In mid-September, Maine’s “Act to Prevent Predatory Marketing Practices against Minors” is scheduled to take effect. Due to the lack of a scienter element in several of the requirements of this new law, this Act could have far-reaching consequences for all businesses that engage in direct marketing or that sell or transfer personal information to third parties, even if the business does not have knowledge that the information regards a minor.
The Act applies to two types of information: (1) health-related information, which includes information related to health or physical condition, nutrition, medications, mental health, medical insurance coverage and similar data; and (2) personal information, which includes a last name with first name or first initial, home or other physical address, social security number, driver’s license or state identification card number, and information about a minor collected in combination with other personal information. An email address or other online identifier is not expressly included, but it would be considered personal information if combined with other personal information of any of the other types included in this definition.
Since Maine’s new law is intended to protect the privacy of minors, it can be compared to the federal Children’s Online Privacy Protection Act (“COPPA”). However, the Maine law is broader than COPPA in many significant ways. Among the other differences discussed below, under Maine law, a minor is someone under 18. In contrast, COPPA only protects “children” who are under 13 years old.
Maine’s new law can also be compared to some other state laws, As an example, it can be compared to a law that has been in existence in California since 2004. California’s Civ Code sec. 1798.91 also regulates the collection, use and disclosure of health related information for marketing purposes without notice and consent; however, California’s law is not limited in application to minors.
Maine’s new Act contains three separate prohibitions.
First, the Act makes it unlawful to knowingly collect or receive health-related or personal information for “marketing purposes” from a minor without prior “verifiable parental consent.” The way the Act is written, it is unclear whether the requirement for “knowing” collection or receipt applies to the type of information or also to the fact that the information is collected from a minor. The Act defines “marketing purposes” as “the purposes of marketing or advertising products, goods or services to individuals.” This particular provision – unlike the provisions discussed below – appears to be limited to information collected “from” a minor. “Verifiable parental consent” is defined to mean reasonable efforts to give the parent notice of the collection, use and disclosure practices and to obtain parental authorization for such collection, use or disclosure “before that information is collected from that minor.” Unlike COPPA, Maine’s Act is not limited to online collection. Nor does the Act contain any exceptions permitting some collection of “personal information” from the minor, such as for the purpose of obtaining parental consent for additional collection.
Second, the Act makes it unlawful to sell, offer for sale or otherwise transfer health-related or personal information about a minor if (A) it was collected in violation of the prohibition above; (B) it “individually identifies the minor”; or (B) it will be used for “predatory marketing” as described below. This provision does not have a scienter requirement (although a “knowledge element is built into Subsection A). Subsection B – which is not limited to uses “for marketing purposes” – apparently requires that any transfer of information “about a minor” be done on an aggregate basis.
Third, the Act prohibits “predatory marketing,” which is defined as using health-related or personal information regarding a minor “for the purpose of marketing a product or service to that minor or promoting any course of action for the minor relating to a product.” Again, there is no scienter requirement, nor any exception permitting a parent to sign up on behalf of a child, or to otherwise consent to such marketing.
The Act provides for enforcement by the Maine Attorney General as an unfair trade practice, with penalties of $10,000-$20,000 for the first violation and at least $20,000 for subsequent violations. The Act also provides for a private right of action in Maine state court, including recovery for the greater of actual damages or $250 per violation (with the potential for trebling for willful or knowing violation), plus attorney’s fees.
The potentially broad reach of this statute (particularly due to the lack of a scienter element in several of its provisions) makes it likely to be subject to challenge. In the meantime, businesses should consider their approach to achieving compliance. Given the breath of the Act, and the fact that some of its requirements apply regardless of a company’s knowledge of an individual’s age, complying with Maine’s new law will surely prove to be a challenge for essentially every enterprise.