ME LD1088: An Act to Enact the Maine Consumer Data Privacy Act

In one paragraph

Not law. Maine's LD 1088, the Maine Consumer Data Privacy Act, as introduced would have applied to controllers handling data of 100,000 or more consumers (50,000 from 2028), or 25,000 with more than 25% of gross revenue from data sales. Consumers could have accessed, corrected, deleted and ported data and opted out of targeted advertising, sales and profiling in furtherance of solely automated decisions with legal or similarly significant effects. The Attorney General would have enforced it exclusively, with no private right of action. The Judiciary Committee split three ways on June 13, 2025, and Report A, Ought Not To Pass, was accepted June 25, 2025.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None: the bill died, so it creates no obligations in Maine.

Key provisions

1. 1Applies to controllers meeting a 100,000-consumer threshold (50,000 from January 1, 2028) or 25,000 consumers with over 25% of revenue from data sales (§9603)
2. 2Consumer rights to access, correct, delete, port data and opt out of targeted advertising, sales and profiling in furtherance of solely automated decisions with significant effects (§9604)
3. 3Sensitive data requires prior consent; responses to requests within 45 days; universal opt-out signals honored by December 1, 2027 (§9604, §9606)
4. 4Data protection assessments for heightened-risk processing, including profiling with a reasonably foreseeable risk of harm (§9608)
5. 5Exclusive Attorney General enforcement after at least 30 days' notice; no private right of action (§9612)
6. 6Introduced text took effect July 1, 2026; final disposition Accepted Report A (ONTP), June 25, 2025

Latest legislative action

Jun 25, 2025. Accepted Report A (ONTP)

Sponsors (showing 5 of 32)

Roll call votes