As of July 1, 2020, the California Attorney General began enforcing the California Consumer Privacy Act (CCPA). While many details about CCPA enforcement remain uncertain, many states have enacted or will enact their own privacy laws. Businesses clearly must wrestle with this mosaic of new and emerging privacy restrictions. Some industries have explored legal challenges to these statutes. One of these legal challenge, against a new Maine privacy law, was just defeated.
In February 2020, lobby groups representing the broadband industry sued the state of Maine under the theory that the Maine privacy law violates their First Amendment protections on business speech The Maine privacy law in question prohibits ISPs from using, disclosing, or selling browsing history and other personal information without customers’ opt-in consent. The plaintiffs’ First Amendment argument draws from the theory that a company’s sale of private individual’s browsing history constitutes a First Amendment protected form of “commercial speech.” The lawsuit’s second theory flows from the history of these types of browser privacy protections. Similar federal protections were rolled back by the President and Congress in 2017. After the federal roll-back, Maine legislators decided to revive these protections for their residents. However, the lawsuit argues that the federal deregulatory action had to effect of preempting and barring any supplementary state law protections.
In a July 7, 2020 order, Judge Lance Walker agreed in general with the characterization of the browser history sales as “commercial speech,” but held that “intermediate scrutiny” of the privacy law, not “strict scrutiny,” governed judicial review of this law. Against that legal backdrop, Judge Walker held that the law is not unconstitutional on its face and declared the preemption arguments “dubious.” While Judge Walker allowed the case to continue, the decision dealt a major blow to the theories underpinning the case.
The legal fight against privacy regulations will continue. The Maine law addresses only a discrete privacy issue. The CCPA sprawls by comparison and will face many legal challenges, especially now that enforcement activity has begun. However, the CPPA and other similar privacy laws will likely face similar First Amendment and preemption claims, in addition to a few other interesting wrinkles. The fight will continue.