Maine’s recently enacted privacy law regulates the use of Maine residents’ personal information by internet-service providers, the companies that connect users to the internet, but it does not regulate data collection and usage by so-called edge providers, such as Google, Amazon, Twitter, Facebook and Netflix. That approach makes little sense.
In a recent OpEd, Rep. Nicole Grohoski, D-Ellsworth, suggested that because the activities of edge providers constitute interstate commerce, only Congress can regulate them. Her argument is doubly mistaken.
First, it proves too much. If it were valid, Maine could not regulate data collection and usage by internet-service providers any more than by edge providers. The former, as much as the latter, engage in interstate commerce.
Second, any argument that the Constitution’s so-called dormant Commerce Clause categorically bars state regulation of interstate businesses operating via the internet is unfounded. To take one example, a recent Supreme Court decision allows states to require out-of-state internet businesses to collect and remit sales taxes based on internet transactions with in-state residents. Under that decision, Maine should be able to regulate edge providers’ use of consumer information that they acquire from Maine residents through internet transactions originating in Maine.
Recent decisions by lower federal courts largely support this conclusion. Federal courts have upheld state privacy laws over challenges from edge providers Facebook and Shutterfly. And the new California consumer privacy law applies to edge providers as well as internet-service providers.
To avoid pitfalls under the Commerce Clause, the Maine Legislature would need to draft carefully in regulating data collection and use by edge providers.
But the Legislature’s current approach of regulating only internet-service providers’ privacy practices and not those of edge providers actually makes Maine law more vulnerable to constitutional challenge than a nondiscriminatory privacy-protection statute would be. There is no reason to leave Maine residents’ privacy needlessly unprotected by not expanding the state’s law.
Richard H. Fallon, Jr. is the Story Professor of Law at Harvard Law School. He has been retained by Charter Communications to prepare an expert report on constitutional issues raised by state data-privacy legislation. The views expressed here are his alone.