This case concerns a First Amendment challenge brought by internet service providers (“ISPs”) to a Maine law requiring the ISPs to obtain customer consent before using, selling, or disclosing their customers’ personal information.
The Maine statute also holds that an ISP can't refuse to serve a customer or charge a penalty for not allowing use of their information, or offer a discount to induce them to give up information. ISPs, challenged the law in a Maine U.S. District Court.
The bill requires opt-in permission for what ISPs say is not sensitive personal information, an opt-out option for collection of data that is not personal at all, and preventing them from offering consumer-benefiting discounts or rewards. The ISPs argue that such limitations are impermissible restrictions on how they communicate with their customers that are not “remotely tailored” to protecting consumer privacy and are thus unconstitutional restrictions on speech.
ISPs argued that the state law was preempted by the congressional resolution invalidating privacy regulations adopted by the FCC. They also said the law conflicted with the FCC's Restoring Internet Freedom Order because the FCC said the way to enforce privacy is a combination of ISP disclosures and Federal Trade Commission enforcement of those disclosures while the state was adopting prescriptive rules.
Defendant countered that the state law "regulates a space Congress explicitly left open, and any conflict is a figment of Plaintiffs’ imaginative pleading."
ISPs also argued that it was unconstitutionally vague due to lack of clarity about its geographic scope, so unclear as to whom the law would apply. For example, out of state residents using their mobile phones in the state. They also said it was void for vagueness due to the "nebulousness" of the definition of personal information.
The court held that since Congress' resolution was simply the nullification of the FCC's ISP privacy order, it created "no overarching federal policy, and enacts no scheme with which the Maine Privacy Statute can conflict."
As to the unconstitutionally vague personal information definition. "Plaintiffs’ Motion simply fails to clarify how an ill-defined opt-in and opt-out regime would inhibit any protected First Amendment activity," held the court, "for example, how it might chill them from preparing particular marketing materials for sale to customers. And, they have not begun to bear their burden to show the statute would be unconstitutional in “all of its applications,” as they must for a facial challenge. "Plaintiffs’ members are businesses accustomed to regulation, and the Privacy Statute does not appear to carry any criminal penalty, the vagueness review is less searching in this case," stated the court.
As to the issue of geography, the court found that the law "applies to a clearly-defined set of businesses when providing services to a clearly-defined set of customers; the law regulates ISPs operating in Maine serving customers that are physically located in Maine, and physically billed for those services in Maine."