Bill > S33

This bill establishes the Comprehensive Massachusetts Consumer Data Privacy Act, which creates comprehensive data privacy protections for Massachusetts residents. The bill applies to businesses that process personal data of at least 100,000 consumers or 25,000 consumers while deriving over 25% of their gross revenue from selling personal data. Key provisions include giving consumers the right to confirm what personal data is being processed about them, access that data, correct inaccuracies, delete personal data, obtain a copy of their data, and opt out of targeted advertising, data sales, and certain automated profiling. The bill imposes significant obligations on businesses (called "controllers") to limit data collection, obtain consent for processing sensitive data, protect children's data, and provide clear privacy notices. Controllers must obtain parental consent for processing data of children under 13 and are prohibited from certain practices that could harm minors, such as targeted advertising to children. The bill requires businesses to conduct data protection assessments for high-risk processing activities and implement reasonable data security practices. Enforcement is exclusively through the Massachusetts Attorney General, with a cure period from July 2026 to December 2027 that allows businesses to address violations before facing potential action. The law will take effect on July 1, 2026, and violations are considered unfair trade practices under existing Massachusetts law.

Business and Industry

https://malegislature.gov/Bills/194/S33