Massachusetts Senate backs data privacy bill giving consumers more control of their data

Local News

Lawmakers said the legislation would make Massachusetts one of the states with the strongest data privacy laws in the U.S.

By Annie Jonas

October 9, 2025 | 5:00 AM

2 minutes to read

The Massachusetts Senate unanimously passed a landmark data privacy bill that would give residents strong new protections over how their personal information is collected, used, and sold. Lawmakers said the measure would make Massachusetts among the states with “the strongest data privacy laws in the country.”

“When Massachusetts residents’ personal information is being offered up for sale to the tech billionaire with the highest bid, it is imperative that we act decisively to protect individuals and families,” Senate President Karen E. Spilka said in a news release.

She called the legislation “visionary” and lauded it as a nation-leading example of data protection laws. Here’s what to know.

What does the Massachusetts Data Privacy Act do?

The legislation, known as the Massachusetts Data Privacy Act (S.2619), creates new rights for consumers, including the ability to know what data companies collect about them and to opt out of having their data sold for targeted advertising.

Under the proposed law, companies can only collect data that is “reasonably necessary” to provide their product or service. For certain types of sensitive data, such as health care data and GPS location information, companies can only collect information if it is “strictly necessary.”

The bill goes even further to ban the sale of any sensitive data, with protected categories including: health care data and biometric identifiers like face scans and fingerprints, religious affiliation, immigration status, sexual orientation, and information from minors.

What Massachusetts’ new data privacy bill means for consumers and businesses

If a company wants to transfer sensitive data to another party, it must first obtain the consumer’s affirmative consent to do so. The bill defines “affirmative consent” as a “written statement by electronic means or any
other unambiguous affirmative action.”

Consumers also have the right to know if their personal data is being collected, to see what data was collected, to find out who their data has been shared with, and even to correct inaccurate data, delete personal information, and opt out of having their personal data sold to others.

The bill also gives the Massachusetts Attorney General’s Office strong enforcement powers, including the authority to bring civil actions against companies that violate the law. Any violation of the act would be treated as an unfair or deceptive trade practice under state law.

Massachusetts privacy bill moves to the House, could take effect in 2027

The Massachusetts Data Privacy Act draws inspiration from similar legislation in other states, such as the Maryland Online Data Privacy Act of 2024, and incorporates some of the nation’s most protective provisions.

If enacted, most provisions would take effect January 1, 2027, with additional sections following on June 1, 2027.

The bill, which passed the Senate on Sept. 25, now heads to the House of Representatives for consideration before it can be sent to Governor Maura Healey for approval.

Annie Jonas

Annie Jonas is a Community writer at Boston.com. She was previously a local editor at Patch and a freelancer at the Financial Times.