacy Act" 
V 
Amend the bill by striking out the title and substituting the following: 
'An Act to Enact the Maine Consumer Data Privacy Act' 
Amend the bill by striking out eve1ything after the enacting clause and insetting the 
following: 
'Sec. 1. 10 MRSA c. 1057 is enacted to read: 
CHAPTER 1057 
MAINE CONSUMER DATA PRIVACY ACT 
§9601. Short title 
This chapter may be known and cited as 
11the Maine Consumer Data Privacy Act.
§9602. Definitions 
As used in this chapter. unless the context otherwise indicates. the following terms 
have the following meanings. 
1. 
Affiliate. 
11Affiliate
means a business or nonprofit organization that shares 
common branding with another business or nonprofit organization or controls. is controlled 
by or is under common control with another business or nonprofit organization. 
2. 
Biometric data. 
"Biometric data
means data generated by automatic 
measurements of an individual's biological characteristics. such as a fingerprint. voiceprint. 
retina, iris or other unique biological pattern or characteristic that is used to identify a 
specific individual. "Biometric data" does not include: 
A. A digital or physical photograph: 
Page I - 132LR0014(03) 
COMMITTEE AMENDMENT 
" 
~QS, 
,,-••' 
COMMITTEE AMENDMENT "8 "to H.P. 1220, L.D. 1822 
B. An audio or video recording: 
C. Any data generated from a digital or physical photograph or an audio or video 
recording, unless the data is generated to identify a specific individual; or 
D. Data collected, used or stored for health care treatment, payment or operations under 
the federal Health Insurance Portability and Accountability Act of 1996, 42 United 
States Code, Chapter 7. Subchapter XI. Patt C. and the regulations, rules, guidance and 
exemptions adopted pursuant to that Act. 
3. Business associate. "Business associate" has the same meaning as in 45 Code of 
Federal Regulations, Section 160.103. 
4. Child. "Child" means an individual who has not attained 13 years of age. 
5. Consent. "Consent'' means a clear affomative act signifying a consumer's freely 
given. specific, informed and unambiguous agreement to allow the processing of personal 
data relating to the consumer. "Consent" may include a written statement, including by 
electronic means. that is made in the language the consumer uses to obtain a product or 
service from the controller and in a format that is reasonably accessible to and usable by 
consumers with disabilities. "Consent" does not include: 
A. 
Acceptance of a tenns of use document or similar document that contains 
descriptions of personal data processing along with other unrelated infonnation: 
B. Hovering over, muting, pausing or closing a given piece of content: or 
C. Agreement obtained through the use of a dark pattem. 
6. Consumer, "Consumer" means an individual who is a resident of this State. 
"Consumer" does not include an individual acting in a commercial or employment context 
or as an employee. owner, director. officer or contractor of a company. pa1tnership, sole 
proprietorship, nonprofit organization or government agency whose communications or 
transactions with the controller occur solely within the context of that individual's role with 
the company, pa1tnership, sole proprietorship. nonprofit organization or government 
agency, 
7, Control. "Control" means: 
A. Ownership of, or the power to vote, more than 50% of the outstanding shares of 
any class of voting security of a company: 
B. Control in any manner over the election of a majority of the directors of a company 
or of individuals exercising similar functions in a company: or 
C. Power to exercise controlling influence over the management of a company. 
8. Controller. "Controller" means a person that, alone or jointly with other persons, 
determines the purpose and means of processing personal data. 
9. COPPA. "COPPA" means the federal Children's Online Privacy Protection Act of 
1998, 15 United States Code, Section 6501 et seq. and the regulations, rules, guidance and 
exemptions adopted pursuant to that Act, as that Act and such regulations, rules, guidance 
and exemptions may be amended from time to tin1e. 
10. Covered entity. "Covered entity" has the same meaning as in 45 Code of Federal 
Regulations. Section 160.103. 
COMMITTEE AMENDMENT 
·~OS 
COMMITTEE AMENDMENT•£" to H.P. 1220, L.D. 1822 
11. Dark pattern. "Dark pattem" means a user interface designed or manipulated 
with the substantial effect of subverting or impairing user autonomy, decision-making or 
choice and includes, but is not limited to, any practice the Federal Trade Commission refers 
to as a dark pattem. 
12. Decisions that produce legal or similarly significant effects concerning the 
consumer. "Decisions that produce legal or similarly significant effects concerning the 
consumer" means decisions that result in the provision or denial to the consumer of 
financial or lending services, housing, insurance, education enrollment or opp01tunity, 
criminal justice, employment oppo1tunities, health care services or access to essential 
goods or services. 
13. De-identified data. "De-identified data" means data that cannot reasonably be 
used to infer info1mation about or otherwise be linked to an identified or identifiable 
individual, or a device linked to an individual, if the controller that possesses the data: 
A. Takes reasonable measures to ensure that the de-identified data cannot be associated 
with an individual; 
B. Publicly commits to process the de-identified data only in a de-identified fashion 
and not attempt to re-identify the data; and 
C. Contractually obligates recipients of the de-identified data to satisfy the criteria set 
forth in paragraphs A and B. 
14. Federally recognized Indian tribe in this State. "Federally recognized Indian 
tribe in this State" means the Houlton Band of Maliseet Indians, the Mi'kmaq Nation, the 
Passamaquoddy Tribe or the Penobscot Nation when the band, nation or tribe is acting in 
a governmental capacity and not in a business capacity. "Federal recognized Indian tribe 
in this State" does not include a business entity, including any federally chartered tribal 
corporation or other business entity owned or pa1tly owned by the Houlton Band of 
Maliseet Indians, the Mi'kmag Nation, the Passamaquoddy Tribe or the Penobscot Nation. 
15. Nonprofit organization. "Nonprofit organization" means an organization that is 
exempt from taxation under Section 501(c)(3), Section 501(c)(4), Section 501(c)(6) or 
Section 501(c)(12) of the United States Internal Revenue Code of 1986, as amended. 
16. Personal data. "Personal data" means information that is linked or reasonably 
linkable to an identified or identifiable consumer or that is linked or reasonably linkable to 
a device that is linked or reasonably linkable to an identified or identifiable consumer. 
"Personal data" does not include de-identified data or publicly available information. 
17. Precise geolocation data. "Precise geolocation data" means information derived 
from technology, including, but not limited to, global positioning system level latitude and 
longitude coordinates, that directly identifies the specific location of an individual with 
precision and accuracy within a radius of 1,750 feet. "Precise geolocation data" does not 
include: 
A. The content of communications; or 
B. Data generated by or connected to advanced utility metering infrastructure systems 
or equipment for use by a utility. 
COMMITTEE AMENDMENT 
,.. 
~o<o 
COMMITTEE AMENDMENT" g" to H.P. 1220, L.D. 1822 
18. Process. "Process" means an operation or set of operations perfotmed on personal 
data. including the collection. use. storage. disclosure. analysis. deletion or modification of 
personal data. 
19. Processor. "Processor" means a person that processes personal data on behalf of 
a controller. 
20. Profiling. "Profiling" means any form of solely automated process perfo1med on 
personal data to evaluate, analyze or predict personal aspects related to an identified or 
identifiable individual's economic situation, health. personal preferences, interests, 
reliability. behavior. location or movements. 
21. Protected health information. "Protected health information" has the same 
meaning as in the regulations. rules, guidance and exemptions adopted pursuant to the 
federal Health Insurance P01iability and Accountability Act of 1996, 42 United States 
Code, Chapter 7, Subchapter XL Patt C. 
22. Pseudonymous data. "Pseudonymous data" means personal data that cannot be 
attributed to a specific individual without the use of additional information. as long as the 
additional information is kept separately from the personal data and is subject to 
appropriate technical and organizational measures to ensure that the personal data is not 
attributed to an identified or identifiable individual. 
23. 
Publicly available information. 
"Publicly available info1mation
means 
information that: 
A. Is lawfully made available to the general public through federal. state or local 
government records; or 
B. Is lawfully made available to the general public through widely distributed media. 
24. Sale of personal data. "Sale of personal data" means the exchange of personal 
data for monetaiy or other valuable consideration by the controller to a 3rd party. "Sale of 
personal data" does not include: 
A. The disclosure of personal data to a processor that processes the personal data on 
behalf of the controller; 
B. The disclosure of personal data to a 3rd patiy for purposes of providing a product 
or service requested by the consumer; 
C. The disclosure or transfer of personal data to an affiliate of the controller; 
D. The disclosure of personal data when the consumer directs the controller to disclose 
the personal data or intentionally uses the controller to interact with a 3rd patiy; 
E. The disclosure of personal data that the consumer: 
(1) Intentionally made available to the general public via a channel of mass media; 
and 
(2) Did not restrict to a specific audience; or 
F. The disclosure or transfer of personal data to a 3rd patiy as an asset that is pa1t of a 
merger, acquisition, bankruptcy or other transaction, or a proposed merger. acquisition, 
bankruptcy or other transaction. in which the 3rd patiy assumes control of all or pa1t 
of the controller's assets. 
COMMITTEE AMENDMENT 
~oeo 
COMMITTEE AMENDMENT"~' to H.P. 1220, L.D. 1822 
25. Sensitive data. "Sensitive data" means personal data that includes: 
A. Data revealing racial or ethnic origins, religious beliefs, medical histo1y, mental or 
physical health conditions, diagnoses made by a medical professional, sexual 
orientation or citizenship or immigration status; 
B. Genetic or biometric data; 
C. Personal data collected from a consumer known to be a child; 
D, Precise geolocation data; 
E. A social security number, driver1s license number or nondriver identification card 
number, except that "sensitive data" does not include the last 4 digits of a social security 
number, driver's license number or nondriver identification card number; 
F. A consumer's account number, log-in inf01mation, financial account number or 
credit or debit card number that, in combination with any required security code, access 
code or password, pe1mits access to a consumer's financial account; or 
G, Data conceming an individual's status as a victim of a crime. For the purposes of 
this paragraph, "victim" has the same meaning as in Title 17-A. section 2101, 
subsection 2, 
26. Targeted advertising. "Targeted advertising" means displaying an adve1tisement 
to a consumer when the advertisement is selected based on personal data obtained or 
inferred from that consumer's activities over time and across nonaffiliated publicly 
accessible websites or online applications to predict that consumer's preferences or 
interests, "Targeted adve1tising
does not include: 
A. Advertisements based on activities within a controller's own publicly accessible 
websites or online applications; 
B. Adve1tisements based on the context of a consumer's current search gue1y, visit to 
a publicly accessible website or online application; 
C, Advertisements directed to a consumer in response to the consumer's request for 
information or feedback; or 
D. 
Processing personal data solely to measure or repo1t adve1tising frequency, 
performance or reach. 
27. Trade secret. 
11Trade secret
has the same meaning as in section 1542, subsection 
4. 
§9603. Scope 
1. Applicability; July 1, 2026 to December 31. 2027. From July l, 2026 to December 
L 2027, the provisions of this chapter apply to persons that conduct business in this State 
or persons that produce products or services that are targeted to residents of this State and 
that during the preceding calendar year: 
A. Controlled or processed the personal data of not less than 100,000 consumers, 
excluding personal data controlled or processed solely for the purpose of completing a 
payment transaction; or 
B. Controlled or processed the personal data of not less than 25,000 consumers and 
derived more than 25% of gross revenue from the sale of personal data. 
COMMITTEE AMENDMENT 
_,. 
~o~ 
COMMITTEE AMENDMENT "13" to H.P. 1220, L.D. 1822 
2. Applicability; beginning January 1, 2028. Beginning Janua1y 1, 2028, the 
provisions of this chapter apply to persons that conduct business in this State or persons 
that produce products or services that are targeted to residents of this State and that during 
the preceding calendar year: 
A. Controlled or processed the personal data of not less than 50,000 consumers, 
excluding personal data controlled or processed solely for the purpose of completing a 
payment transaction: or 
B. Controlled or processed the personal data of not less than 25,000 consumers and 
derived more than 25% of gross revenue from the sale of personal data. 
3. Exempt entities. The provisions of this chapter do not apply to: 
A. A body, authority, board, bureau, commission, district or agency of this State, a 
political subdivision of this State or a federally recognized Indian tribe in· this State; 
B. A national securities association that is registered under the federal Securities 
Exchange Act of 1934, 15 United States Code, Section 78a et seq.: 
C. A financial institution or affiliate of a financial institution, including a service 
corporation, that is subject to Title V of the federal Gramm-Leach-Bliley Act, 15 
United States Code, Section 6801 et seq. (1999), as amended; 
D. A person or entity that qualifies as a licensee under Title 24-A, section 2263, 
subsection 8; 
E. A covered entity or business associate: 
F. A nonprofit organization that: 
(1) Does not receive any revenue from the sale of personal data; or 
(2) That is established to detect and prevent fraudulent acts in connection with 
insurance; or 
G. A person or entity that is a motor vehicle dealer franchisee as described in section 
1171, subsection 7. 
4. Exempt data. The provisions of this chapter do not apply to: 
A. Nonpublic personal inf01mation regulated under and collected, processed, sold or 
disclosed in accordance with the requirements of the federal Gramm-Leach-Bliley Act, 
United States Code, Section 6801 et seq. (1999), as amended; 
B. Health care information as defined in Title 22, section 1711-C. subsection 1, 
paragraph E; 
C. Protected health information under the federal Health Insurance Portability and 
Accountability Act of 1996, 42 United States Code, Chapter 7, Subchapter XI, Pait C, 
and the regulations, rules, guidance and exemptions adopted pursuant to that Act; 
D. Patient-identifying information as described in 42 United States Code, Section 
290dd-2; 
E. Identifiable private information for the protection of human subjects in research 
under 45 Code of Federal Regulations, Pait 46; 
COMMITTEE AMENDMENT 
oeo 
.~ 
COMMITTEE AMENDMENT •:g "to H.P. 1220, L.D. 1822 
F. Identifiable private information that is otherwise information collected as pa1t of 
human subjects in research pursuant to the good clinical practice guidelines issued by 
the International Council for Harmonisation of Technical Requirements for 
Pharmaceuticals for Human Use or successor organization: 
G. The protection of human subjects in research under 21 Code of Federal Regulations, 
Pa1ts 50 and 56, or personal data used or shared in research, as defined in 45 Code of 
Federal Regulations. Section 164,501. that is conducted in accordance with the 
standards set fo1th in paragraphs E and F. or other research conducted in accordance 
with applicable law: 
H. Infonnation and documents created for purposes of the federal Health Care Quality 
Improvement Act of 1986, 42 United States Code, Section 11101 et seq: 
I. Information derived from health care-related information listed in this subsection 
that is de-identified in accordance with the requirements for de-identification pursuant 
to the federal Health Insurance Portability and Accountability Act of 1996. 42 United 
States Code. Chapter 7. Subchapter XL Pait C. and the regulations. rules. guidance and 
exemptions adopted pursuant to that Act: 
J. Information that originates from information described in paragraphs C to I. or 
information that is inte1mingled so as to be indistinguishable from infonnation 
described in paragraphs C to I, that a covered entity. business associate or program or 
activity relating to substance use disorder as described in 42 United States Code, 
Section 290dd-2. creates, processes or maintains in the same manner as is required 
under the applicable laws and regulations cited in paragraphs C to I: 
K. Information used for public health activities and purposes as authorized by the 
federal Health Insurance P01tability and Accountability Act of 1996, 42 United States 
Code, Chapter 7, Subchapter XI, Patt C. and the regulations. rules, guidance and 
exemptions adopted pursuant to that Act; 
L. The collection, maintenance, disclosure, sale, communication or use of personal 
information bearing on a consumer's creditwo1thiness, credit standing. credit capacity, 
character. general reputation, personal characteristics or mode of living by a consumer 
rep01ting agency, furnisher or user that provides information for use in a consumer 
rep01t. and by a user of a consumer repo1t, but only to the extent that such activity is 
regulated by and authorized under the federal Fair Credit Rep01ting Act, 15 United 
States Code, Section 1681 et seq.: 
M. Personal data collected, processed, sold or disclosed in compliance with the federal 
Driver's Privacy Protection Act of 1994. 18 United States Code, Section 2721 et seq.: 
N. Personal data regulated by the federal Family Educational Rights and Privacy Act 
of 1974, 20 United States Code, Section 1232g; 
0. Personal data collected. processed, sold or disclosed in compliance with the federal 
Fatm Credit Act of 1971. 12 United States Code. Section 2001 et seq.: 
P. Data processed or maintained: 
(1) In the course of an individual applying to, employed by or acting as an agent 
or independent contractor of a controller. processor or 3rd party. to the extent that 
the data is collected and used within the context of that role: 
COMMITTEE AMENDMENT 
., 
~o'¼,, 
COMMITTEE AMENDMENT'£ "to H.P. 1220, L.D. 1822 
(2) As the emergency contact information of an individual under this chapter used 
for emergency contact purposes; or 
(3) That is necessary to retain to administer benefits for another individual relating 
to the individual who is the subject of the inf01mation under subparagraph (1) and 
used for the purposes of administering those benefits; or 
O. Personal data collected, processed, sold or disclosed in relation to price, route or 
service, as such terms are used in the federal Airline Deregulation Act of 1978, 49 
United States Code, Section 40101 et seq., by an air carrier subject to that Act, to the 
extent this chapter is preempted by the federal Airline Deregulation Act of 1978, 49 
United States Code, Section 41713. 
5. Compliance with COPP A. Controllers and processors that comply with the 
verifiable parental consent requirements of COPPA are deemed to be compliant with an 
obligation to obtain parental consent pursuant to this chapter. 
§9604. Consumer rights 
1. Consumer rights. A consumer has a right to: 
A. Confinn whether or not a controller is processing the consumer's personal data and 
to access that personal data, unless such confirmation or access would require the 
controller to reveal a trade secret: 
B. C011·ect inaccuracies in the consumer's personal data, taking into account the nature 
of the personal data and the purposes of the processing of the consumer's personal data; 
C. Delete personal data provided by, or obtained about, the consumer; 
D. Obtain a copy of the consumer's personal data processed by the controller, in a 
portable and, to the extent technically feasible, readily usable fonnat that allows the 
consumer to transmit the data to another controller without hindrance, when the 
processing is carried out by automated means, as long as the controller is not required 
to reveal a trade secret; and 
E. Opt out of the processing of the consumer's personal data for purposes of: 
(1) Targeted advertising; 
(2) The sale of personal data; or 
(3) Profiling in furtherance of solely automated decisions that produce legal or 
similarly significant effects concerning the consumer. 
2. Exercise of consumer rights. A consumer may communicate and access the 
infmmation necessaty to exercise rights under this section by a secure and reliable means 
established by the controller and described to the consumer in the controller's privacy 
notice. A consumer may designate an authorized agent in accordance with section 9605 to 
exercise the rights of the consumer to opt out of the processing of the consumer's personal 
data as specified in subsection L paragraph E, subparagraphs (1) and (2). In the case of 
processing personal data of a consumer known to be a child, the parent or legal guardian 
may exercise consumer rights on the child's behalf. In the case of processing personal data 
concerning a consumer subject to a guardianship, conservatorship or other protective 
arrangement, the guardian or the conservator of the consumer may exercise rights on the 
consumer's behalf. 
COMMITTEE AMENDMENT 
~QS. 
COMMITTEE AMENDMENT ".B" to H.P. 1220, L.D. 1822 
3, Responding to exercise of consumer rights. Except as otherwise provided in this 
chapter, a controller shall comply with a request by a consumer to exercise the consumer's 
rights authorized pursuant to this chapter as follows. 
A. A controller shall respond to the consumer without undue delay, but not later than 
the 45th day after receipt of the request. The controller may extend the response period 
by 45 days when reasonably necessa1y considering the complexity and number of the 
consumer's requests, as long as the controller infonns the consumer of the extension 
within the initial 45-day response period. 
B. If a controller declines to take action regarding the consumer's request, the 
controller shall inform the consumer without undue delay, but not later than the 45th 
day after receipt of the request, of the justification for declining to take action and 
instructions for how to appeal the decision. 
C. The controller shall provide information in response to a consumer's request, free 
of charge, once during any 12-month period. 
If requests from a consumer are 
manifestly unfounded, excessive or repetitive, the controller may charge the consumer 
a reasonable fee to cover the administrative costs of complying with the request or 
decline to act on the request. The controller bears the burden of demonstrating the 
manifestly unfounded, excessive or repetitive nature of the request. 
D. If a controller is unable to authenticate a request to exercise a right afforded under 
subsection 1, using commercially reasonable efforts, the controller is not required to 
comply with a request to initiate an action pursuant to this section and shall provide 
notice to the consumer that the controller is unable to authenticate the request to 
exercise the right until the consumer provides additional infonnation reasonably 
necessary to authenticate the consumer and the consumer's request to exercise the right. 
E. A controller that has obtained personal data about a consumer from a source other 
than the consumer is in compliance with a consumer's request to delete that data 
pursuant to subsection 1, paragraph C by: 
(1) Retaining a record of the deletion request and the minimum data necessary for 
the pm:pose of ensuring that the consumer's personal data remains deleted from the 
controller's records and not using the retained data for any other purpose pursuant 
to the provisions of this chapter; or 
(2) Opting the consumer out of the processing of the personal data for any purpose 
other than the purposes exempted from the provisions of this chapter. 
4. Appeals, A controller shall establish a process for a consumer to appeal the 
controller's inaction on a request within a reasonable period of time after the consumer's 
receipt of the decision. The appeal process must be conspicuously available and similar to 
the process for submitting requests to initiate action pursuant to this section. Not later than 
the 60th day after receipt of an appeal, a controller shall infonn the consumer in writing of 
action taken or not taken in response to the appeal, including a written explanation of the 
reasons for the decisions. If the appeal is denied, the controller shall also provide the 
consumer with an online mechanism, if available, or other method through which the 
consumer may contact the Attomey General to submit a complaint. 
§9605. Authorized agent 
COMMITTEE AMENDMENT 
.... 
~os 
COMMITTEE AMENDMENT 'B" to H.P. 1220, L.D, 1822 
A consumer may designate another person to serve as the consumer's authorized agent, 
and act on the consumer's behalf, to opt out of the processing of the consumer's personal 
data for the purposes specified in section 9604, subsection 1, paragraph E, subparagraphs 
(1) and (2). The consumer may designate an authorized agent by way of, among other 
methods, technology, including, but not limited to, an Internet link or a browser setting, 
browser extension or global device setting, indicating the consumer's intent to opt out of 
such processing. A controller shall comply with an opt-out request received from an 
authorized agent if the controller is able to verify, using commercially reasonable effo1is, 
the identity of the consumer and the authorized agent's authority to act on the consumer's 
behalf. 
§9606. Actions of controllers 
1. Data minimization. A controller must comply with the requirements of this 
subsection. 
A. A controller shall limit the collection of personal data to what is adequate, relevant 
and reasonably necessaty in relation to the purposes for which the data is processed, as 
disclosed to the consumer. 
B. Except as otherwise provided in this chapter, a controller may not process personal 
data for purposes that are neither reasonably necessa1y for, nor compatible with, the 
disclosed purposes for which the data is processed, as disclosed to the consumer, unless 
the controller obtains the consumer's consent. 
C. A controller shall process the minimum amount of personal data that is reasonably 
necessary, adequate or relevant for each purpose for which data is processed, as 
disclosed to the consumer. 
2. Duties. A controller shall: 
A. 
Establish, implement and maintain reasonable administrative, technical and 
physical data security practices to protect the confidentiality, integrity and accessibility 
of personal data appropriate to the volume and nature of the personal data: 
B. In the case of the processing of sensitive data concerning a consumer known to be 
a child, process the data in accordance with COPP A: and 
C. Provide an effective mechanism for a consumer to revoke the consumer's consent 
under this section that is at least as easy as the mechanism by which the consumer 
provided the consumer's consent and, upon revocation of the consent, cease to process 
the data as soon as practicable, but not later than 15 days after the receipt of the request. 
3. Prohibitions, A controller may not: 
A. Process sensitive data concerning a consumer unless the controller obtains the 
consumer's consent: 
B. Process personal data in violation of the laws of this State and federal laws that 
prohibit unlawful discrimination against consumers: 
C. When the controller, under the circumstances, has actual knowledge or willfully 
disregards that the consumer is at least 13 years of age but has not attained 16 years of 
age: 
COMMITTEE AMENDMENT 
COMMITTEE AMENDMENT "E "to H.P. 1220, L.D. 1822 
(1) Process the personal data of the consumer for purposes of targeted advertising; 
or 
(2) Sell the consumer's personal data without the consumer's consent; or 
D. Retaliate against a consumer for exercising a consumer right in this chapter or for 
not agreeing to the collection or processing of personal data for a separate product or 
service, including by denying goods or services, charging different prices or rates for 
goods or services or providing a different level of quality of goods or services to the 
consumer. 
4. Loyalty and rewards programs. Subsection 3 may not be construed to require a 
controller to provide a product or service that requires the personal data of a consumer that 
the controller does not collect or maintain or prohibit a controller from offering a different 
rate, level. quality or selection of goods or services to a consumer, including offering goods 
or services for no fee, if the offering is in connection with a consumer's voluntaiy 
participation in a bona fide loyalty, rewards, premium features, discounts or club card 
program. 
5, Privacy notice. A controller shall provide consumers with an accessible, clear and 
meaningful privacy notice in plain language that is understandable by a reasonable 
consumer that includes: 
A. The categories of personal data processed by the controller; 
B. The pm:pose for processing personal data; 
C. How consumers may exercise their consumer rights, including how a consumer 
may appeal a controller's decision with regard to the consumer's request; 
D. The categories of personal data that the controller shares with 3rd patties, if any; 
E. The categories of 3rd patties, if any, with which the controller shares personal data; 
and 
. F. An active e-mail address or other mechanism that the consumer may use to contact 
the controller. 
6. Consumer rights request mechanism. A controller shall establish, and shall 
describe in a privacy notice, one or more secure and reliable means for consumers to submit 
a request to exercise a consumer right pursuant to this chapter. The design of the secure 
and reliable means must take into account the ways in which consumers nonnally interact 
with the controller, the need for secure and reliable communication of requests and the 
ability of the controller to verify the identity of the consumer making the request. A 
controller may not require a consumer to create a new account in order to exercise a 
consumer right. but may require a consumer to use an existing account. 
7. Notice of sale and targeted advertising; opt-out mechanism. If a controller sells 
personal data to a 3rd party or processes personal data for targeted adve1tising1 the 
controller shall clearly and conspicuously disclose such processing, as well as the manner 
in which a consumer may exercise the right to opt out of such processing. The disclosure 
required under this section must include: 
A. A clear and conspicuous link titled "Do Not Sell My Personal Data" or bearing a 
substantially similar title on the controller's publicly accessible website that directs the 
COMMITTEE AMENDMENT 
~O~-, 
COMMITTEE AMENDMENT "B" to H.P. 1220, L.D, 1822 
consumer. or an agent of the consumer. to a publicly accessible website that enables 
the consumer, or an agent of the consumer, to opt out of the sale of the consumer's 
personal data: and 
B. A clear and conspicuous link titled "Opt Me Out of Targeted Adve1tising" or 
bearing a substantially similar title on the controller's publicly accessible website that 
directs the consumer. or an agent of the consumer. to a publicly accessible website that 
enables the consumer, or an agent of the consumer. to opt out of processing of the 
consumer's personal data for targeted adve1tising, 
In lieu of providing the 2 links described in paragraphs A and B. a controller may satisfy 
the requirements of this subsection by providing a single conspicuous and clearly labeled 
link on the controller's publicly accessible website that allows a consumer. or an agent of 
the consumer. both to opt out of the sale of the consumer's personal data and to opt out of 
the processing of the consumer's personal data for targeted adve1tising. If the controller 
maintains a specific section or page of its publicly accessible website that allows a 
consumer. or an agent of the consumer. to opt out of the sale of the consumer's data or the 
processing of the consumer's data for targeted adve1tising and to select additional privacy 
controls. the controller may satisfy the requirements of this subsection by providing a single 
conspicuous and clearly labeled link on the controller's publicly accessible website titled 
"Your Privacy Choices" or bearing a substantially similar title that directs the consumer. or 
an agent of the consumer. to that specific section or page of its publicly accessible website. 
8. Universal opt-out mechanism. No later than December 1. 2027, a controller shall 
allow a consumer to opt out of any processing of the consumer's personal data for the 
purposes of targeted adve1tising or any sale of personal data through an opt-out preference 
signal sent. with the consumer's consent. by a platfotm. technology or mechanism to the 
controller indicating the consumer's intent to opt out of any such processing or sale. The 
platform. technology or mechanism: 
A. Must be consumer-friendly and easy to use by the average consumer: 
B. May not unfairly disadvantage another controller: 
C. May not make use of a default setting but must require the consumer to make an 
affitmative. freely given and unambiguous choice to opt out of any such processing or 
sale of the consumer's personal data: 
D. Must be as consistent as possible with another similar platform. technology or 
mechanism required by federal or state law: and 
E. Must enable the controller to reasonably deteimine whether the consumer is a 
resident of this State and whether the consumer has made a legitimate request to opt 
out of to the sale of the consumer's personal data or targeted adve1tising. 
A controller that recognizes an opt-out preference signal that has been approved by the 
laws or regulations of another state is in compliance with this subsection. 
§9607. Responsibilities of processors and controllers 
1. Processor responsibilities. A processor shall adhere to the instructions of a 
controller and shall assist the controller in meeting the controller's obligations under this 
chapter. Assistance provided under this section must include: 
COMMITTEE AMENDMENT 
COMMITTEE AMENDMENT" B" to H.P. 1220, L.D. 1822 
A. Taking into account the nature of processing and the infotmation available to the 
processor, by appropriate technical and organizational measures, so far as is reasonably 
practicable, to fulfill the controller's obligation to respond to a consumer rights request; 
B. Taking into account the nature of processing and the information available to the 
processor, by assisting the controller in meeting the controller's obligations in relation 
to the security of processing the personal data and in relation to the notification of a 
breach of security, as required by chapter 210-B, of the system of the processor, in 
order to meet the controller's obligations: and 
C. Providing necessa1:y information to enable the controller to conduct and document 
data protection assessments. 
2. Contractual requirements. A contract between a controller and a processor must 
govem the processor's data processing procedures with respect to processing perf01med on 
behalf of the controller. The contract must clearly set forth instructions for processing data. 
the nature and purpose of processing, the type of data subject to processing, the duration of 
processing and the rights and obligations of both patties. The contract must require that 
the processor: 
A. 
Ensure that each person processing personal data is subject to a duty of 
confidentiality with respect to the data; 
B. At the controller's direction, delete or retum all personal data to the controller as 
requested at the end of the provision of services, unless retention of the personal data 
is required by law; 
C. On the reasonable request of the controller, make available to the controller all 
inf01mation in the processor's possession necessaty to demonstrate the processor's 
compliance with the obligations in this chapter; 
D. 
Allow and cooperate with reasonable assessments by the controller or the 
controller's designated assessor or arrange for a qualified and independent assessor to 
conduct an assessment of the processor's policies and technical and organizational 
measures in suppott of the obligations in this chapter, using an appropriate and 
accepted control standat·d or framework and assessment procedure for the assessment. 
The processor shall provide a repo1t of the assessment to the controller upon request: 
and 
E. Engage a subcontractor pursuant to a written contract that requires the subcontractor 
to meet the obligations of the processor with respect to the personal data. 
3. Processing relationship liability. This section may not be construed to relieve a 
controller or processor from the liabilities imposed on the controller or processor by virtue 
of the controller's or processor's role in the processing relationship as described in this 
chapter. 
4. Fact-based determination. Determining whether a person is acting as a controller 
or processor with respect to a specific processing of data is a fact-based dete1mination that 
depends upon the context in which personal data is to be processed. A person who is not 
limited in the person's processing of personal data pursuant to a controller's instructions, or 
who fails to adhere to the instructions, is a controllet· and not a processor with respect to a 
specific processing of data. 
A processor that continues to adhere to a controller's 
instructions with respect to a specific processing of personal data remains a processor. If 
COMMITTEE AMENDMENT 
~o'i:, .. 
COMMITTEE AMENDMENT ::}3" to H.P. 1220, L.D. 1822 
a processor begins, alone or jointly with other persons, dete1mining the purposes and means 
of the processing of personal data, the processor acts as a controller with respect to the 
processing and may be subject to an enforcement action under section 9611. 
§9608, Data protection assessments 
1, Documentation. A controller shall conduct and document a data protection 
assessment for each of the controller's processing activities that presents a heightened risk 
of harm to a consumer. For the purposes of this section, "processing activity that presents 
a heightened risk of haim to a consumer" includes: 
A. The processing of personal data for the purposes of targeted advertising; 
B. The sale of personal data; 
C. The processing of personal data for the purposes of profiling, when profiling 
presents a reasonably foreseeable risk of: 
(1) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers; 
(2) Financial, physical or reputational injury to consumers; 
(3) A physical or other intrusion upon the solitude or seclusion, or the private 
affairs or concerns, of consumers, when the intrusion would be offensive to a 
reasonable person; or 
(4) Other substantial injmy to consumers; and 
D. The processing of sensitive data. 
2. Required elements. Data protection assessments conducted pursuant to subsection 
must identify and weigh the benefits that may flow. directly and indirectly, from the 
processing to the controller, the consumer, other stakeholders and the public against the 
potential risks to the rights of the consumer associated with the processing. as mitigated by 
safeguards that can be employed by the controller to reduce the risks. The controller shall 
factor into the data protection assessment the use of de-identified data and the reasonable 
expectations of consumers, as well as the context of the processing and the relationship 
between the controller and the consumer whose personal data will be processed. 
3. Attorney General disclosure; exemption from public records, The Attomey 
General may require that a controller disclose a data protection assessment that is relevant 
to an investigation conducted by the Attomey General, and the controller shall make the 
data protection assessment available to the Attorney General. The Attorney General may 
evaluate the data protection assessment for compliance with the responsibilities set forth in 
this chapter. A data protection assessment is confidential and exempt from disclosure under 
Title 1, chapter 13. To the extent information contained in a data protection assessment 
disclosed to the Attorney General includes info1mation subject to attomey-client privilege 
or work product protection, the disclosure does not constitute a waiver of that privilege or 
protection. 
4. Processing activity. A single data protection assessment may address a comparable 
set of processing operations that include similar activities. 
5. Reciprocity. If a controller conducts a data protection assessment for the purpose 
of complying with another applicable law or regulation. the data protection assessment 
satisfies the requirements established in this section if the data protection assessment is 
COMMITTEE AMENDMENT 
~0'9-> 
COMMITTEE AMENDMENT J3" to H.P. 1220, L.D. 1822 
reasonably similar in scope and effect to the data protection assessment that would 
otherwise be conducted pursuant to this section, 
6. Application. A controller is not required to conduct a data protection assessment 
under this section for any processing activity created or initiated before July 1. 2026. 
§9609. De-identified and pseudonymous data 
1. De-identified data requirements. A controller in possession of de-identified data 
shall: 
A. Take reasonable measures to ensure that the data cannot be associated with an 
individual; 
B. Publicly commit to maintaining and using de-identified data without attempting to 
re-identify the data; and 
C. 
Contractually obligate recipients of the de-identified data to comply with all 
provisions of this chapter. 
2. De-identified data and pseudonymous re-identification of data. This chapter 
may not be construed to require a controller or processor to: 
A. Re-identify de-identified data or pseudonymous data; or 
B. Maintain data in identifiable form, or collect, obtain, retain or access data or 
technology, in order to be capable of associating an authenticated consumer request 
with personal data. 
3. Consumer requests. This chapter may not be construed to require a controller or 
processor to comply with an authenticated consumer rights request if the controller: 
A. Is not reasonably capable of associating the request with the personal data, or it 
would be unreasonably burdensome for the controller to associate the request with the 
personal data; 
B. boes not use the personal data to recognize or respond to the consumer who is the 
subiect of the personal data, or associate the personal data with other personal data 
about the same consumer; and 
C, Does not sell the personal data to a 3rd party or otherwise voluntarily disclose the 
personal data to a 3rd patty other than a processor, except as otherwise permitted in 
this section. 
4. Pseudonymous data requirements. The rights afforded under section 9604, 
subsection 1 do not apply to pseudonymous data in cases when the controller is able to 
demonstrate that info1mation necessaty to identify the consumer is kept separately and is 
subject to effective technical and organizational controls that prevent the controller from 
accessing the information. 
5. Contractual oversight, A controller that discloses pseudonymous data or de-
identified data shall exercise reasonable oversight to monitor compliance with contractual 
commitments to which the pseudonymous data or de-identified data is subject and shall 
take appropriate steps to address breaches of those contractual commitments. 
§9610. Controller and processor; duties and obligations 
COMMITTEE AMENDMENT 
ROS 
1..,-· 
COMMITTEE AMENDMENT"£" to H.P. 1220, L.D, 1822 
1. Exempt controller and processor activities. This chapter may not be construed 
to restrict a controller's or processor's ability to: 
A. Comply with federal laws or regulations or the laws or rules of a state; 
B. Comply with a civil. criminal or regulato1y inquhy, investigation, subpoena or 
summons by federal or state govemmental authorities or governmental authorities of a 
federally recognized Indian tribe in this State: 
C. Cooperate with federal. tribal or state law enforcement agencies conceming conduct 
or activity that the controller or processor reasonably and in good faith believes may 
violate federal laws or regulations or the laws and rules of a state; 
D. Investigate, establish, exercise, prepare for or defend legal claims: 
E. Provide a product or service specifically requested by a consumer; 
F. Perfonn under a contract to which a consumer is a party, including fulfilling the 
terms of a written warranty; 
G. Take steps at the request of a consumer prior to entering into a contract: 
H. Take hnmediate steps to protect an interest that is essential for the life or physical 
safety of the consumer or another individual and when the processing cannot be 
manifestly based on another legal basis: 
I. Prevent, detect, protect against or respond to security incidents, identity theft, fraud, 
harassment, malicious or deceptive activities or illegal activity or preserve the integrity 
or security of systems or investigate, report or prosecute those responsible for an action 
described in this paragraph: 
J. Engage in public or peer-reviewed scientific or statistical research in the public 
interest that adheres to all other applicable ethics and privacy laws and is approved, 
monitored and govemed by an institutional review board that dete1mines, or shnilar 
independent oversight entities that determine: 
(1) Whether the deletion of the information is likely to provide substantial benefits 
that do not exclusively accrue to the controller; 
(2) Whether the expected benefits of the research outweigh the privacy risks; and 
(3) Whether the controller has implemented reasonable safeguards to mitigate 
privacy risks associated with research, including risks associated with 
re-identification; 
K. Assist another controller, processor or 3rd patty with obligations under this chapter: 
or 
L. Process personal data for reasons of public interest in the area of public health, but 
solely to the extent that the processing is: 
(1) Subject to suitable and specific measures to safeguard the rights of the 
consumer whose personal data is being processed: and 
(2) Under the responsibility of a professional subject to confidentiality obligations 
under federal or state laws or local ordinances. 
COMMITTEE AMENDMENT 
.. ROS 
COMMITTEE AMENDMENT '13 "to H.P. 1220, L,D, 1822 
2. Internal use. The obligations imposed on controllers or processors under this 
chapter do not restrict a controller's or processor's ability to collect, use or retain data for 
internal use to: 
A. Conduct internal research to develop, improve or repair products, services or 
technology; 
B. Effectuate a product recall; 
C. Identify and repair technical errors that impair existing or intended functionality; 
or 
D. Perfotm internal operations that are reasonably aligned with the expectations of the 
consumer or reasonably anticipated based on the consumer's existing relationship with 
the controller, or are otherwise compatible with processing data in fu1therance of the 
provision of a product or service specifically requested by a consumer or the 
performance of a contract to which the consumer is a party. 
3. Evidentiary privilege. The obligations imposed on controllers or processors under 
this chapter do not apply when compliance with this chapter by the controller or processor 
would violate an evidentia1y privilege under the laws of this State. This chapter may not 
be construed to prevent a controller or processor from providing personal data concerning 
a consumer to a person covered by an evidentia1y privilege under the laws of this State as 
pa1t of a privileged communication. 
4. Liability. A controller or processor that discloses personal data to a 3rd-party 
processor or 3rd-party controller in accordance with this chapter has not violated this 
chapter if the 3rd-party processor or 3rd-party controller that receives and processes the 
personal data violates this chapter, as long as, at the time the disclosing controller or 
processor disclosed the personal data, the disclosing controller or processor did not have 
actual knowledge that the receiving 3rd-party processor or 3rd-party controller would 
violate this chapter. A 3rd-party controller or 3rd-party processor receiving personal data 
from a controller or processor in compliance with this chapter is likewise not in violation 
of this chapter for the transgressions of the controller or processor from which the 3rd-party 
controller or 3rd-party processor receives the personal data. 
5. Exemptions. This chapter may not be construed to: 
A. Impose an obligation on a controller or processor that adversely affects the rights 
or freedoms of a person, including, but not limited to, the rights of a person: 
(1) To freedom of speech or freedom of the press guaranteed 'in the United States 
Constitution, Amendment I: or 
(2) Under Title 16, section 61; or 
B. Apply to a person's processing of personal data in the course of the person's purely 
personal or household activities, 
6, Limitations. Personal data processed by a controller or processor pursuant to this 
section may be processed only to the extent that the processing is: 
A. Reasonably necessa1y and proportionate to the purposes listed in this section; and 
B. Adequate, relevant and limited to what is reasonably necessa1y in relation to the 
specific purposes listed in this section. Personal data collected, used or retained 
COMMITTEE AMENDMENT 
~os. 
COMMITTEE AMENDMENT :ff" to H.P. 1220, L.D. 1822 
pursuant to subsection 2 must, when applicable, take into account the nature and 
purpose of the collection, use or retention. The data must be subject to reasonable 
administrative, technical and physical measures to protect the confidentiality, integrity 
and accessibility of the personal data and to reduce reasonably foreseeable risks of 
harm to consumers relating to the collection, use or retention of personal data. 
7. 
Controller burden. If a controller processes personal data pursuant to an 
exemption in this section, the controller bears the burden of demonstrating that the 
processing qualifies for the exemption and complies with the limitations in subsection 6. 
8. 
Clarification of roles. 
Processing personal data for the purposes expressly 
identified in this section does not solely make a legal entity a controller with respect to the 
processing. 
§9611. Enforcement 
1. Violation as unfair trade practice; exclusive Attorney General enforcement. A 
violation of this chapter constitutes an unfair trade practice under the Maine Unfair Trade 
Practices Act, except that the rulemaking provisions of Title 5, section 207, subsection 2 
do not apply to this chapter and except as provided in subsections 2 and 3. The Attorney 
General has the exclusive authority to enforce violations of this chapter under the Maine 
Unfair Trade Practices Act. 
2. Notice. Notwithstanding any provision of Title 5, section 209 to the contrary, at 
least 3 0 days prior to commencement of any action under the Maine Unfair Trade Practices 
Act to enforce this chapter, the Attorney General shall notify the person against whom an 
action may be brought of the intended action and give the person an oppotiunity to cure the 
alleged violation or violations. The Attorney General may bring an action pursuant to this 
section only if the controller fails to cure one or more of the alleged violations described in 
the notice within 30 days of receiving the notice. 
3. No private right of action, Notwithstanding Title 5, section 213, this chapter may 
not be construed as creating a private right of action under this chapter or any other 
provision of law against any person based on a violation of any provision of this chapter or 
any other law. 
4. Preemption. This chapter supersedes and preempts any ordinance, resolution, rule 
or other regulation adopted by a political subdivision of the State regarding the processing 
of personal data by a controller or processor. 
§9612. Maine Privacy Fund established 
1. Establishment; purpose. The Maine Privacy Fund, referred to in this section as 
the "fund," is established within the Depa1iment of the Attorney General as a nonlapsing 
fund to providing funding for the staff and activities of the department necessa1y to enforce 
the provisions of this chapter. 
2. Administration. The Depaiiment of the Attomey General shall administer the 
fund. The fund must be established and held separate and apa1i from any other funds or 
money of the State or the depatiment and must be used and administered exclusively for 
purposes authorized in this section. The fund consists of: 
A. Any civil penalties, attomey's fees or costs awarded to the State in an action brought 
by the Attorney General to enforce a violation of this chapter; 
COMMITTEE AMENDMENT 
.~o~. 
". 
COMMITTEE AMENDMENT J" to H.P. 1220, L.D. 1822 
B. Sums that may be appropriated by the Legislature to the fund or transfen·ed by the 
Treasurer of State to the fund; 
C. Interest eamed on fund balances; and 
D. Other funds received from any public or private source, including grants, gifts, 
bequests and donations. 
Sec. 2, 35-A MRSA c. 94, as amended, is repealed. 
Sec. 3. Report. By Februa1y 1, 2027, the Attomey General shall submit a repo1t to 
the joint standing committee of the Legislature having jurisdiction over judiciary matters 
regarding the operation and implementation of the Maine Revised Statutes, Title 10, 
chapter 1057. The report must include, at a minimum, the following information: 
1. The number of notices the Attorney General has issued under Title 10, section 9611, 
subsection 2 and the nature of the violations alleged in the notices; 
2. The number of persons sent a notice described in subsection 1 that conferred with 
the Attorney General during the notice period described in Title 10, section 9611, 
subsection 2 in a manner that alleviated the need for a civil action under the Maine Unfair 
Trade Practices Act; 
3. The number of civil actions brought by the Attorney General under the Maine Unfair 
Trade Practices Act to enforce violations of Title 10, chapter 1057; and 
4. Any recommendations the Attorney General has for improving the operation of Title 
10, chapter 1057. 
The joint standing committee of the Legislature having jurisdiction over judiciaty 
matters may repo1t out legislation related to the repo1t to the 133rd Legislature in 2027. 
Sec. 4. 
Appropriations and allocations. The following appropriations and 
allocations are made. 
ATTORNEY GENERAL, DEPARTMENT OF THE 
Administration - Attorney General 0310 
Initiative: Provides funding for one Assistant Attorney General position, one Paralegal 
position, one Technician position and related costs to administer and enforce the Maine 
Consumer Data Privacy Act. 
GENERAL FUND 
POSITIONS - LEGISLATIVE COUNT 
Personal Services 
All Other 
GENERAL FUND TOTAL 
Maine Privacy Fund N496 
2025-26 
0.000 
$0 
$0 
$0 
2026-27 
3.000 
$420,508 
$20,000 
$440,508 
Initiative: Provides funding to establish the Maine Privacy Fund to suppo1t staff and 
activities required to enforce the Maine Consumer Data Privacy Act. 
OTHER SPECIAL REVENUE FUNDS 
All Other 
2025-26 
$0 
COMMITTEE AMENDMENT 
2026-27 
$500 
~os 
COMMITTEE AMENDMENT ".{5" to H.P. 1220, L.D. 1822 
OTHER SPECIAL REVENUE FUNDS TOTAL 
ATTORNEY GENERAL, DEPARTMENT OF THE 
DEPARTMENT TOTALS 
GENERAL FUND 
OTHER SPECIAL REVENUE FUNDS 
DEPARTMENT TOTAL-ALL FUNDS 
Sec. 5. Effective date. This Act takes effect July 1, 2026.' 
$0 
2025-26 
$0 
$0 
$0 
$500 
2026-27 
$440,508 
$500 
$441,008 
Amend the bill by relettering or renumbering any nonconsecutive Part letter or section 
number to read consecutively. 
SUMMARY 
This amendment, which is the minority repo1t of the committee, replaces the bill and 
changes the title. 
The amendment enacts the Maine Consumer Data Privacy Act, which takes effect July 
1, 2026. The Act regulates the collection, use, processing, disclosure, sale and deletion of 
nonpublicly available personal data that is linked or reasonably linkable to an individual 
who is a resident of the State, referred to in the Act as a "consumer," or that is linked or 
reasonably linkable to an identifiable consumer's device, by a person that conducts business 
in this State or that produces products or services targeted to residents of this State, referred 
to in the Act as a "controller." Under the Act, a controller must limit the collection of 
personal data to what is adequate, relevant and reasonably necessary in relation to the 
purposes for which the controller processes that data, as disclosed in a privacy notice 
specifying the categories of personal data processed by the controller, the purposes for 
processing the personal data, the categories of personal data transferred to 3rd parties and 
the categories of 3rd paities to whom personal data is shared. The controller must also 
process the minimum amount of personal data reasonably necessary, adequate or relevant 
for each disclosed processing purpose. 
A consumer has the right, under the Act, to confi11n whether a controller is processing 
the consumer's personal data; to require the controller to conect inaccuracies in or delete 
the consumer's personal data; to obtain a copy of the consumer's personal data; and to opt 
out of the processing of the consumer's personal data for purposes of tai·geted adve1tising, 
sale or profiling in fmtherance of decisions about the consumer's access to financial or 
lending services, housing, insurance, 
education, criminal justice, employment 
oppo1tunities, health care services and essential goods and services. The privacy notice 
must describe how a consumer may exercise these rights. The controller must obtain the 
affomative, informed consent of a consumer before processing the consumer's sensitive 
data, including data revealing the consumer's race or ethnic origins, religious beliefs, 
medical history or mental or physical health conditions or diagnoses, sexual orientation or 
citizenship or immigration status; genetic or biometric data; precise geolocation data; data 
of a known child who has not attained 13 years of age; social security, driver's license or 
nondriver identification card number; information that petmits access to a consumer's 
financial account; or data concerning the consumer's status as the victim of a crime. If the 
COMMITTEE AMENDMENT 
~os 1 
COMMITTEE AMENDMENT ",B'to H.P. 1220, L.D. 1822 
contro lier knows that the consumer has not attained 13 years of age, the controller may not 
process the consumer's data for any purpose without parental consent. If the controller 
knows or willfully disregards that the consumer is at least 13 years of age but has not 
attained 16 years of age, the controller may not process the consumer's data for targeted 
advertising and must obtain the consumer's consent before processing the consumer's data 
for sale. 
The Act prohibits a controller from processing data in a manner that discriminates 
against a person in violation of state or federal law. A controller is also prohibited from 
retaliating against a consumer for exercising the consumer's rights under the Act, except 
that a controller may offer different prices or selection of goods in connection with a 
consumer's voluntary participation in a bona fide loyalty or discount program. A controller 
must establish, implement and maintain reasonable data security practices. Beginning July 
1, 2026, if a controller engages in a data processing activity that presents a heightened risk 
of harm to a consumer, including processing any data for targeted adve11ising, sale or 
profiling or any processing of sensitive data, the controller must conduct and document a 
data protection assessment to identify and weigh the benefits and potential risks of the 
processing activity. 
The controller may be required to disclose the data protection 
assessment to the Attorney General, who must keep it confidential, when the assessment is 
relevant to an investigation conducted by the Attorney General. 
The provisions of the Act do not apply to specifically enumerated persons, including 
the State, political subdivisions of the State and federally recognized Indian tribes in the 
State; financial institutions or their affiliates subject to the federal Gramm-Leach-Bliley 
Act; state-licensed and authorized insurers; covered entities and business associates subject 
to the federal Health Insurance Po11ability and Accountability Act of 1996; motor vehicle 
dealer franchisees; nonprofits that do not receive any revenue from the sale of personal data 
or that detect and prevent fraudulent insurance acts; and persons that both processed the 
personal data of fewer than 25,000 consumers in the preceding calendar year and derived 
no more than 25% of gross revenue from the sale of personal data. The Act also does not 
apply to persons that controlled or processed the personal data for purposes other than 
completing payment transactions of fewer than 100,000 consumers in the preceding 
calendar year, except that, beginning January 1, 2028, this exception applies only to persons 
that controlled or processed the personal data for purposes other than completing payment 
transactions of fewer than 50,000 consumers in the preceding calendar year. 
In addition, the provisions of the Act do not apply to specifically enumerated types of 
data, including: nonpublic personal information regulated under the federal Gramm-Leach-
Bliley Act; health care information protected under the Maine Revised Statutes, Title 22, 
section 1711-C; protected health information under the federal Health Insurance P011ability 
and Accountability Act of 1996; personal data regulated by the Family Educational Rights 
and Privacy Act of 1974; data processed and maintained by the controller regarding an 
applicant for employment or employee to the extent the data is collected and used within 
the context of that role; and data necessary for the controller to administer benefits. The 
Maine Consumer Data Privacy Act also does not prohibit controllers from engaging in 
specifically enumerated activities, including complying with state or federal law; 
complying with investigations or subpoenas from governmental authorities including the 
Federal Government and the government of a state or a federally recognized Indian tribe 
in the State; cooperating with federal, state or tribal law enforcement agencies; providing 
COMMITTEE AMENDMENT 
~o<a> 
COMMITTEE AMENDMENT:£" to H.P. 1220, L.D. 1822 
a product or service specifically requested by the consumer; protecting life and physical 
safety of consumers and preventing or responding to security incidents; and conducting 
intemal product research, effectuating a product recall or perfo1ming other internal 
operations aligned with the expectations of a consumer. 
Violations of the Act may be enforced exclusively by the Attorney General under the 
Maine Unfair Trade Practices Act. The Attorney General is required to provide a potential 
defendant with at least 30 days' notice prior to initiating an enforcement action, during 
which time the potential defendant may cure any violation alleged in the notice. Any civil 
penalties, attorney's fees or costs awarded to the State for a violation of the Act must be 
deposited in the Maine Privacy Fund, which is established to provide funding for the 
enforcement staff and activities of the Depa1tment of the Attorney General. The Act fmther 
requires the Attorney General to submit a repmt by February 1, 2027 to the joint standing 
committee of the Legislature having jurisdiction over judiciary matters regarding the 
operation and implementation of the Act. The committee may report out legislation related 
to the repmt to the 133rd Legislature in 2027. 
The amendment also repeals the current law goveming the privacy of broadband 
Internet access service customer personal info1mation because broadband Internet access 
service providers are subject to the provisions of the Act. 
FISCAL NOTE REQUIRED 
(See attached) 
COMMITTEE AMENDMENT 
Approved: 06/04/25 L-RL-
LD 1822 
LR 14(03) 
An Act to Enact the Maine Online Data Privacy Act 
Fiscal Note for Bill as Ame~ded by c.01;11mittee Amendment '13' (H--117) 
Committee: Judiciary 
, 
Net Cost (Savings) 
General Fund 
Appropriations/Allocations 
G.eneral Fund 
Other Special Revenue Funds 
Correctional and Judicial Impact Statements 
Fiscal Note Required: Yes 
Fiscal Note 
FY 2025-26 
$0 
$0 
$0 
FY 2026-27 
$440,508 
$440,508 
$500 
Projections 
FY 2027-28 
$457,416 
$457,416 
$500 
Projections 
FY 2028-29 
$489,920 
$489,920 
$500 
This bill may increase the number of civil suits filed in the court system. The additional workload associated with the 
minimal number of new cases filed in the court system does not require additional funding at this time. The collection 
of additional filing fees will increase General Fund revenue by minor amounts. 
Fiscal Detail and Notes 
The bill includes a General Fund apptopriation to the Office of the Attorney General of $440,508 in fiscal year 2026-
for one Assistant Attorney General position, one Paralegal position, one Technician position and related costs to 
administer and enforce the Maine Consumer Privacy Act. 
The bill establishes the Maine Privacy Fund with a base Other Special Revenue Funds allocation of $500 beginning in 
fiscal year 2026-27. 
LR0014(03) - Fiscal Note - Page 1 of 1