US Judge Says Maine ISP Privacy Law Not Preempted

States and privacy advocates hailed a federal court ruling Tuesday that said Maine’s ISP privacy law isn’t preempted by Congress or the FCC. The U.S. District Court of Maine order (in Pacer) is a preliminary win for Maine’s 2019 law countering Congress’ 2017 Congressional Review Act (CRA) repeal of 2016 FCC broadband privacy rules. It could pave the way for more state privacy laws and may have implications for state net neutrality laws, said the state law's supporters.

Judge Lance Walker denied industry plaintiffs' motion for judgment on the pleadings but granted Maine's cross-motion on whether the state law is preempted. Walker rejected industry claims the Maine law conflicts with the CRA repeal and the FCC net neutrality order overturning its previous one (see 2006110033). “Plaintiffs’ argument flies in the face of a strong presumption against implied federal preemption of state law,” he wrote. Privacy regulation is a field in which states have great latitude under police powers to legislate, said Walker, also disagreeing the law is subject to the strictest First Amendment scrutiny.

The case will continue on constitutional questions. “While there will be more litigation, this initial ruling is a huge victory for Maine consumers and for our state’s efforts to take appropriate measures to protect their privacy,” Maine Attorney General Aaron Frey (D) said in a statement. “We are confident that the law will withstand the industry’s First Amendment challenge.”

NCTA disagreed with the court and again sought a national privacy law applying to all types of companies. “The glaring deficiencies with the Maine privacy statute remain,” said a cable association spokesperson. Another plaintiff, ACA Connects, declined comment, while CTIA referred us to a February statement and USTelecom didn’t comment.

Consumer privacy protection is “squarely within” state police power, emailed NARUC General Counsel Brad Ramsay. “A CRA action to effectively vacate a federal rule cannot be construed to preempt State action” and the U.S. Appeals Court for the D.C. Circuit earlier ruled the FCC net neutrality order doesn’t necessarily preempt states, he said. “The effort to manufacture a conflict where none exists is evident. The impossibility exception simply doesn’t allow federal agency non-action -- a policy not required by the relevant statute -- to override state protections.”

“This is very, very encouraging,” building on what the D.C. Circuit said about preemption, National Association of State Utility Consumer Advocates Telecom Committee Chair Regina Costa told us. “Whether the industry likes it or not, states have the authority to look after the interests of their consumers.”

The preemption ruling is important for “privacy advocates all across the country who can look to this decision for guidance and encouragement that states and state legislatures have a role to play in protecting customer privacy,” said Zachary Heiden, American Civil Liberties Union Maine chief counsel, in an interview. ACLU Maine fought hard for the law it believes is constitutional, he said. “I hope that the upshot of this decision is more energy devoted to protecting privacy at the state level,” and it’s “positive” for state consumer protection policies generally, he said.

The FCC declined comment.

No Preemption

Congress' repeal of one FCC order “neither creates a broad federal policy nor speaks to what states might do in the ISP Privacy Order’s absence,” Walker said. Industry plaintiffs failed to show any obstacle the Maine law creates for federal law. Walker rejected plaintiffs’ citing of lawmaker statements on the CRA’s intent, saying courts must interpret a statue by its ordinary meaning when enacted. "Anything more than that is anti-democratic vanity run amuck; a judicial astrologist’s attempt to divine the legislative heavens with an armillary sphere and palm readings. The words of a law are not the beginning of a riddle as to its meaning.”

"The idea that the FCC’s relinquishment of authority over ISPs creates a federal scheme prohibiting state privacy regulation of ISPs blinks reality,” Walker said. The agency’s net neutrality order wasn’t “affirmative deregulation” but “a decision by the FCC that it lacked authority to regulate in the first place and would defer to the FTC’s enforcement of existing antitrust and consumer protection laws,” Walker said. “Not only is the FCC’s abdication of authority in favor of the FTC of dubious preemptive effect, but Plaintiffs also have failed to identify any conflict between the FCC’s proclamation that the FTC is the proper federal regulator of ISPs ... and Maine’s decision to impose privacy protections at the state level.”

Commercial speech is less protected than other types, and plaintiffs haven’t “done enough” to show they deserve judgment on their claim that the Maine law is “a facially unconstitutional violation of the First Amendment,” Walker said. Plaintiffs haven't shown the law's vagueness chills their speech, he said. The court doesn’t have enough information to assess whether Maine has a substantial interest in regulating privacy, he said: the state still has "plenty of room to show -- through discovery -- that its privacy statute does not overshoot the mark.”

“The ISPs attempted an early kill shot, but they lost badly,” emailed Andrew Schwartzman, Benton Institute for Broadband & Society senior counselor. “They failed to convince a Trump-appointee that Maine's privacy statute was preempted by Congress and the FCC. While they will have another opportunity to pursue their First Amendment claims with a more fully developed factual record, the judge rejected their call for the highest level of First Amendment analysis, which leaves them unlikely to succeed on those issues as well.”

“The judge's preemption analysis will be a useful precedent in the pending litigation challenging the Vermont and California net neutrality laws,” Schwartzman noted. Industry suits against those state laws had been held pending resolution of Mozilla and others’ challenge of the FCC repealing an earlier net neutrality order but may move forward now that Mozilla and others let pass Monday's deadline to appeal to the Supreme Court (see 2007070012).

The judge is right that “absence of federal broadband privacy rules cannot serve as the basis for pre-empting Maine’s state broadband privacy rules,” and the decision is “a good first step towards deflating the industry's ‘shoot-the-moon’ attempt to use the First Amendment as a deregulatory tool,” said Georgetown Law Institute for Technology Law and Policy Distinguished Fellow Gigi Sohn. It supports the D.C. Circuit’s Mozilla ruling, “which has allowed for states like California, Vermont and Washington to pass laws protecting Internet users from anticompetitive and anti-consumer practices by broadband providers,” she said. The judge in denying facial First and 14th Amendment challenges at this time used the phrase shoot the moon.

“This bodes well for other state efforts to protect the privacy of broadband users and open internet principles,” said Public Knowledge Legal Director John Bergmayer.

It shows the need for a national law that "clearly preempts" a state patchwork, emailed Free State Foundation President Randolph May. The case raised “some fairly novel questions," and if plaintiffs appeal, it "remains an open question as to whether they may ultimately succeed," he said: The court order shouldn't affect net neutrality preemption cases "because the federal policy against inconsistent net neutrality-type regulation of ISPs is already more clearly expressed than in the privacy area."