English
Spanish
Portuguese
Arabic
Haitian Creole
Chinese (Traditional)
Legislation provides consumers with greater control over their own data
On June 4, 2026, the Massachusetts House of Representatives passed (146-0) a comprehensive bill establishing essential consumer data privacy rights for residents of the Commonwealth. The Massachusetts Consumer Data Privacy Act provides consumers with greater control over their own data. The bill increases accountability for companies and grants user data privacy protections to residents of and those present in Massachusetts. Highlights include strong privacy protections for minors and a blanket ban on the sale of precise geolocation data.
Back on September 25, 2025, the Senate had passed (40-0) its own version of the bill. The Senate did not concur with a House amendment, so on June 11, 2026, a committee of conference was appointed. The committee will reconcile the differences between the two bills.
“This legislation is about ensuring that the Commonwealth’s laws keep pace with the challenges of an increasingly data-driven world, where technology is embedded in nearly every aspect of daily life. Consumers deserve meaningful protections for their personal information and greater control over how that information is collected, used, and sold,” said House Speaker Ronald J. Mariano (D-Quincy). “This bill establishes common-sense safeguards for sensitive data, strengthens transparency, and promotes accountability for entities that profit from personal information – striking an important balance between encouraging innovation and protecting the privacy rights of Massachusetts residents. I want to thank Leader Moran, Chair Farley-Bouvier, and all my colleagues in the House for recognizing the importance of these critical reforms, and for voting to advance them.”
“The Massachusetts Consumer Data Privacy Act centers the consumer and is a must for the 21st century. Through the technology that we have come to rely on daily, companies collect and legally sell our data, including sensitive data, without our knowledge or consent,” said State Representative Tricia Farley-Bouvier (D-Pittsfield), who is House Chair of the Legislature’s Joint Committee on Advanced Information Technology, the Internet and Cybersecurity. “The Massachusetts Consumer Data Privacy Act is a critical step to hold companies accountable, protect minors, and establish strong consumer protections. It is the result of public hearings and thoughtful deliberation with privacy experts, advocates, and industry representatives.”
“Massachusetts residents should have the right to know who is collecting their personal information, how it is being used, and the ability to say ‘no’ when that information is sold or shared. In today’s digital world, data privacy is not a luxury, it is a consumer protection issue,” said State Representative Jessica Giannino (D-Revere). “This legislation gives individuals greater control over their personal information, protects children from targeted advertising, bans the sale of precise geolocation data, and holds companies accountable for safeguarding sensitive data. I am proud to support this bipartisan effort to modernize our laws and ensure that Massachusetts remains a leader in protecting the privacy and security of its residents.”
“I am proud to have supported this important legislation. Data privacy in 2026 is critical. All of us have been affected by the wholesale capturing of our data. This law makes Massachusetts put people and privacy first. I look forward to the Governor signing this legislation into law,” said State Representative Jeffrey Rosario Turco (D- Winthrop).
Massachusetts Consumer Data Privacy Act mandates
Limit collection to what is reasonably necessary: The bill requires that personal data collection must be proportionate to providing requested services, and data must be protected and deleted when no longer necessary or required by law.
Data subject rights: Under the bill, data subject rights extend to all residents in Massachusetts. These rights include the right to access their personal information, the right to correct inaccurate information, the right to opt out of certain processes, such as targeted advertising, the right to transport personal data and the right to delete certain information.
Protections for sensitive data: The bill specifies that sensitive data, as defined below, cannot be sold or shared without a user’s affirmative consent. Companies cannot sell sensitive data without additional unambiguous, affirmative consent from a consumer.
Sensitive data includes information such as biometric or genetic information, precise geolocation data, health and wellness information, reproductive and sexual health data, data of a minor under 18, government-issued identifiers, and data that reveals an individual’s racial or ethnic origin, national origin or citizenship or immigration status, religious beliefs, sex life, sexual orientation, status as transgender or nonbinary, union membership, status as a military service member or veteran and status as a victim of a crime.
Protection for children and minors under 18: The bill provides special protections for individuals under 18, including a prohibition on targeted advertising to minors.
Ban on the sale of precise geolocation data: The bill includes a ban on the sale of precise geolocation data. Restricting the trade of location data helps protect people from surveillance, stalking and the misuse of sensitive personal information. This protection is extended to both residents of Massachusetts and visitors, which is especially important now to protect people who travel to and within Massachusetts, including for reproductive and gender affirming health care.
Enforcement: The bill grants the Attorney General rulemaking authority and includes a private right of action. A private right of action allows consumers to hold the largest data holders accountable for any violations they might make. Rulemaking authority will allow the Attorney General to keep up with the pace of technological change and provide greater clarity in areas where it is needed.
