Massachusetts Senate Unanimously Passes Sweeping Data Privacy Bill

The Massachusetts Senate has unanimously approved a data privacy bill that lawmakers describe as a major step toward protecting residents' personal information. Supporters said the measure would place Massachusetts among the states with "the strongest data privacy laws in the country."

The legislation, called the Massachusetts Data Privacy Act (S.2619), passed the Senate on Sept. 25. Senate President Karen E. Spilka framed the bill as a response to the commercial trade in personal details. "When Massachusetts residents' personal information is being offered up for sale to the tech billionaire with the highest bid, it is imperative that we act decisively to protect individuals and families," she said in a news release. She called the bill "visionary" and a nation-leading example of data protection.

Under the bill, consumers would gain several new rights. They could learn whether a company is collecting their personal data, view what has been gathered, and find out who it has been shared with. They could also correct inaccurate information, request deletion, and opt out of having their data sold, including for targeted advertising.

The proposal also limits what businesses can collect. Companies would be allowed to gather only data that is "reasonably necessary" to deliver their product or service. For certain sensitive categories, such as health care data and GPS location information, collection would be permitted only when it is "strictly necessary."

The bill goes further by banning the sale of sensitive data altogether. The protected categories include health care data, biometric identifiers such as face scans and fingerprints, religious affiliation, immigration status, sexual orientation, and information from minors.

A company that wants to transfer sensitive data to another party would first have to obtain the consumer's affirmative consent. The bill defines that as a "written statement by electronic means or any other unambiguous affirmative action."

Enforcement would fall to the Massachusetts Attorney General's Office, which would have the authority to bring civil actions against companies that break the law. Any violation would be treated as an unfair or deceptive trade practice under state law.

The measure draws on similar laws elsewhere, including the Maryland Online Data Privacy Act of 2024, and incorporates some of the most protective provisions found nationally.

The bill now heads to the House of Representatives. If the House approves it, it would go to Gov. Maura Healey for approval. If enacted, most provisions would take effect Jan. 1, 2027, with additional sections following on June 1, 2027.