(BOSTON—9/25/2025) Today, Senator Feeney and his Senate colleagues unanimously passed the Massachusetts Data Privacy Act, landmark data privacy legislation that is poised to lead the nation in consumer protections, keeping pace with a digital landscape that increasingly puts Massachusetts residents’ sensitive personal information at risk. Senators passed the legislation on a bipartisan vote of 40–0. 

“Enhancing the protection of our personal consumer data in Massachusetts is a matter of personal safety, basic human rights and common sense. In the year 2025, our personal data is much more than just the sites we visit or the products we buy, but a sophisticated web of data that is currently exploited for highly sensitive, personal information such as precise GPS location, health care information, and even biometric data such as face or fingerprint scans. While this bill is no magic wand, it goes a long way towards safeguarding our personal data, especially for kids by prohibiting all entities from selling minors’ personal data in Massachusetts. I am grateful to my Senate colleagues for bringing this bill to a vote and for underscoring our commitment in the Senate towards addressing common-sense consumer protection measures," said Senator Paul Feeney (D-Foxborough). 

The legislation, S.2608, establishes clear rights for Massachusetts residents regarding their personal data, including the right to know what information is being collected and the ability to opt out of having their data used for targeted advertising or sold to other companies. 

Protected data includes health care information; face scans and fingerprints; precise geolocation; information about a person’s religion or ethnicity; information related to a person’s immigration status; and information pertaining to a child. Additional enhanced protections apply to minors, including a full ban on the sale of a young person’s personal data. 

The Massachusetts Data Privacy Act (MDPA) limits the collection of personal data, specifically protects personal information that is defined as sensitive in nature, and gives people rights over targeted advertising. 

Further details are below. 

• Guarantees the Consumer’s Right to Know. Specifies that people have a right to know if their personal data is being collected, allows them to see what data was collected, and allows them to find out who their data has been shared with. 

• Gives Control to Consumers. Gives Massachusetts residents control over their personal data through new guaranteed rights to correct inaccurate data, delete personal information, and opt out of having their personal data sold to others. 

• Creates Strong Enforcement Powers. Gives the Office of the Attorney General broad regulatory authority to enforce the provisions of the Massachusetts Data Privacy Act. 

• Curtails Data Collection. Constrains companies’ unfettered collection of personal data by limiting them to only collecting what is reasonably necessary in order to provide their product or service. For certain sensitive types of data, including biometrics, precise GPS location, and health care data, businesses could only collect the information if it is strictly necessary. 

• Bans Sensitive Data Sales. Prohibits any kind of entity, including businesses and nonprofits, from selling a person’s sensitive data. Protected categories of sensitive data include precise geolocation; health care information; biometric data, such as face and fingerprint scans; citizenship or immigration status; information revealing someone’s sex life, and any information about a person’s race, color, ethnicity, religion, sexual orientation, gender identity, or national origin; and information that pertains to a child. 

•  Limits Data Transfers. Limits entities from transferring sensitive data unless they first obtain the consumer’s affirmative consent. 

•  Creates Opt-Out Rights for Targeted Advertising. Gives consumers the right to opt out of having their personal data collected or processed for the purpose of targeted advertising or for sale to third parties. 

•  Bans the Sale of Children’s Data. Prohibits all entities from selling minors’ personal data. 

•  Blocks Targeted Ads for Minors. Prohibits companies from collecting or processing a child’s personal information for the purposes of targeting ads. 

During the course of today’s debate, Senators voted to adopt meaningful amendments that further strengthened the bill, including: 

• Amendment 4: Extends the ban on sales of geolocation data to cover anyone who visits Massachusetts for any reason, including travel to the state to pursue personal health care. 

• Amendment 52: Ensures that businesses cannot sell sensitive data, regardless of whether they are otherwise exempt under the act. 

The Massachusetts Data Privacy Act was advanced as a new draft out of the Senate Committee on Ways and Means on September 18 on a 16-0 vote, as a revised version of a bill previously advanced on May 12 by the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on a 5-0 vote. The joint committee solicited public testimony on the underlying legislation at a hearing in April. 

Senators’ debate and votes on the legislation were livestreamed and archived video is available online. 

The legislation was passed by the Senate and now moves to the House of Representatives for consideration. 

### 

Statements of Support 

Carol Rose, Executive Director, ACLU of Massachusetts 

“Massachusetts urgently needs strong privacy laws to prohibit companies from collecting or manipulating our personal information in ways that threaten our safety, discriminate against us, or otherwise threaten our most essential rights. We are deeply grateful to Senate President Karen Spilka, Senator Cynthia Creem, Senator Cindy Friedman, and Senator Michael Moore for their leadership and vision on this critical issue. Protecting privacy is more urgent today than ever before, as the Trump administration unleashes attack after attack on the rule of law and our most cherished freedoms. We look forward to working with leaders in the House to pass these critical democratic protections in their strongest possible form.” 

Dominique Lee, President & CEO, Planned Parenthood Advocacy Fund of Massachusetts 

“Escalating federal attacks make it even more important to create and strengthen data privacy protections and their enforcement for reproductive health care providers, staff, volunteers, and most of all, patients. People providing or seeking legally protected health care in Massachusetts should never have to fear that their movements will be tracked and their data sold to the highest bidder. This bill is a critical safeguard for reproductive freedom, and we thank the Senate for their swift action.” 

Claire Teylouni, Senior Director of Policy and Programs and interim co-Executive Director, Reproductive Equity Now 

“We are thrilled that the Senate has taken strong action to protect Bay Staters’ data privacy. We are especially encouraged by the inclusion of core provisions of the Location Shield Act prohibiting the sale of sensitive location data—which can reveal where we live, work, travel, seek health care, and more. Protecting the privacy of patients and providers is critical as we stand up to the Trump administration and work to ensure Massachusetts remains a safe beacon for abortion and reproductive health care. We thank Senate President Spilka, Senator Creem, Senator Friedman and all of our Senate champions for their leadership in recognizing that protecting our digital footprints is essential to securing reproductive equity. We look forward to working with our partners and champions in the House to continue to advance this bill.” 

Chrissy Lynch, President of the Massachusetts AFL-CIO 

“The Massachusetts AFL-CIO applauds the work of Senate leadership to move forward one of the strongest data privacy laws in the country. Working people expect strong protections at home and on the job and that expectation extends to their personal data. We are grateful that the Senate has rejected Big Tech's assertion that our most personal and sensitive information should be up for sale. We look forward to our continued partnership with the Senate to ensure working people in the Commonwealth have the strongest possible safeguards in all aspects of their lives.” 

Caitriona Fitzgerald, Deputy Director, Electronic Privacy Information Center (EPIC) 

“EPIC commends the Senate for passage of the Massachusetts Data Privacy Act. In a time where our privacy is more under attack than ever, this bill gives Massachusetts residents critical protections against harmful data practices such as the sale of our location data, health data, and more. EPIC appreciates the leadership of Senate President Spilka and Senator Creem, who has long been a privacy champion, on this important bill.”