ME LD1822

Establishes comprehensive data privacy protections for Maine residents effective July 1, 2026, applying to businesses that process personal data of at least 35,000 consumers or 10,000 consumers if deriving over 20% of revenue from data sales

Grants consumers rights to access, correct, and delete their personal data; obtain portable copies; receive lists of third parties who purchased their data; and opt out of targeted advertising, data sales, and automated profiling

Prohibits selling sensitive data (including racial/ethnic origins, health data, biometrics, precise geolocation, and minors' data) and bans targeted advertising to minors; prohibits geofencing within 1,750 feet of health care facilities to track consumer health data

Requires controllers to provide clear privacy notices, implement reasonable data security practices, conduct data protection assessments for high-risk processing activities, and obtain binding contracts with data processors

Enforced exclusively by the Attorney General under the Maine Unfair Trade Practices Act, with a discretionary 60-day cure period for violations before April 1, 2027; exempts government entities, nonprofits, higher education institutions, financial organizations, and data already regulated under HIPAA, GLBA, and other federal laws