Maine

A person is guilty of unauthorized dissemination of certain private images, a Class D crime, if, with intent to harass, torment, or threaten, the person intentionally or knowingly disseminates, displays, or publishes an image of another person in a state of nudity or engaged in a sexual act or sexual contact, or an image that has been created or modified so that it appears to show the depicted person in such a state, knowing the depicted person is identifiable and has not consented.

A 2025 amendment (P.L. 2025, ch. 400) added the created-or-modified-image language and a matching definition of image that reaches a computer data file or other electronically or mechanically reproduced visual image, bringing an AI-generated or AI-manipulated sexual deepfake within the existing non-consensual-intimate-image crime rather than creating a separate offense.

The same chapter also touched Maine's protection-from-abuse and protection-from-harassment statutes (19-A M.R.S. § 4102; 5 M.R.S. § 4651), per the enacting bill's own list of affected sections; those companion provisions are not separately researched here. The Legislature's own bill-status page records enactment and the Governor's signature on June 20, 2025, not June 25 as a secondary tracker reports.

A person may not provide, advertise, or otherwise offer therapy or psychotherapy services to the public, including through Internet-based artificial intelligence, unless those services are provided by a professional licensed in Maine to practice psychotherapy or behavioral health therapy; a violation is a violation of the Maine Unfair Trade Practices Act.

The same act enacts parallel provisions across seven licensing-board chapters of Title 32 (including 32 M.R.S. §§ 2113, 2600-G, 3300-J, 3820-A, 6207-D, 7009, and 13870) that let a Maine-licensed therapy professional use AI for administrative support such as scheduling or billing and, with the client's written disclosure and consent, for supplementary support such as session notes, but forbid letting AI make an independent therapeutic decision, interact directly with a client in therapeutic communication, or generate a treatment recommendation without the licensee's review and approval; a violation of a board-chapter provision is enforced through board discipline under 10 M.R.S. § 8003(5) rather than through the Unfair Trade Practices Act.

Each provision excepts an AI-based intervention used solely within an institutional-review-board-approved research project. Enacted as LD 2082 (P.L. 2026, ch. 687) and signed by the Governor on April 13, 2026.

A person may not use an AI chatbot, or any other computer technology that simulates human conversation, to engage in trade and commerce with a consumer in a way that may mislead or deceive a reasonable consumer into believing they are engaging with a human being, unless the consumer is notified in a clear and conspicuous manner that they are not. A violation is a violation of the Maine Unfair Trade Practices Act.

The provision was enacted as LD 1727 (P.L. 2025, ch. 294), originally allocated to 10 M.R.S. § 1500-Y and since reallocated by the Revisor of Statutes to its current citation, § 1500-DD. The Legislature's own bill-status page records enactment and the Governor's signature on June 12, 2025.

Whenever a political public communication that already requires a disclosure under Maine campaign-finance law contains synthetic media of a candidate, the communication must also carry the words THIS COMMUNICATION CONTAINS AUDIO, VIDEO AND/OR IMAGES THAT HAVE BEEN MANIPULATED OR ALTERED.

Synthetic media is defined as an image, audio recording, or video recording of a candidate that, in a manner likely to deceive a reasonable person, depicts the candidate saying or doing something the candidate did not say or do, or that has been manipulated to give a materially different impression of the candidate's appearance, action, or speech than the unaltered original; satire, parody, and technical clarity edits that do not change the impression given are excluded.

A violation of this subsection carries a civil penalty of up to 500% of the expenditure on the offending communication, compared with 100% for other disclosure violations under the same section, and a broadcaster or newspaper is liable only if it publishes or broadcasts with actual knowledge that the communication contains synthetic media. Enacted as LD 517 (P.L. 2026, ch. 593) and signed by the Governor on March 23, 2026.

A person must notify affected Maine residents of a breach of security as expediently as possible and without unreasonable delay, no more than 30 days after becoming aware of the breach and identifying its scope absent a law-enforcement delay, and must notify the appropriate state regulator within the Department of Professional and Financial Regulation, or the Attorney General if unregulated by that department.

A violation carries a fine of up to $500 per violation, up to $2,500 per day, and the chapter's "cumulative effect" clause (sec. 1349(3)) preserves rights and remedies available under other federal or state law rather than itself granting one; unlike Virginia's damages-preservation clause, it names no individual right to recover damages, so it is not read as a private right of action.

The section's own history note dates enactment to PL 2005, c. 379, sec. 1, amended by PL 2005, c. 583, PL 2009, c. 161, and PL 2019, c. 512, without printing a same-page effective date, so no effective date is recorded here.

A provider of broadband internet access service may not use, disclose, sell, or permit access to a customer's customer personal information except with the customer's express, affirmative, opt-in consent, revocable at any time, and may not refuse service or charge a penalty or offer a discount based on the customer's consent decision.

"Customer personal information" is defined broadly (name, billing information, Social Security number, demographic data, browsing history, application usage history, precise geolocation, financial and health information, children's information, device identifiers, communications content, and origin and destination IP addresses) but never mentions biometric data.

The section's own history note dates enactment to PL 2019, c. 216, sec. 1, without printing a same-page effective date, so no effective date is recorded here; the section carries no amendment since. No enforcement or penalty provision appears within the section itself as read.

A person commits aggravated criminal invasion of computer privacy, a Class C crime, by intentionally making an unauthorized copy of a computer program, software, or information, knowing the person is not authorized to do so; by intentionally or knowingly damaging a computer resource with no reasonable ground to believe the person has the right to do so; or by intentionally or knowingly introducing or allowing the introduction of a computer virus into a computer resource.

Unauthorized copying under the first branch does not require proof of resulting damage, so it reaches bulk automated copying of data from a computer resource without authorization, not only intrusions that damage or infect a system.

A person is guilty of criminal invasion of computer privacy, a Class D crime, if the person intentionally accesses any computer resource knowing that the person is not authorized to do so. The statute states a bare authorization test with no separate requirement of malicious intent, deception, or resulting damage, so an intentional, knowing, unauthorized access alone completes the offense; no exception for a publicly accessible page is stated in the text.