Senate Passes the Massachusetts Data Privacy Act

 Senate Passes the Massachusetts Data Privacy Act 

Nation-leading bill guards personal privacy and provides data protections for Massachusetts residents 

 

(BOSTON—09/25/2025) The Massachusetts Senate today unanimously approved the Massachusetts Data Privacy Act, landmark data privacy legislation that is poised to lead the nation in consumer protections, keeping pace with a digital landscape that increasingly puts Massachusetts residents’ sensitive personal information at risk. Senators passed the legislation on a bipartisan vote of 40–0. 

 

The legislation, S.2608, establishes clear rights for Massachusetts residents regarding their personal data, including the right to know what information is being collected and the ability to opt out of having their data used for targeted advertising or sold to other companies. 

 

Protected data includes health care information; face scans and fingerprints; precise geolocation; information about a person’s religion or ethnicity; information related to a person’s immigration status; and information pertaining to a child. Additional enhanced protections apply to minors, including a full ban on the sale of a young person’s personal data. 

 

“When Massachusetts residents’ personal information is being offered up for sale to the tech billionaire with the highest bid, it is imperative that we act decisively to protect individuals and families,” said Senate President Karen E. Spilka (D-Ashland). “As part of our ongoing effort to protect our residents, defend our values and lead Massachusetts during a time when those values are under attack, I am proud of the Senate for passing this visionary legislation which will offer some of the best data privacy protections in the country. I am deeply grateful to Majority Leader Creem for her leadership on this topic, Chair Rodrigues for stewarding the bill to the floor, and to all the Senators who contributed components to this bill.” 

 

“I am thrilled that the Senate has passed the Massachusetts Data Privacy Act,” said Senate Majority Leader Cynthia Stone Creem (D-Newton). “This bill positions Massachusetts to have among the strongest data privacy laws in the country and makes it clear that our personal data can no longer be profited from without transparency and accountability to Massachusetts consumers. This is an important effort in strengthening protections for communities who are especially vulnerable to data privacy concerns, and sends the message that here in Massachusetts, you have rights over your personal information.” 

 

“In an era when technological innovations are continuing to advance at breakneck speed, this bipartisan consumer protection bill stands up for the safety of Massachusetts residents and protects their personal data from bad actors and nefarious profiteers,” said Senator Michael J. Rodrigues (D-Westport), Chair of the Senate Committee on Ways and Means. “I am proud that the Senate struck a collaborative, commonsense approach, passing arguably one of the strongest data privacy bills in the nation that institutes responsible safeguards around large companies’ use of sensitive and private information. I want to thank Senate President Spilka, Leader Creem, and my Senate colleagues for working together and delivering a victory for consumers, civil liberties, and personal security.” 

 

The Massachusetts Data Privacy Act (MDPA) limits the collection of personal data, specifically protects personal information that is defined as sensitive in nature, and gives people rights over targeted advertising.  

 

Further details are below. 

 

• Guarantees the Consumer’s Right to Know. Specifies that people have a right to know if their personal data is being collected, allows them to see what data was collected, and allows them to find out who their data has been shared with. 
• Gives Control to Consumers. Gives Massachusetts residents control over their personal data through new guaranteed rights to correct inaccurate data, delete personal information, and opt out of having their personal data sold to others. 
• Creates Strong Enforcement Powers. Gives the Office of the Attorney General broad regulatory authority to enforce the provisions of the Massachusetts Data Privacy Act. 
• Curtails Data Collection. Constrains companies’ unfettered collection of personal data by limiting them to only collecting what is reasonably necessary in order to provide their product or service. For certain sensitive types of data, including biometrics, precise GPS location, and health care data, businesses could only collect the information if it is strictly necessary. 
• Bans Sensitive Data Sales. Prohibits any kind of entity, including businesses and nonprofits, from selling a person’s sensitive data. Protected categories of sensitive data include precise geolocation; health care information; biometric data, such as face and fingerprint scans; citizenship or immigration status; information revealing someone’s sex life, and any information about a person’s race, color, ethnicity, religion, sexual orientation, gender identity, or national origin; and information that pertains to a child. 
• Limits Data Transfers. Limits entities from transferring sensitive data unless they first obtain the consumer’s affirmative consent. 
• Creates Opt-Out Rights for Targeted Advertising. Gives consumers the right to opt out of having their personal data collected or processed for the purpose of targeted advertising or for sale to third parties. 
• Bans the Sale of Children’s Data. Prohibits all entities from selling minors’ personal data. 
• Blocks Targeted Ads for Minors. Prohibits companies from collecting or processing a child’s personal information for the purposes of targeting ads. 

 

During the course of today’s debate, Senators voted to adopt meaningful amendments that further strengthened the bill, including: 

 

• Amendment 4: Extends the ban on sales of geolocation data to cover anyone who visits Massachusetts for any reason, including travel to the state to pursue personal health care. 
• Amendment 52: Ensures that businesses cannot sell sensitive data, regardless of whether they are otherwise exempt under the act. 

 

“Big tech companies make billions of dollars selling your personal data without giving you any say in what information they collect or how they use it. No one should profit off of anyone’s personal data. The Massachusetts Data Privacy Act returns the power of choice back to the people because your data belongs to you,” said Senator Michael O. Moore (D-Millbury), Senate Chair of the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity. “Representing one of the strongest data privacy protection actions in America, the MDPA empowers consumers, places strict limits on data collection, protects sensitive data, and more. This legislation is the culmination of three years of work, collaborations with advocates, and in-depth discussions with stakeholders and lawmakers in states with data protection laws—I could not be more proud to see it advance through the Senate today. I’d like to thank my committee staff for their years of work, committee vice chair Senator Payano, as well as Senate President Spilka, Ways and Means Chair Rodrigues, and all my colleagues in the Senate for their sense of urgency. I am hopeful that the House will soon join us in passing the MDPA.” 

 

“Today, the Senate’s passage of the Massachusetts Data Privacy Act ensures comprehensive data protection,” said Senator Barry R. Finegold (D-Andover), Senate Chair of the Joint Committee on Economic Development and Emerging Technologies. “This groundbreaking initiative gives consumers expanded rights over their personal data by protecting sensitive information—including for minors, limiting intrusive targeted ads, and granting the Attorney General new enforcement powers. Massachusetts is setting the standard for innovation and consumer protection.” 

 

The Massachusetts Data Privacy Act was advanced as a new draft out of the Senate Committee on Ways and Means on September 18 on a 16-0 vote, as a revised version of a bill previously advanced on May 12 by the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on a 5-0 vote. The joint committee solicited public testimony on the underlying legislation at a hearing in April. 

 

Senators’ debate and votes on the legislation were livestreamed and archived video is available online. 

 

The legislation was passed by the Senate and now moves to the House of Representatives for consideration.