If Passed Would Set a National Standard for Consumer Data Protections
STATE HOUSE, BOSTON, SEPT. 18, 2025…..Senate Democrats are ready to act on an omnibus data privacy bill that would install restrictions on the type of information that companies can collect, block the sale of personal sensitive data, and insulate children from targeted advertising.
The Senate Ways and Means Committee on Thursday approved a redrafted Massachusetts Data Privacy Act (S 2608), with the branch expected to debate and vote on the legislation on Thursday, Sept. 25.
Tech giants and other companies could only collect personal data that is “reasonably necessary” for providing products and services, according to a bill summary. Personal sensitive data — including biometrics, geolocation and health care data — also cannot be collected unless it’s “strictly necessary,” the summary says.
“This legislation is going to end the Wild West of data collection in Massachusetts,” Senate President Karen Spilka told reporters. “We give residents control over what information is shared, and we make clear that kids should be off limits, totally off limits, and this will protect minors from surveillance and targeted advertising.”
Businesses, nonprofits and other entities cannot sell sensitive information, including precise geolocation data that could shed insights into a person accessing reproductive health care, under the bill. The data cannot be transferred without consumer’s “affirmative consent,” said Senate Majority Leader Cindy Creem.
The legislation bans the sale of minors’ personal data, and companies could not collect or process their data to deploy targeted ads.
Consumers would gain the right to update inaccurate data, delete personal data and opt out of data being sold to others. People could also opt out of targeted advertising.
“This bipartisan, commonsense bill reported out by the committee today is arguably one of the strongest data privacy bills in the country. The legislation strikes a delicate and thoughtful balance, establishing clear guidelines for companies regarding the collection, storage, and use of consumer data,” Senate Ways and Means Chair Michael Rodrigues said in a statement. “It rests squarely on protecting consumers, giving individuals greater control over their personal data during this era of rapid technological innovation.”
The redrafted bill drops a provision that would have given Bay Staters a private right of action, Creem said. The Newton Democrat stressed Attorney General Andrea Campbell would have the authority to enforce the law and issue regulations.
“There’s also the availability of a 93A frivolous action that the AG can take,” Creem said, referring to the state’s consumer protection law. “So that’s a big enforcement piece and the attorney general is going to have to have some sort of a portal or something for consumers to go in and register their complaints. And the attorney general is going to continue to monitor that.”
Creem said senators crafted the bill with input from the tech industry and studied privacy bills in other states.
“We’ve met with everyone, anyone that wanted to meet with us,” she said.
Asked whether she expects industry opposition to the legislation, Creem chuckled affirmatively.
“Like everything else, nobody likes controls, and certainly even the fact that we’re going to be collecting less data means less sales, less information they have to sell to other people,” Creem said.
At a committee hearing in April, Andrew Kingman of the State Privacy and Security Coalition registered his support for a Rep. Kate Hogan bill (H 80) that uses a data privacy network adopted by Connecticut, Rhode Island, New Hampshire and 15 other states. His coalition represents 35 companies and six trade associations, including Amazon, Google, Netflix and Meta.
He cautioned against Massachusetts embracing a separate framework and data minimization standards, saying companies won’t know “what’s expected of them or how to comply.”
“They also unintentionally — clearly, but unintentionally — can have the effect of depriving marginalized populations of goods and services designed for them, and they can make it harder for Massachusetts businesses to reach their own customers than it is for those Massachusetts business to reach customers, again, in New Hampshire, Connecticut and Rhode Island,” Kingman had testified to the Advanced Information Technology, the Internet and Cybersecurity Committee.
