1077 points by pseudolus 2467 days ago | 224 comments on HN
| Mild positive Editorial · v3.7· 2026-02-28 11:51:50· from archive
Summary Privacy & Surveillance Advocates
TechCrunch reports on Maine's passage of a law preventing ISPs from selling browsing data without consumer consent, celebrating it as the strongest state privacy law. Article actively advocates for privacy rights (Article 12) while also engaging freedom of conscience/religion (Article 18) and freedom of expression (Article 19) by highlighting surveillance's threats to personal autonomy. Demonstrates democratic remedy mechanism functioning effectively.
I live there and I am proud our lawmakers took this seriously. It seems too common for lawmakers to not understand the ramifications of what was at stake.
Kind of ironic, when I click it I am presented with a huge oath overlay saying how much they care about my privacy without a "Reject all" button anywhere in sight.
For all practical purposes it won't make a difference. When you sign up for ISP service there will be a new small paragraph buried deep in the long 10000+ word contract text that says you consent to them selling your browsing data, which you have to sign to start the service, which nobody reads anyway.
The summary:
"This bill prohibits a provider of broadband Internet access service from using, disclosing, selling or permitting access to customer personal information unless the customer expressly consents to that use, disclosure, sale or access. The bill provides other exceptions under which a provider may use, disclose, sell or permit access to customer personal information. The bill prohibits a provider from refusing to serve a customer, charging a customer a penalty or offering a customer a discount if the customer does or does not consent to the use, disclosure, sale or access. The bill requires providers to take reasonable measures to protect customer personal information from unauthorized use, disclosure, sale or access. The provisions of the bill apply to providers operating within the State when providing broadband Internet access service to customers that are billed for service received in the State and are physically located in the State."
I look forward to the day when selling user's data requires the user's opt-in every single time a third party wants to access that data. No more "yes to all" or allowing blanket usage in TOS/EULAs.
People who use apps that sell their data should be bombarded with requests to use that data each and every single time, until they either decide the app isn't worth it or the app decides they should try a different business model.
And ad targeting should be included in that. Add a new notifications button to FB - companies that have requested advertising access to me. If I decline or don't answer, I never see their ads.
My hope is that a high tracking rejection rate will cause these companies running data vacuums on the side to reconsider the RoI of investing in data vacuums - it could result in a sort of herd immunity to advertising, if 95% of people opt-out the other 5% may be effectively opted out since advertising to just 5% of consumers becomes unprofitable.
Is this personally identifiable? I don't see any issue with collecting and selling anonymized observations.
It would be like police setting up cameras and using them to train a machine learning model on drunk driver detection. It's not collecting who is driving, just observing how normal cars subtly drift in and out of a lane and brake vs. intoxicated drifting/braking and using that to train a DUI detection model.
Define consent. Because I’m pretty sure the only outcome of this will be some new language tucked away in the fine print of every customer’s monthly bill giving consent unless they cancel service or something like that.
Good, now we just need to overcome corrupt crooks in Congress and also pass strong Net Neutrality bill, or at least prevent the fake one from passing to avoid cementing perpetual loopholes.
Section 4-B says it's acceptable to use a customer's personal data:
"To advertise or market the provider's communications-related services to the customer;"
With ISPs that own networks, e.g. Comcast -> NBC, would a service like NBC Sports be considered a communication-related service of Comcast's? If yes, then could they feed that customer data into NBC's advertising infrastructure? If so, could NBC then sell that data?
Do Maine judges tend to honor the spirit or the letter of the law more often?
> The bill will go into effect if Gov. Mills signs it
She'll sign it. Mainer here who's been following what's been going on (she's our first female governor), she's been very committed to making sure our state is modernized. She quoted Kurt Vonnegut in her inaugural speech.
Probably not strict enough. ISPs are just going to shrinkwrap their contracts with an extra clause saying they're selling your data unless you write them a letter to some address which they will check at a ridiculously low frequency or have to call through a call center and deal with every salesman and their brother and sister flabberghasted at such a request while passing it on to their "superior" for an hour at a time while you sit on hold waiting... and in the meantime will sell your data. The law really should have made it completely opt-in only (which nobody would reasonably do) or just bar it completely.
They already know all the tricks to stop people getting out of their contracts, they're just going to start applying that to this kind of opt-out situation too.
Really we need to stop relying on third parties to use our data "correctly" no-one has the time and expertise to carfully read and understand what these third parties say they intend to do with the data and then actually verify that they did what they said.
It is much easier to just assume these third parties will do whatever they want and either not share the data or accept that it will be used in ways you can't control.
There was a campaign by the Maine Chamber of Commerce running against it on the grounds that the privacy protections didn't go far enough. They only applied to ISPs (carriers) not to companies higher in the stack (Facebook, etc.). [1]
I couldn't quite work out of this campaign was done out of legitimate concern or was a cynical attempt to derail it? I mean, I agree with them that privacy legislation should apply broadly, but then I'm happy to at least start somewhere.
"The 'opt-in' nature...would set it apart from other
state internet privacy laws...
the proposed Maine law also would prohibit any [ISP] from
making the sale of customer data part of its mandatory
[TOS]. It also could not charge higher fees to customers
who refuse to opt in"
Boy have I got a surprise for you. I was an engineer at a web analytics firm a decade ago and yes, ISPs have your web browsing data and are selling it left and right. Also apps, Cell phone companies, etc. Our company bought all that data. and when that wasn't enough, we created apps that collected even more. Every click and ajax request, etc.... timestamped.
Yes, there are analysts sifting through your browsing data (if you're lucky, vaguely anonymized). Yes, I heard countless stories of this data being abused and misused. I simply can't imagine it has gotten much better by now.
A significant amount of the data is stuff that will normally be logged for diagnostics, billing, complying with legal requests etc, ie normal ISP business.
I really don't understand the extreme hostility to data collection and data markets. No one likes ads, but no one wants to have to pay a subscription fee to every single site on the internet. If I'm going to see ads, I'd rather them be something I might potentially find useful than something irrelevant. If I end up buying their product, the exchange is mutually beneficial and both parties walk away with value from the exchange.
What's really great is that it can really help small businesses and startups over large corporations. Brands like Coca Cola can afford to canvas the world with their logo, but a business with a handful of employees must use their marketing budget very carefully. User data and profiling makes it realistic to find those people naturally through their internet habits.
Even if this is being used by politicians, I don't see the harm. If you think people can't think for themselves in the face of political advertising campaigns, then I don't see why you'd also believe that those same people can be trusted with the responsibility of the vote.
I can understand the need for treating data carefully and making sure the data is sufficiently scrubbed for personal identification, but this issue is something different.
Can they email you a "Change of Terms of Service" link (that nobody reads) that explains you auto accept if you continue using their service or some BS?
You assume they put an opt-out link on the button and not have it buried in either the Terms of Service, a customer request or an entirely separate EULA.
> I don't see any issue with collecting and selling anonymized observations.
In this day and age when correlating and analyzing data from a wide variety of sources is commonplace, the only effectively "anonymized" data is data that has been discarded.
Me too! Now we just need to get some ISP competition. Spectrum has a complete monopoly in my area. Their service is spotty at best, and they also accidentally blocked my account from paying digitally. Now I have to drive to their office with a couple hundred dollars cash once a quarter to prepay my bill...
There needs to be some law against dark patterns because nothing is enforceable anymore. I'm not sure what can be done but I know that the death of our society is due to people/companies that are using loop holes and all sorts of tricks to game the system and undermine basic trust. It used to be that these "tricks" were used only sparingly but as more and more bad actors engage in this type of behavior it only makes it more normalized, and even causing more people to resort to the same behavior in order to survive.
It's like bad drivers. If you have more and more people cutting cars exiting a freeway exit, people at the end will never make it off the freeway in a timely manner. Thus, people have to start being bad drivers themselves or else they will never get to their destination on time.
Won’t the customer consent just become a line in the T&C’s and unless you accept it you can’t use their service? This would be a similar situation to the cookie disclaimers.
This law sound like it was written by data brokers. It does nothing at best and legitimizes corrupt practices at worst.
WTF is "consent" doing here? Why would ISP ever need to sell someone's data in order to operate? Do they also plan to explicitly prohibit ISPs from torturing customers and selling their organs? From selling illegal drugs to minors? Dear state of Maine, I too would like to waive all my legal liabilities by making my victims sign a bunch of paperwork!
https://en.wikipedia.org/wiki/Lawrence_v._Texas is an example. But these constitutional decisions are about the validity of particular State laws; they don't create free-standing rights that can be enforced against companies that violate your privacy.
The example, run anonymously, can be no more than unsupervised clustering. In order to train "a DUI detection model" there must be actual DUIs and BACs recorded, which isn't anonymous.
I agree and this points to the problem of "high level, usable TOS/EULA". Today's EULA "culture" is so hopelessly broken. Whereas the software is interactive and intuitive, using readable labels and buttons, the EULA is a couple dozen pages of non-interactive legal fine print. Companies will continue to get away with evil until we come up with better requirements for this nonsense.
Central focus. Article advocates for privacy rights protection; celebrates Maine law as preventing ISP monetization of personal data. Quotes ACLU calling it strongest state privacy law. Explains ISP surveillance scope and vulnerability clearly.
FW Ratio: 56%
Observable Facts
Headline: 'Maine passes law preventing ISPs from selling browsing data without consent'
Opening statement: 'Good news! Maine lawmakers have passed a bill that will prevent internet providers from selling consumers' private internet data to advertisers'
ACLU statement: 'Today, the Maine legislature did what the U.S. Congress has thus far failed to do and voted to put consumer privacy before corporate profits'
Oamshri Amarasingham (ACLU Maine): 'Nobody should have to choose between using the internet and protecting their own data'
Governor Mills: 'Maine people can now access the internet with the knowledge and comfort that their personal information can't be bought or sold by their internet service providers without their express approval'
Inferences
'Good news!' opening signals editorial support for privacy-protective legislation
Quoting privacy advocates without ISP/corporate rebuttals suggests editorial preference for privacy protection over data monetization business model
Calling ACLU bill 'strongest' state privacy law frames this as exemplary human rights protection
Explaining ISP surveillance capabilities (website names, visit frequency, duration) contextualizes privacy violation that law addresses
Article recognizes privacy's importance to freedom of thought, conscience, religion. ACLU quote specifically cites ISP tracking of religious website visits as privacy violation affecting conscience.
FW Ratio: 33%
Observable Facts
ACLU statement: 'Linking all that information can reveal a lot about you – for example, if you are visiting a religious website or a support site for people with a particular illness'
Inferences
Specific example of religious website surveillance indicates awareness that ISP data access threatens freedom of conscience/religion
Connecting privacy to health/religious autonomy shows understanding of Article 18's scope
Article addresses surveillance's chilling effect on freedom of opinion and expression. ISP capability to track website visits and viewing patterns constrains free information access.
FW Ratio: 40%
Observable Facts
ACLU: 'Your internet provider sees everything you do online. Even if the website you're visiting is encrypted, your ISP can still see the website name, how frequently you visit the website, and how long you're there for.'
Article explains ISP ability to track 'which websites a user visits and for how long'
Inferences
Universal ISP surveillance of browsing patterns creates chilling effect on freedom to access/read information
Maine law advocated in article protects freedom to seek and receive information without corporate surveillance
Article's advocacy for consent-based data practices implicitly protects freedom of expression by preventing coercive data monetization
Content affirms human dignity through privacy protection; frames Maine law as protecting fundamental rights against corporate exploitation
FW Ratio: 50%
Observable Facts
Article begins with 'Good news!' framing Maine privacy law as positive development
ACLU statement quotes: 'Today, the Maine legislature did what the U.S. Congress has thus far failed to do and voted to put consumer privacy before corporate profits'
Inferences
Framing celebrates legislative action protecting privacy as aligned with preamble's vision of human dignity
Contrasting Maine action with congressional inaction suggests the article views privacy as fundamental right Congress failed to uphold
Maine law demonstrates effective legislative remedy against corporate privacy violations; article shows process working
FW Ratio: 60%
Observable Facts
Senate unanimously passed bill 35-0, House voted 96-45 in favor
Governor Janet Mills signed bill into law on June 6, 2019
Article includes governor's tweet: 'Maine people can now access the internet with the knowledge and comfort that their personal information can't be bought or sold by their internet service providers without their express approval'
Inferences
Unanimous senate vote and 96-45 house vote show democratic remedy mechanism functioning effectively
Governor's signature and supportive statement demonstrate accessible legal process for privacy protection
Article demonstrates democratic participation working: Maine legislature votes on privacy law (96-45 house, 35-0 senate), governor signs. Shows government responsiveness to constituents.
FW Ratio: 60%
Observable Facts
Maine senate unanimously passed bill 35-0
Maine house voted 96-45 in favor
Governor Janet Mills signed into law June 6, 2019
Inferences
Broad bipartisan legislative margins (96-45 house) indicate public participation in democratic process on privacy rights
Article's coverage of legislative and executive action illustrates functioning of representative government
Article is readable without paywall, enabling access to privacy advocacy information. Page contains ads/tracking (structural negative on privacy practice), but article content itself accessible.