Maine has passed a law forbidding ISPs from distributing customer data without the customer's consent.

While the ISPs say this means the sky is falling, I consider it inadequate. First, because it doesn't apply when the FBI sends a "national security letter" to get a copy of all the data. Second, because the ISPs have ways to get almost every customer to consent, in formal terms. The engineering of consent is very effective.

What we need is a law forbidding ISPs from keeping data about what customers do.