If you are reading this editorial on an electronic device, your internet service provider knows about it.

It also knows what other websites you have visited, what searches you have conducted, what you bought, what you didn’t buy, what bank you use and where you get your health care. As our lives move evermore online, more information is available about us, and the companies that we pay to get us on the internet can make a lot of money selling it.

That’s why the Legislature passed Public Law 216 last year, making Maine the first state to require internet service providers to ask permission before mining our data. That law surmounted an important legal hurdle this week, when U.S. District Court Judge Lance Walker threw out most of a lawsuit filed by industry leaders, who claimed that Maine had no right to regulate the business that they do in Maine.

It was a tough ruling for the industry. Walker flat out dismissed claims that the state’s right to regulate these companies is pre-empted by federal law. And he rejected a request to decide the case in the companies’ favor on their argument that selling customer information is protected by the First Amendment’s free speech guarantee. Calling this “a shoot the moon” argument, the judge said that states have more leeway regulating commercial speech than they would with political speech and it’s up to the companies to show that they have been harmed. “Not all speech deserves the same level of protection,” Walker wrote.

That part of the case will continue, but this is a very important early decision in what will likely be a long legal battle.

“While there will be more litigation, this initial ruling is a huge victory for Maine consumers and for our state’s efforts to take appropriate measures to protect their privacy,” Maine Attorney General Aaron M. Frey said.

Maine’s law is only a partial protection of our privacy. Other companies, including industry giants like Google and Facebook, also collect and sell our information. But we have the option of not using those sites. When so much of our personal, social and business lives is required to take place online, we have to have an internet service provider, and that should not give those companies a license to invade our privacy for profit.

Maine’s success in this case could spark other states to create similar safeguards for their residents, and it could even inspire Congress to take on more sweeping privacy regulations. We have a long way to go, but this is a promising first step.