Rep. Stanley, MA House Pass Landmark Data Privacy Legislation with Strong Consumer Protections

BOSTON – Thursday, June 4, 2026 – Rep. Stanley joined his colleagues in the Massachusetts House of Representatives in unanimously passing comprehensive legislation establishing essential consumer data privacy rights for residents of the Commonwealth. The Massachusetts Consumer Data Privacy Act provides consumers with greater control over their own data. The bill increases accountability for companies and grants user data privacy protections to residents of and those present in Massachusetts. Highlights include strong privacy protections for minors and a blanket ban on the sale of precise geolocation data.

“With technology changing constantly, it is critical for the Commonwealth to step up and protect our personal, private and sensitive information,” said Representative Thomas M. Stanley (D-Waltham). This legislation limits companies to use only data that is absolutely necessary, restricting tracking of geolocation and personal information, to ensure that our residents can keep their information safe. Establishing a framework for data privacy was no small feat and would not have been possible without Speaker Mariano, Leader Moran, and Chair Farley-Bouvier. I'm grateful for their efforts to tackle this complex issue and produce a bill that provides meaningful safeguards in place for our residents.”

Limit Collection to What is Reasonably Necessary

The bill requires that personal data collection must be proportionate to providing requested services, and data must be protected and deleted when no longer necessary or required by law.

Data Subject Rights

Under the bill, data subject rights extend to all residents in Massachusetts. These rights include the right to access their personal information, the right to correct inaccurate information, the right to opt out of certain processes such as targeted advertising, the right to transport personal data, and the right to delete certain information.

Protections for Sensitive Data

The bill specifies that sensitive data, as defined below, cannot be sold or shared without a user’s affirmative consent. Companies cannot sell sensitive data without additional unambiguous, affirmative consent from a consumer.

Sensitive data includes information such as biometric or genetic information, precise geolocation data, health and wellness information, reproductive and sexual health data, data of a minor under 18, government-issued identifiers, and data that reveals an individual’s racial or ethnic origin, national origin or citizenship or immigration status, religious beliefs, sex life, sexual orientation, status as transgender or non-binary, union membership, status as a military service member or veteran, and status as a victim of a crime.

Protection for Children and Minors under 18

The bill provides special protections for individuals under 18, including a prohibition on targeted advertising to minors.

Ban on the Sale of Precise Geolocation Data

The bill includes a ban on the sale of precise geolocation data. Restricting the trade of location data helps protect people from surveillance, stalking, and the misuse of sensitive personal information. This protection is extended to both residents of Massachusetts and visitors, which is especially important now to protect people who travel to and within Massachusetts, including for reproductive and gender affirming health care.

Enforcement

The bill grants the Attorney General rulemaking authority and includes a private right of action. A private right of action allows consumers to hold the largest data holders accountable for any violations they may make. Rulemaking authority will allow the Attorney General to keep up with the pace of technological change and provide greater clarity in areas where it is needed.

The bill passed the House of Representatives 146-0 and now goes back to the Senate for further consideration.

###