State of the states: Maine comprehensive privacy, Oregon AI chatbot bills on the move

The Maine Legislature has advanced a comprehensive privacy bill through both chambers, but uncertainty is still swirling around its fate.

The Maine Senate passed an amended version of Legislative Document 1822, the Maine Online Data Privacy Act, on a 20-14 vote 5 March. The original version of the bill passed the Maine House weeks prior, but the House will now debate the Senate amended version that includes a controversial exemption for political organizations.

Much of the bill aligns closely with Maryland's comprehensive framework, which contains stringent data minimization requirements, enhanced children's privacy protections and prohibitions on sensitive data sales. The amended version introduced by the bill sponsor, state Sen. Anne Carney, D-Maine, includes the political organization exemption, updates to attorney general enforcement funding and a new 1 Sept. 2027 effective date.

Despite a Democratic trifecta with control of the legislature and the governor's office, the bill has advanced on small margins through committees and chambers. Those margins are now threatened by the political organization exemption, which showed in the 18-16 vote to allow the amendment.

During Senate floor remarks, state Sen. Joe Baldacci, D-Maine, explained why he joined Republicans in trying to defeat the exemption.

"These are neutral standards, not politically dictated standards," Baldacci said. "I don't see any First Amendment protection issue here. ... The bill by itself adequately protected the First Amendment."

Baldacci added the exemption doesn't help consumers and "does a disservice to the rest of the bill, which is a lot of very positive things."

Legislative debates have bogged down Maine's comprehensive aspirations for the last few years. State lawmakers used joint committee meetings in and out of the 2025 legislative session to consider multiple comprehensive bills and approaches. The aim was to find a consensus framework, whether it was one of the bills being considered or piecemealing a new bill from several proposals.

If the core provisions of LD 1822 can navigate additional chamber votes and get governor approval as currently constituted, the bill will require considerable compliance attention. The coverage thresholds include businesses that control or process the personal data of at least 35,000 residents, or the data of at least 10,000 consumers while deriving at least 20% of gross revenue from data sales.

"This is one that companies will need to pay attention to, in particular its data minimization provisions, but there are other provisions of note," Troutman Locke Pepper Partner David Stauss, CIPP/E, CIPP/US, CIPT, FIP, told the IAPP. "A lot will also come down to whether the attorney general’s office prioritizes enforcement. State laws that are enforced, and are written in ways that enforcement is more straightforward, are the ones that get the most attention from companies."

Oregon's AI chatbot safety bill with PRA heads for governor's desk

Oregon Senate Bill 1546 is one of the first artificial intelligence chatbot bills to clear a state legislature this year despite many introduced across the states. However, Oregon's bill may prove to be one of the most impactful digital safety bills this year due to its private right of action for statutory damages.

SB 1546 received near-unanimous approval in three final floor votes between chambers, including a 28-2 final Senate vote 5 March. Gov. Tina Kotek, D-Ore., has five days to act on the bill, which has a default 1 Jan. 2027 after lawmakers did not specify an effective date.

Under the bill, AI chatbot operators are staked to required safety notifications and measures for all users while additional obligations will be attached to users who operators have "reason to believe" are minors. General transparency disclosures about speaking with a chatbot instead of human lead the safety requirements, which also include user break reminders and prohibitions on addictive algorithms.

"We can’t make the same mistakes with AI that we made with social media and leave our kids vulnerable and without meaningful safeguards. This bill would put Oregon in the leading edge of meeting the risks posed by AI chatbots," state Rep. April Dobson, D-Ore., said in a statement with fellow lawmakers after House passage 4 March.

According to the final bill text, the PRA is available to individuals when they suffer "an ascertainable loss of money or property or other injury in fact." Safety violations and subsequent PRA applicability are up for interpretation, leaving the possibility of frivolous litigation depending on the perception of harms.

"It is clearly intended to apply to AI companions but the applicability language and exceptions are ambiguous, especially considering that chatbots are rapidly developing," Troutman's Stauss said. "With a private right of action and statutory damages, this is one of those bills companies should be mindful of when deploying consumer-facing interactive AI. The hope is that this does not become another CIPA situation as chatbot technology evolves."