11 months ago
Rep. Maggie O’Neil, a Maine legislator, wanted to give the state’s residents a strong set of new online privacy rights. She introduced a data-privacy bill in May — rebuffing a Meta lobbyist, who wanted her to get behind a more industry-friendly law.
Then L.L. Bean arrived.
In October, a lawyer for the venerable outdoor retailer appeared in the state Capitol to testify against her bill, saying its new privacy requirements would add unnecessary burdens for businesses. The company also sent a letter urging lawmakers to follow existing privacy regulations in other states, rather than carving out a new set of protections for Maine.
As one of Maine’s largest employers and best-known brands, the century-old L.L. Bean has significant clout in the state Capitol. It didn’t endorse a specific law, but its testimony aligned directly with a rival privacy bill supported by the tech industry — one that would give companies much more latitude to use, buy and sell data on consumers.
That bill, drafted by a state senator, had input from lobbyists from Meta, the cable giant Charter Communications, and the State Privacy and Security Coalition — a tech industry group representing companies such as Google and Amazon.
The strange bedfellows in Maine’s privacy fight — a family-owned retail institution standing shoulder-to-shoulder with global tech giants like Meta — offer a window into the complexities of the national debate over data privacy laws currently being waged in state capitol after state capitol.
As customer data becomes an increasingly lucrative global industry, and a growing issue for advocates and consumers, the federal government has largely stalled in its efforts to pass national laws. So companies have been waging their influence wars in state legislatures — often cobbling together powerful coalitions of local businesses and national industries to water down potential local laws.
A review of public records in multiple states — California, Delaware, Indiana and Montana — shows that local businesses have amplified the tech industry’s messages in privacy debates across the country.
Often, these arguments come from local business groups, like retail associations or a states’ Chamber of Commerce, some of which disclose partnerships with tech giants like Amazon, Google and Meta. But rarely does a nationally known brand like L.L. Bean stake its own claim in the debate.
In Maine, the debate is now between two potential laws: O’Neil’s bill, based on a now-stalled federal law supported by privacy advocates, and state Sen. Lisa Keim’s rival bill, the Maine Consumer Privacy Act, based on business-friendly legislation that has already passed in 11 other states with the tech industry’s support.
Keim said L.L. Bean’s testimony played a significant role in shaping Maine lawmakers’ perspectives on her bill: “L.L. Bean was incredibly instrumental in how we looked at language and what we’re doing,” Keim said in an interview.
L.L. Bean says it did not coordinate with Meta or any other tech companies in Maine, instead pushing its own views as a longtime retailer that needs customer data for analytics and advertising.
The national legal landscape around privacy has become increasingly complex as states pass their own laws, and L.L. Bean says it already complies with the much more stringent privacy law passed by California in 2018, which for many firms has become a de facto national standard. Its push against O’Neil’s proposal was to “provide a level of continuity among states,” said Jason Sulham, L.L. Bean’s manager of public affairs, in a statement.
State-level consumer privacy laws have arisen from both progressive Democrats and Republicans, like Keim, worried about too much corporate control of personal data. When they do, they trigger well-funded lobbying opposition from the tech industry, which depends on consumer data as a business asset.
They’re also opposed by many smaller businesses — and by national brands like L.L. Bean — that rely on customer data to advertise their products online and understand customer habits. Retailers worry that privacy laws written to limit how companies can use people’s data could also harm their outreach.
Those smaller businesses can be powerful voices at the state level. State lawmakers are often skeptical of lobbyists from companies like Meta, Google and Amazon — out-of-state tech giants that are often the reason for introducing privacy regulations in the first place. But local business associations that promote the same viewpoints in the statehouse can help turn the tide.
In Maine, small businesses — and larger ones, like L.L. Bean — are represented by the Maine State Chamber of Commerce, which has testified against O’Neil’s bill and supports Keim’s legislation. Its members have “significant concerns about the impacts of the proposed privacy legislation,” said a spokesperson for the Maine State Chamber of Commerce.
While mom-and-pop shops don’t exactly have the same interests as Big Tech, small businesses have come to rely on tech giants for outreach and advertising. The tech industry used the same strategy nationally by focusing on small businesses’ advertising capabilities when Congress was mulling over antitrust legislation in 2022. When Apple introduced stronger privacy features to prevent unwanted tracking online, Meta opposed it in a blog post titled “Speaking Up For Small Businesses.”
TechNet, an industry group with members including Apple, Amazon, Meta and Google, has highlighted in the past how small businesses might bear big costs — more than $20 billion annually — for lawyers to help them navigate privacy regulations if all 50 states had different rules. That statistic — often cited to state lawmakers considering stronger regulations — comes from a tech industry-funded think tank.
In Maine, the tug-of-war over the two bills has turned into something of a fog. Under criticism for her industry-friendly bill, Keim has started to make changes — eliminating an exemption for smaller businesses, and requiring companies to get “opt-in” consent for data collection, rather than relying on an opt-out model like the bills in 11 other states. She also says she’s interested in tightening protections in other ways: reexamining a “right to cure” provision that gives companies a window to fix violations before an attorney general can sue, and removing exemptions for nonprofits and academic institutions.
Keim now finds herself fighting the industry over some of those changes: TechNet, the Computer and Communications Industry Association and the Maine State Chamber of Commerce have called for amendments to remove the opt-in requirements.
Meanwhile, O’Neil’s rival proposal — which would be a first-in-the-nation state privacy law if Maine decides to move forward with it — is getting questions from lawmakers trying to better understand its implications. At a work session on Dec. 11, state lawmakers asked O’Neil about potential exemptions for Maine’s businesses and how her bill would be enforced.
The two rival bill’s authors say they have been in touch about their privacy regulations. O’Neil says she hopes that Maine’s legislature can agree on a middle ground.
“One thing I’ve been thinking about is, how can we take the elements that are both in my bill and Sen. Keim’s bill and harmonize those,” O’Neil said at the work session.
While Keim has been working with O’Neil, she said she doesn’t see the two bills being combined because of key differences in the language. Keim’s vision for Maine’s privacy legislation is taking the tech industry’s preferred model, and toughening up the language.
L.L. Bean hasn’t commented on any of her revisions to the bill, but even then, the esteemed local institution won’t have the last word.
“I’m not unduly influenced by any one entity,” Keim said. “I’m going to listen to all sides but forge ahead with language that I believe is best suited for Maine.”
English (US)