The Maine legislature has voted to approve an online privacy bill, which now goes to governor Janet Mills for her signature. 

The bill, "An Act to Protect the Privacy of Online Customer Information," which passed unanimously, applies only to ISPs. Such provider may not use, disclose, sell or allow access to customer personal information without the consent of the customer--opt in--and may not refuse service to those who don't consent to such sharing or charge more for customers who don't allow that use.

ISPs can do all that with non-personal information unless the customer disallows it (opt out).

There are plenty of exceptions, for: provision of access service, to market service to that customer, to prevent fraud and abuse, or to provide geolocation info for emergency services, for relatives in the case of risk of death or serious harm to the customer, to provide emergency services.

The bill includes requirements for clear notice of terms of service and reasonable measures to protect personal info from unauthorized use. 

Its provisions stop at state lines, which is one of the reasons ISPs are pushing for national privacy legislation that would preempt what they call a "patchwork" of different state regs. 

The bill's provisions apply to ISPs "operating within the state when providing broadband internet access service to customers that are billed for service received in the state and are physically located in the state."

Mills ran on a platform that included expanding broadband access and last year praised Spectrum for its investment in the state.

Various states have been adopting privacy bills since congress invalidated a former FCC's broadband privacy rules and the FCC under new management ceded primary regulatory oversight of broadband access to the Federal Trade Commission.

Rep. Ro Khanna (D-Calif.) has proffered an opt-in centric "Internet Bill of Rights" for ISPs and edge providers that Khanna says was based "in part on the input provided during conversations with" a Who's Who of edge providers including Amazon, Apple, Google, Twitter, Facebook and others.

It consultation equates with support, the edge has gone all in for opt in. Khanna's district includes parts of Silicon Valley.

In rolling out the list, Khanna included a shout out from World Wide Web founder Tim Berners-Lee: "This bill of rights provides a set of principles that are about giving users more control of their online lives while creating a healthier internet economy."

Here is the list Khanna's office e-mailed to B&C/Multichannel News (after first handing it to The New York Times). The bracketed materials are B&C/Multichannel News editorial notations.

(1) "To have access to and knowledge of all collection and uses of personal data by companies;

(2) "To opt-in consent to the collection of personal data by any party and to the sharing of personal data with a third party; [The definition of "personal" would be crucial.]

(3) "Where context appropriate and with a fair process, to obtain, correct, or delete personal data controlled by any company and to have those requests honored by third parties [that is the "erase button" that both Sen. Ed Markey (D-Mass.) and Rep. Joe Barton (R-Tex.) advocated for kids' online data for years.

(4) "To have personal data secured and to be notified in a timely manner when a security breach or unauthorized access of personal data is discovered;

(5) "To move all personal data from one network to the next;

(6) "To access and use the internet without internet service providers blocking, throttling, engaging in paid prioritization, or otherwise unfairly favoring content, applications, services, or devices. [effectively restoring the FCC's network neutrality rules].

(7) "To internet service without the collection of data that is unnecessary for providing the requested service absent opt-in consent;

(8) "To have access to multiple viable, affordable internet platforms, services, and providers with clear and transparent pricing;

(9) "Not to be unfairly discriminated against or exploited based on your personal data [no digital red-lining];

and

(10) "To have an entity that collects your personal data have reasonable business practices and accountability to protect your privacy."