Bill > S2619

This bill establishes the Massachusetts Data Privacy Act, which creates comprehensive privacy protections for consumers' personal data. The bill applies to businesses that collect data from at least 60,000 consumers or derive 20% of their revenue from selling personal data, and it provides consumers with several key rights, including the ability to confirm what personal data is being collected, access their data, correct inaccuracies, delete their data, obtain a copy of their data in a portable format, and opt out of targeted advertising, data sales, and certain automated profiling. Controllers (businesses collecting data) must limit data collection to what is necessary, obtain affirmative consent for processing sensitive data, and are prohibited from selling sensitive data or collecting data from minors for targeted advertising. The bill requires businesses to provide clear, accessible privacy notices, establish secure means for consumers to exercise their rights, and implement reasonable data security practices. Importantly, the attorney general has exclusive enforcement authority, with the ability to issue violations, seek damages up to $5,000 per violation, and require businesses to cure potential violations within 60 days before formal action. The law is set to take effect on January 1, 2027, and aims to provide Massachusetts residents with greater control and transparency over their personal data.

Budget and Finance

https://malegislature.gov/Bills/194/S2619