Bill > H80

This bill establishes the Comprehensive Massachusetts Consumer Data Privacy Act, creating a robust framework for protecting consumers' personal data privacy. The legislation applies to businesses that process personal data of at least 100,000 consumers or 25,000 consumers with over 25% of gross revenue from data sales. The bill grants consumers several key rights, including the ability to confirm what personal data is being processed, access and correct their data, delete personal data, obtain a portable copy of their data, and opt out of targeted advertising, data sales, and certain automated profiling. The act imposes significant obligations on data controllers, requiring them to limit data collection, obtain consent for processing sensitive data, protect data security, and avoid processing data for purposes incompatible with original collection. Notably, the bill includes special protections for minors, prohibiting targeted advertising and data sales involving consumers under 16 without explicit consent. Controllers must provide clear privacy notices, establish secure means for consumers to exercise their rights, and conduct data protection assessments for high-risk processing activities. The legislation exclusively empowers the Massachusetts Attorney General to enforce these provisions, with a unique approach that initially provides a 60-day cure period for violations between July 2026 and December 2027. After January 2028, the Attorney General will have discretion in determining whether to allow violations to be cured based on factors like the number and nature of violations. Violations are considered unfair trade practices, and the bill explicitly prevents private lawsuits, reserving enforcement power solely with the Attorney General's office. The act is set to take effect on July 1, 2026, marking a significant step in comprehensive data privacy protection for Massachusetts residents.

Business and Industry

https://malegislature.gov/Bills/194/H80