Maine Just Passed a Privacy Law That Big Tech Couldn't Water Down—Only One Other State Has Anything Like It

Most state privacy laws share a quiet flaw: they let companies collect whatever data they want, as long as they ask permission first. A consent popup appears. You click "accept" because you have no real alternative. The company keeps everything.

Maine just rejected that model entirely.

On March 9, 2026, the Maine Senate passed LD 1822, a comprehensive privacy bill that restricts companies from collecting sensitive data unless it is "strictly necessary" to provide a product or service the consumer actually requested. The bill previously passed the House and now returns for a final concurrence vote after Senate amendments.

Only one other state, Maryland, has adopted this stricter data minimization approach. Every other state privacy law defaults to the weaker consent model that the ad industry prefers.

What Data Minimization Actually Means

The difference between consent based and minimization based privacy laws sounds technical. In practice, it changes everything.

Under a consent model, a weather app can collect your precise GPS location, browsing history, contact list, and biometric data. All it needs is a consent dialog that most users never read. The app might use your location for weather forecasts. Everything else gets sold to data brokers.

Under data minimization, that same weather app can collect your location because it needs it to show your forecast. It cannot collect your contacts, browsing history, or biometric data because none of that is strictly necessary for the service you requested. The burden shifts from the user to the company.

Consumer Reports praised the approach, noting the bill "will protect consumers by default, instead of requiring them to make endless consent choices" to safeguard their privacy.

What LD 1822 Prohibits

The bill goes further than data minimization. It establishes several outright bans:

• Sensitive data sales are banned. Companies cannot sell geolocation data within 1,750 feet, biometric or genetic data, race, ethnicity, health information, sexual orientation, or citizenship status.
• Minor data targeting is banned. Companies cannot use children's data for advertising or behavioral targeting.
• Adults get opt out rights. All adults can opt out of having their personal data used for behavioral targeting.
• Civil rights protections are included. The bill prohibits algorithmic discrimination in hiring, admissions, lending, and similar decisions.
• Biometric data collection is restricted. Companies cannot collect fingerprints or similar biometric data unless essential to providing their service.

The Government Surveillance Loophole

Perhaps the most consequential provision addresses a problem that most state privacy laws ignore entirely: the use of commercial data collection as a backdoor for government surveillance.

The ACLU of Maine's policy director Michael Kebede explained the stakes directly: "Data privacy isn't about secrecy. It's about autonomy." The bill restricts government purchases of consumer data that would otherwise require a warrant to obtain, closing a loophole that federal agencies including ICE, CBP, and the FBI have exploited extensively.

The Fourth Amendment prevents the government from searching your home without a warrant. But it says nothing about the government buying your location data from a broker who bought it from an app on your phone. Maine's bill addresses this gap.

Why the Ad Industry Is Fighting It

The Association of National Advertisers, American Association of Advertising Agencies, American Advertising Federation, and Digital Advertising Alliance have all opposed the bill. Their argument: LD 1822 is "more stringent than other state privacy laws" and would "harm consumers and businesses of all sizes."

The specific objections center on data prospecting. Under current law, companies can collect personal data to find and target potential customers who have never interacted with the brand. LD 1822 restricts this practice because prospecting data collection is not "strictly necessary" to provide a service the consumer requested.

The industry's complaint is revealing. When advertisers say a privacy law is too strict, they are acknowledging that their business model depends on collecting data that is not necessary for the services consumers actually use. Data minimization does not harm consumers. It harms the business of collecting and selling consumer data without providing value in return.

What This Means for Compliance

For organizations operating in multiple states, Maine's bill adds a significant new compliance requirement. The data minimization standard is fundamentally different from the consent based approach used by most other state privacy laws.

Companies that have built their compliance programs around consent management may need to restructure their data collection practices entirely. Under LD 1822, obtaining consent is not enough. The collection itself must be necessary for service delivery.

The bill sets an effective date of July 1, 2026, giving organizations limited time to assess and modify their data practices. With Maryland already enforcing a similar standard and Maine following, the data minimization approach may be the direction more states take next.

Twenty one states now have comprehensive privacy laws. Only two require data minimization. The question is not whether more will follow, but how quickly.