Maine's governor recently signed "An Act to Prevent Predatory Marketing Practices against Minors" (referred to in this Legal Update as the "Maine Act" or the "Act").1 The Act, which regulates the collection and use of personal information of children, is substantially more restrictive than the federal Children's Online Privacy Protection Act ("COPPA") and appears to prohibit many common, non-deceptive marketing practices.2 The Act also includes a private right of action, not available under COPPA, that substantially increases the legal exposure of businesses that collect and use personal information of Maine residents who are under 18 years old. The Act becomes effective in mid-September 2009.

Unless and until the Maine Act is successfully challenged, businesses that have implemented COPPA-compliant privacy practices must consider expanding those practices to accommodate the Maine Act, or must consider not collecting or using information of minor residents of Maine for marketing purposes.

I. PROVISIONS OF THE MAINE ACT

The Maine Act began as a bill that restricted only the online or wireless collection and use of minors' health information for marketing purposes.3 However, by the time the bill reached the governor's desk, its scope was far broader. As signed by the governor, the Act creates three new offenses.

First, the Act makes it "unlawful for a person to knowingly collect or receive health‑related information or personal information for marketing purposes from a minor without first obtaining verifiable parental consent of that minor's parent or legal guardian."4

Second, the Act makes it unlawful to "sell or offer for sale or otherwise transfer to another person health‑related information or personal information about a minor if that information: (A)was unlawfully collected pursuant to [the Maine Act]; (B)individually identifies the minor; or (C)will be used in violation of Section 9553 [described below]."5

Finally, section 9553 of the Act states that "a person may not use any health‑related information or personal information regarding a minor for the purpose of marketing a product or service to the minor or promoting any course of action for the minor relating to a product."6 The Act refers to violations of section 9553 as "predatory marketing."7

For purposes of these new offenses, "personal information" means "individually identifiable information, including (a)an individual's first name, or first initial, and last name; (b)a home or other physical address; (c)a Social Security number; (d)a driver's license number or state identification card number; and (e)information concerning a minor that is collected in combination with [one of the above identifiers]."8

Also, the requirement of "verifiable parental consent" for collection of personal information from minors is satisfied by "any reasonable effort, taking into consideration available technology, including a request for authorization for future collection, use and disclosure described in the notice, to ensure that a parent of a minor receives notice of the collection of personal information, use and disclosure practices and authorizes the collection, use and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that minor."9

The Maine Act authorizes both public and private actions against violators. Each violation is an unfair trade practice under Maine's consumer protection law, and violators may be subject to fines in the amount of not less than $10,000 and not more than $20,000 for a first violation, and not less than $20,000 for a second or subsequent violation. The Act also creates a private right of action, authorizing "a person about whom information is unlawfully collected or who is the object of predatory marketing in violation of [the Act to] bring an action in an appropriate state court for either or both of the following: (a)an injunction to stop the unlawful collection or predatory marketing; and (b)recovery of actual damages from each violation or up to $250 in damages for each violation, whichever is greater."10 The court may treble the damages awarded in the event of willful or knowing violations, and "shall award [a successful petitioner] reasonable attorney's fees and costs incurred in connection with the action."11

II. POTENTIAL IMPACT OF THE MAINE ACT

Any business that collects or uses personal information of a Maine resident under the age of 18 for marketing purposes is potentially subject to the new Act. The impact on existing business practices could be substantial.

Notably, companies that now collect information from children in compliance with COPPA may expose themselves to liability when using those same procedures to collect information from minors in Maine. COPPA does not require verifiable parental consent for knowing collection of personal information of children between the ages of 13 and 18, or for collection of personal information that occurs offline. Maine now requires both. Accordingly, the Act may force some businesses to implement age screening for all minors, to engage in age screening when information is collected through the mail or over the telephone, or perhaps to screen for residency in Maine and decline to collect personal information through any channel from minors residing in that state.

The impact of the "predatory marketing" restrictions could be even more severe. As long as no fraud or deception is involved, and subject to strict COPPA requirements where information is collected from children under 13, businesses presently are allowed to sell or transfer personal information of minors for marketing purposes and to use such information as a marketing tool.12 But the Maine Act forbids those practices, and apparently outlaws such innocuous acts as using a minor's publicly-available name and postal address to send the minor an advertisement. Compounding the risk of liability, the Act does not limit the predatory marketing offense to cases in which the offender knew that the information at issue concerned minors. As written, the Act creates a "strict liability" regime for any business that maintains and uses personal information of minors residing in Maine, knowingly or otherwise, for any marketing purpose.

Finally, and perhaps most importantly in practical terms, the Maine Act's private right of action threatens companies that engage in non-deceptive marketing practices with lawsuits — including possible class actions — that are currently not possible before the Act becomes law. Maine's attorney general, if given exclusive enforcement authority, could have moderated the Act's impact by declining to bring actions against conscientious businesses that ran afoul of its more radical provisions. The private right of action, however, encourages private plaintiffs to push the Act to its limits.

III. IS THE MAINE ACT SUBJECT TO CHALLENGE?

Any attempt to enforce the Maine Act will likely prompt a vigorous challenge to its legality. Notably, the Act covers much the same ground as COPPA, which expressly preempts state or local laws that "impose any liability for commercial activities by operators in interstate or foreign commerce in connection with any activity or action described in this title that is inconsistent with the treatment of those activities or actions under this section."13 By prohibiting data collection activities that are permitted under COPPA, the Maine Act appears to run afoul of this preemption provision.

Similarly, the Maine Act restricts commercial speech in ways that may be found to violate the First Amendment to the U.S. Constitution. The Act's "predatory marketing" prohibitions, in particular, flatly prevent the use of minors' names, addresses and other personal information to facilitate non-deceptive marketing communications. Even if the State of Maine could convince a court that this restriction has some tendency to advance a substantial governmental interest, Maine would be hard-pressed to show that the prohibitions in the new law are proportional to the substantiality of the interest being protected.14

IV. PRACTICE TIPS

In order to reduce exposure under the Act, companies that collect or use (or might collect or use) personal information of Maine residents should consider the following actions:

1. Refine present online data collection and screening procedures. The data-collection provisions of the Act place businesses that collect personal information in a difficult position. The Act only requires verifiable parental consent for the knowing collection of minors' personal or health-related information. Accordingly, an operator of a general-audience website that is not subject to COPPA, and therefore does not presently screen for age, is not required to obtain verifiable parental consent under the Maine Act unless it has actual knowledge that it is collecting information from a minor.15 Businesses that do collect age data, either because their sites are directed to children or for other reasons, might consider: (a) obtaining verifiable parental consent for collection of personal information from persons under the age of 18 as required by the Act, rather than 13 as required by COPPA, or (b) adding a screening function for state of residence as well as age. Where users identify Maine as their state of residence, the website might request verifiable parental consent if the users also state that they are under 18, or may decline to collect the information.16

2. Review offline data collection practices. Businesses that collect personal information for marketing purposes by means of postal mail, telephone, or other offline methods and do not presently collect age data are not required to obtain verifiable parental consent under the Maine Act unless they have actual knowledge that they are dealing with minors. If those organizations have a business reason to collect age data, they might wish to institute verifiable parental consent procedures for collection of data from minors who are Maine residents, or might simply decline to collect any information from minor residents of Maine.

3. Review use of existing databases. The Act's restrictions appear to apply, not just to information that is collected after the law's enactment, but to any transfer, sale or marketing use of data that was collected before the Act became law. This creates an especially difficult compliance issue for businesses that cannot confirm whether personal information pertains to minors or residents of Maine. Many companies that have strictly complied with COPPA have no idea if data they have collected relates to 17 year olds or 19 year olds. Because of its "strict liability" character, the Act even raises the possibility that a plaintiff could prove that the Act was violated on the basis of information that was not available to the defendant when the decision to sell, transfer or use the plaintiff's personal information was made. Unless and until the Act is challenged or amended, businesses with extensive marketing databases must assess the costs and risks of reviewing their data, taking appropriate action as to personal information that could relate to individuals under 18 who are residents of Maine, and decide how to treat that information.

Conclusion

Maine's new children's privacy law may well be unconstitutional and seems to create significant risks for legitimate businesses that wish to comply. In the meantime, businesses should consider how they will reduce their exposure to enforcement actions—and especially private actions—that might be brought under this law.

Footnotes

1 Maine Public Law No. 230 (June 2, 2009) (to be codified at 10 MRSA ch. 1055, §§ 9551-9554).

2 Pub. L. No. 105-227, 112 Stat. 2681-728 (codified as amended at 15 U.S.C. §§6501‑06).

3 Maine 124th Legislature, First Regular Session, Senate Bill 431 (as introduced March 24, 2009).

4 10 MRSA §9552(1).

5 Id. §9552(2).

6 Id. §9553.

7 Id.

8 Id. §9551(4). The Act defines "Health-Related Information" as "any information about an individual or a member of the individual's family relating to health, nutrition, drug or medication use, physical or bodily condition, mental health, medical history, medical insurance, coverage or claims or other similar data." Id. § 9551(1).

9 Id. § 9551(5).

10 Id. § 9554.

11 Id. The Act also authorizes the Attorney General to bring enforcement actions under COPPA where the facts appear to support such actions.

12 COPPA imposes a number of restrictions on operators of websites and online services that are directed to children under 13 or that collect information from children under 13. Those restrictions include posting of privacy policies, notices to parents, obtaining verifiable parental consent to the collection and use of personal information, and other requirements. Businesses that may be subject to COPPA should understand the provisions of that statute and the Federal Trade Commission's rules and guidance implementing the statute. See http://www.ftc.gov/coppa.

13 COPPA, supra,§ 1303(d).

14 See Central Hudson Gas & Elec. Corp. v. Public Service Comm'n,447 U.S. 557, 100 S.Ct. 2343, 65 L.Ed.2d 341 (1980) (requiring that any governmental restriction on lawful commercial speech involve a substantial governmental interest, be proportional to that asserted interest, directly advance the interest, and be only as broad as necessary to advance the interest).

15 COPPA requires operators of commercial websites that are directed to children to obtain verifiable parental consent when they collect personal information from children under 13. Accordingly, COPPA-compliant websites that are directed to children screen for age before collecting personal information. COPPA requires operators of general-audience websites to obtain verifiable parental consent only when they knowingly collect personal information from children under 13. Accordingly, general-audience websites that collect personal information often do not screen for age. The Maine Act refers only to knowing collection of information and makes no distinction between websites (and off line services) directed to children and general-audience websites and services.

16 Compliance with the data-collection provisions also is complicated by the predatory marketing provisions, which appear to prohibit the use of a minor's personal information for marketing purposes, even where the business lacked actual knowledge that the individual concerned was a minor. Because of the "strict liability" character of the predatory marketing provisions, a business that declines to engage in age screening, and therefore is not required to obtain verifiable parental consent under the Maine Act unless it otherwise has actual knowledge that an individual is a minor, still might be subject to liability when it sells, transfers or uses that minor's information for marketing purposes.

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Morrison & Foerster LLP. All rights reserved