A bill that has received majority support in both houses of the Legislature would create the toughest state internet privacy law in the nation, prohibiting carriers such as AT&T and Spectrum from selling Maine customers’ personal data without their permission.

On Wednesday, the House voted 96-45 in support of the bill, with nine Republicans voting with Democrats in the majority. Previously, it passed with a majority in the Senate on a voice vote.

The House amended the bill to delay its effective date until July 1, 2020,  in order to give internet service providers time to prepare for the new rules. The amendment would need to be accepted by the Senate before being sent back to the House and Senate for enactment, then on to the desk of Democratic Gov. Janet Mills.

The “opt-in” nature of the bill, which would require internet service providers to obtain express consent from customers to sell their personal data, would set it apart from other state internet privacy laws. The Maine bill would closely mirror a former Federal Communications Commission rule President Trump nullified by executive order in 2017, opening the door for internet service providers to start selling their customers’ personal data to third parties.

Like the FCC rule before it, the proposed Maine law also would prohibit any internet service provider from making the sale of customer data part of its mandatory terms of service. It also could not charge higher fees to customers who refuse to opt in, or penalize them in any way.

Supporters of the Maine bill say large telecommunications providers, which provide essential services, are boosting their profits by selling their customers’ sensitive personal information such as real-time location data. They said personal information flowing across the web should be regarded as the private property of internet users.

The Maine State Chamber of Commerce opposes the bill, saying it is bad policy to pass such restrictions on a state-by-state basis. It also suggested that the proposed law would create a false sense of privacy because it would only apply to internet service providers and not to other companies that do business on the web.

The chamber said it prefers a bill passed recently in California that applies to internet service providers as well as other technology firms such as Google, Microsoft, Amazon and Facebook. But that law is weaker than the one proposed in Maine in the sense that the California law requires consumers to opt-out, or specifically request that their data not be sold.

The sponsor of Maine’s bill, Sen. Shenna Bellows, D-Manchester, said she already is laying the groundwork for a follow-up internet privacy bill aimed at the likes of Facebook and Google in the next legislative session. Still, she said internet service providers are distinct in the sense that it is impossible for the typical consumer to avoid them.

“You can use the internet without using Facebook,” Bellows said. “You can’t use the internet without using your internet service provider.”

Bellows also noted that using Facebook or Google is free, and that some consumers consider it a fair exchange to allow those services to sell certain customer data to generate revenue. Internet service providers charge money for their services and are capable of generating healthy profits without selling customer data, she said.

Bellows said large providers such as Verizon and Xfinity have access to a tremendous volume of customer data, but unlike other services that facilitate private communications, there is no law prohibiting internet providers from sharing or selling the information that passes through their hands.

“When you put a letter in the post office, you assume that the letter belongs to you,” she said. “You would never assume that the post office would say, ‘That letter now belongs to me. I can sell the contents of that letter.'”

Ben Gilman, general counsel for the Maine State Chamber, said the proposed Maine law isn’t comprehensive enough and will not fully protect consumers’ private data. He said it would give Mainers a false sense of security that their private information was safe.

“If we’re going to do it, it needs to be comprehensive in nature,” Gilman said, adding that it should ideally be done at the federal level.

Still, Gilman struggled to explain why a bill that is essentially aimed at regulating a type of utility must also apply its restrictions to end users of that utility in order to be effective. When asked how the proposed law is different from, say, a regulation that applies to phone companies but not every business with a phone number, he replied, “I think it’s different because it’s the internet, and it’s in widespread use by everyone.”

The bill’s omission of any restrictions on free services such as Facebook and Google is also intended to shield the proposed law from potential lawsuits, lawmakers have said. It would only apply to internet service providers that collect revenue from Maine residents, an attempt to avoid running afoul of the U.S. Constitution’s interstate commerce clause.

American Civil Liberties Union of Maine Advocacy Director Oamshri Amarasingham said the problem Maine’s internet privacy bill would address is not academic or hypothetical. She said there are established reports of internet service providers selling sensitive customer data, such as AT&T, T-Mobile and Sprint selling real-time customer location data to bounty hunters.

“My internet provider sees everything I do online,” Amarasingham said. “The wealth of information internet providers collect is unlike anything we’ve ever seen before.”