(BOSTON 9/25/2025) — Today, the Massachusetts Senate unanimously voted to approve one of the strongest consumer data protection bills in the United States, safeguarding online personal privacy and civil liberties for Bay Staters. The Massachusetts Data Privacy Act (MDPA), introduced by Joint Committee on Advanced Information Technology, the Internet and Cybersecurity Chair Senator Michael Moore, protects young people, empowers consumers with new rights over their personal information, limits how businesses and tech companies can collect and use data, and introduces robust enforcement authority. It also protects residents of the Commonwealth from the exploitation of their precise GPS location, genetic information, health care information, and biometric data such as face or fingerprint scans.

In addition to limits on what big companies can do with personal data, S.2608 – An Act establishing the Massachusetts Data Privacy Act places strong limits on what personal information can be collected in the first place. It also allows people to opt out of being targeted by advertisers based on their personal data. The bill goes even further for young people, creating a stricter threshold to prevent targeted advertising to minors and the sale of their data.

“Big tech companies make billions of dollars selling your personal data without giving you any say in what information they collect or how they use it. No one should profit from anyone’s personal data. The Massachusetts Data Privacy Act returns the power of choice back to the people because your data belongs to you,” said Senator Michael Moore (D-Millbury). “Representing one of the strongest data privacy protection actions in America, the MDPA empowers consumers, places strict limits on data collection, protects sensitive data, and more. This legislation is the culmination of three years of work, collaborations with advocates, and in-depth discussions with stakeholders and lawmakers in states with data protection laws – I could not be more proud to see it advance through the Senate today. I’d like to thank my committee staff for their years of work, Majority Leader Creem for her leadership and support on strong data privacy legislation, as well as Senate President Spilka, Ways and Means Chair Rodrigues, Steering and Policy Chair Friedman and all my colleagues in the Senate for their sense of urgency. I am hopeful that the House will soon join us in passing the MDPA.”

Key highlights of the bill include:

Creates Extensive New Consumer Protections

Guarantees the Consumer’s Right to Know. Specifies that people have a right to know if their personal data is being collected, allows them to see what data was collected, and allows them to find out who their data has been shared with.

Gives Control to Consumers. Empowers people in Massachusetts with control over their personal data through new guaranteed rights to correct inaccurate data, delete personal information, and opt out of having their personal data sold to others.

Creates Strong Enforcement Powers. Gives the Attorney General broad regulatory authority to enforce the provisions of the Massachusetts Data Privacy Act.

Limits the Collection of Personal Data

Curtails Data Collection. Constrains companies’ unfettered collection of personal data by limiting them to only collecting what is reasonably necessary in order to provide their product or service. For certain sensitive types of data, including biometrics, precise GPS location, and healthcare data, businesses could only collect the information if it is strictly necessary.

Protects Sensitive Personal Information

Bans Sensitive Data Sales. Prohibits any kind of entity, including businesses and nonprofits, from selling off a person’s sensitive data. Protected categories of sensitive data include precise geolocation; health care information; biometric data, such as face and fingerprint scans; citizenship or immigration status; information revealing someone’s sex life, and any information about a person’s race, color, ethnicity, religion, sexual orientation, gender identity, or national origin; and information that pertains to a child.

Limits Data Transfers. Limits entities from transferring sensitive data unless they first obtain the consumer’s affirmative consent.

Gives People Rights Over Targeted Ads

Creates Opt-Out Rights for Targeted Advertising. Gives consumers the right to opt out of having their personal data collected or processed for the purpose of targeted advertising or for sale to third parties.

Enhances Specific Protections for Minors

Bans the Sale of Young People’s Data. Prohibits all entities from selling minors’ personal data.

Blocks Targeted Ads for Minors. Prohibits companies from collecting or processing a young person’s personal information for the purposes of targeting ads.

During the course of today’s debate, Senators voted to adopt meaningful amendments that further strengthened the bill, including:

Amendment 4: Extends the ban on sales of geolocation data to cover anyone who visits Massachusetts for any reason, including travel to the state to pursue personal health care.
Amendment 52: Ensures that businesses cannot sell sensitive data, regardless of whether they are otherwise exempt under the act.

“Massachusetts urgently needs strong privacy laws to prohibit companies from collecting or manipulating our personal information in ways that threaten our safety, discriminate against us, or otherwise threaten our most essential rights,” said Carol Rose, Executive Director at the ACLU of Massachusetts. “We are deeply grateful to Senate President Karen Spilka, Senator Cynthia Creem, Senator Cindy Friedman, and Senator Michael Moore for their leadership and vision on this critical issue. Protecting privacy is more urgent today than ever before, as the Trump administration unleashes attack after attack on the rule of law and our most cherished freedoms. We look forward to working with leaders in the House to pass these critical democratic protections in their strongest possible form.”

"Consumer Reports applauds the Massachusetts Senate for passing strong privacy legislation. For too long, tech companies have abused their power to exploit our personal data without meaningful accountability,” said Matt Schwartz, Policy Analyst at Consumer Reports. “This bill provides strong, default protections and allows consumers to take real control over their personal information. We thank Senator Moore for his leadership in sponsoring this key legislation, and we look forward to working with the House to continue to move this measure forward.”

“EPIC commends the Senate for passage the Massachusetts Data Privacy Act, which puts meaningful limits on the over-collection and abuse of our personal data. This bill combines the best consumer protections from other state laws to provide Massachusetts residents with some of the strongest privacy protections in the country while minimizing new compliance obligations for companies,” said Caitriona Fitzgerald, Deputy Director of Electronic Privacy Information Center (EPIC). “EPIC appreciates the leadership of Senate President Spilka, Senator Creem, and Senator Moore on this critical and timely issue.”

The Senate’s action on the Massachusetts Data Privacy Act comes in the wake of increasing concerns about what sensitive personal data is being collected by online services and who is accessing it. In an era of increasing federal surveillance on protesters, political opponents, and immigrants, data privacy protections are more important than ever. Recent revelations of contracts data brokers have signed with ICE – who within the last six months have also been subject to a FTC complaint and then hacked by a Russian cybercriminal, high-profile arrests in Worcester, Medford, and Boston, and senior White House advisors discussing the suspension of habeus corpus have pushed the issue to the forefront of policy conversations and urge rapid action.

The Massachusetts Data Privacy Act was advanced as a new draft out of the Senate Committee on Ways and Means on September 18 on a 16-0 vote, as a revised version of a bill previously advanced on May 12 by the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on a 5-0 vote. The joint committee solicited public testimony on the underlying legislation at a hearing in April.

Senators’ debate and votes on the legislation were livestreamed and archived video is available online.

Having been passed in the Senate, the Massachusetts Data Privacy Act now goes to the House for further consideration.

###