Nation-leading bill guards personal privacy and provides data protections for Massachusetts residents
(BOSTON–09/25/2025) The Massachusetts Senate today unanimously approved the Massachusetts Data Privacy Act, landmark data privacy legislation that is poised to lead the nation in consumer protections, keeping pace with a digital landscape that increasingly puts Massachusetts residents’ sensitive personal information at risk. Senators passed the legislation on a bipartisan vote of 40–0.
The legislation, S.2608, establishes clear rights for Massachusetts residents regarding their personal data, including the right to know what information is being collected and the ability to opt out of having their data used for targeted advertising or sold to other companies.
Protected data includes health care information; face scans and fingerprints; precise geolocation; information about a person’s religion or ethnicity; information related to a person’s immigration status; and information pertaining to a child. Additional enhanced protections apply to minors, including a full ban on the sale of a young person’s personal data.
“Consumer data is the new digital gold, with technology companies tracking and selling all sorts of data that have no impact on their products or operations,” said Senator Cindy F. Friedman (D-Arlington), Chair of the Senate Committee on Steering and Policy. “Loose restrictions on the compilation and resale of personal data leaves Massachusetts residents vulnerable to bad actors nationwide and even worldwide. As we continue to talk about ways to protect our residents and defend our values, the passage of the Massachusetts Data Privacy Act shows the Senate’s commitment to ensuring anyone located in Massachusetts has a right to privacy and should be able to feel safe in our Commonwealth. I am especially thankful to see the adoption of an amendment I filed which ensures that affiliates of larger businesses that transfer sensitive data are captured under this new Act.”
The Massachusetts Data Privacy Act (MDPA) limits the collection of personal data, specifically protects personal information that is defined as sensitive in nature, and gives people rights over targeted advertising.
Further details are below.
- Guarantees the Consumer’s Right to Know. Specifies that people have a right to know if their personal data is being collected, allows them to see what data was collected, and allows them to find out who their data has been shared with.
- Gives Control to Consumers. Gives Massachusetts residents control over their personal data through new guaranteed rights to correct inaccurate data, delete personal information, and opt out of having their personal data sold to others.
- Creates Strong Enforcement Powers. Gives the Office of the Attorney General broad regulatory authority to enforce the provisions of the Massachusetts Data Privacy Act.
- Curtails Data Collection. Constrains companies’ unfettered collection of personal data by limiting them to only collecting what is reasonably necessary in order to provide their product or service. For certain sensitive types of data, including biometrics, precise GPS location, and health care data, businesses could only collect the information if it is strictly necessary.
- Bans Sensitive Data Sales. Prohibits any kind of entity, including businesses and nonprofits, from selling a person’s sensitive data. Protected categories of sensitive data include precise geolocation; health care information; biometric data, such as face and fingerprint scans; citizenship or immigration status; information revealing someone’s sex life, and any information about a person’s race, color, ethnicity, religion, sexual orientation, gender identity, or national origin; and information that pertains to a child.
- Limits Data Transfers. Limits entities from transferring sensitive data unless they first obtain the consumer’s affirmative consent.
- Creates Opt-Out Rights for Targeted Advertising. Gives consumers the right to opt out of having their personal data collected or processed for the purpose of targeted advertising or for sale to third parties.
- Bans the Sale of Children’s Data. Prohibits all entities from selling minors’ personal data.
- Blocks Targeted Ads for Minors. Prohibits companies from collecting or processing a child’s personal information for the purposes of targeting ads.
During the course of today’s debate, Senators voted to adopt meaningful amendments that further strengthened the bill, including:
- Amendment 4: Extends the ban on sales of geolocation data to cover anyone who visits Massachusetts for any reason, including travel to the state to pursue personal health care.
- Amendment 52: Ensures that businesses cannot sell sensitive data, regardless of whether they are otherwise exempt under the act.
The Massachusetts Data Privacy Act was advanced as a new draft out of the Senate Committee on Ways and Means on September 18 on a 16-0 vote, and a fact sheet to that draft is available here. A revised version of a bill previously advanced on May 12 by the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on a 5-0 vote. The joint committee solicited public testimony on the underlying legislation at a hearing in April.
Senators’ debate and votes on the legislation were livestreamed and archived video is available online.
The legislation was passed by the Senate and now moves to the House of Representatives for consideration.
###