Maine Privacy Bill Advances, Oregon AI Chatbot Bill Clears Legislature

IAPP Privacy News

Published March 6th, 2026

Detected March 13th, 2026

Summary

Maine's legislature has advanced a comprehensive privacy bill, the Maine Online Data Privacy Act, through both chambers. Oregon's Senate Bill 1546, an AI chatbot safety bill, has also cleared its state legislature and is heading to the governor. Both bills represent significant state-level regulatory developments.

View original document View source feed page

What changed

The Maine Legislature has advanced the Maine Online Data Privacy Act (LD 1822) through both chambers, with the Senate passing an amended version on March 5, 2026. This bill, largely mirroring Maryland's privacy law, includes stringent data minimization requirements and enhanced children's privacy protections. A notable amendment exempts political organizations, a point of contention during legislative debate. The bill's coverage thresholds apply to businesses processing personal data of at least 35,000 residents or 10,000 consumers if 20% of gross revenue comes from data sales.

Oregon's Senate Bill 1546, one of the first AI chatbot safety bills to clear a state legislature this year, is also moving forward. Companies operating in Maine will need to review the bill's provisions, particularly data minimization requirements, and prepare for compliance, especially if the attorney general's office prioritizes enforcement. The effective date for the Maine bill is set for September 1, 2027. The Oregon bill's implications for AI chatbot deployment and safety are also significant, though specific compliance actions are not detailed in this report.

What to do next

Review Maine LD 1822 for data minimization and children's privacy provisions.
Assess applicability based on data processing volumes and revenue from data sales.
Monitor Oregon SB 1546 for AI chatbot regulatory requirements.

Source document (simplified)

Published

6 March 2026

Subscribe to IAPP Newsletters
The Maine Legislature has advanced a comprehensive privacy bill through both chambers, but uncertainty is still swirling around its fate.

The Maine Senate passed an amended version of Legislative Document 1822, the Maine Online Data Privacy Act, on a 20-14 vote 5 March. The original version of the bill passed the Maine House weeks prior, but the House will now debate the Senate amended version that includes a controversial exemption for political organizations.

Much of the bill aligns closely with Maryland's comprehensive framework, which contains stringent data minimization requirements, enhanced children's privacy protections and prohibitions on sensitive data sales. The amended version introduced by the bill sponsor, state Sen. Anne Carney, D-Maine, includes the political organization exemption, updates to attorney general enforcement funding and a new 1 Sept. 2027 effective date.

Despite a Democratic trifecta with control of the legislature and the governor's office, the bill has advanced on small margins through committees and chambers. Those margins are now threatened by the political organization exemption, which showed in the 18-16 vote to allow the amendment.

During Senate floor remarks, state Sen. Joe Baldacci, D-Maine, explained why he joined Republicans in trying to defeat the exemption.

"These are neutral standards, not politically dictated standards," Baldacci said. "I don't see any First Amendment protection issue here. ... The bill by itself adequately protected the First Amendment."

Baldacci added the exemption doesn't help consumers and "does a disservice to the rest of the bill, which is a lot of very positive things."

Legislative debates have bogged down Maine's comprehensive aspirations for the last few years. State lawmakers used joint committee meetings in and out of the 2025 legislative session to consider multiple comprehensive bills and approaches. The aim was to find a consensus framework, whether it was one of the bills being considered or piecemealing a new bill from several proposals.

If the core provisions of LD 1822 can navigate additional chamber votes and get governor approval as currently constituted, the bill will require considerable compliance attention. The coverage thresholds include businesses that control or process the personal data of at least 35,000 residents, or the data of at least 10,000 consumers while deriving at least 20% of gross revenue from data sales.

"This is one that companies will need to pay attention to, in particular its data minimization provisions, but there are other provisions of note," Troutman Locke Pepper Partner David Stauss, CIPP/E, CIPP/US, CIPT, FIP, told the IAPP. "A lot will also come down to whether the attorney general’s office prioritizes enforcement. State laws that are enforced, and are written in ways that enforcement is more straightforward, are the ones that get the most attention from companies."

Oregon's AI chatbot safety bill with PRA heads for governor's desk

Oregon Senate Bill 1546 is one of the first artificial intelligence chatbot bills to clear a state legislature this year despite many introduced across the states. However, Oregon's bill may prove to be one of the most impactful digital safety bills this year due to its private right of action for statutory damages.

SB 1546 received near-unanimous approval in three final floor votes between chambers, including a 28-2 final Senate vote 5 March. Gov. Tina Kotek, D-Ore., has five days to act on the bill, which has a default 1 Jan. 2027 after lawmakers did not specify an effective date.

Under the bill, AI chatbot operators are staked to required safety notifications and measures for all users while additional obligations will be attached to users who operators have "reason to believe" are minors. General transparency disclosures about speaking with a chatbot instead of human lead the safety requirements, which also include user break reminders and prohibitions on addictive algorithms.

"We can’t make the same mistakes with AI that we made with social media and leave our kids vulnerable and without meaningful safeguards. This bill would put Oregon in the leading edge of meeting the risks posed by AI chatbots," state Rep. April Dobson, D-Ore., said in a statement with fellow lawmakers after House passage 4 March.

According to the final bill text, the PRA is available to individuals when they suffer "an ascertainable loss of money or property or other injury in fact." Safety violations and subsequent PRA applicability are up for interpretation, leaving the possibility of frivolous litigation depending on the perception of harms.

"It is clearly intended to apply to AI companions but the applicability language and exceptions are ambiguous, especially considering that chatbots are rapidly developing," Troutman's Stauss said. "With a private right of action and statutory damages, this is one of those bills companies should be mindful of when deploying consumer-facing interactive AI. The hope is that this does not become another CIPA situation as chatbot technology evolves."

This content is eligible for Continuing Professional Education credits. Please self-submit according to CPE policy guidelines.

Submit for CPEs