Bill > H4746

This bill establishes the Massachusetts Consumer Data Privacy Act, a comprehensive law designed to protect consumer personal data privacy. The legislation creates robust rights for consumers, including the ability to confirm what personal data is being collected about them, access that data, correct inaccuracies, delete their data, obtain a copy of their data, and opt out of targeted advertising, data sales, and certain types of profiling. The bill applies to businesses that collect data from at least 100,000 consumers or derive revenue from selling personal data, with specific provisions for handling sensitive data like biometric information, precise location data, and data related to minors. Controllers (businesses collecting data) must obtain affirmative consent for certain data processing activities, provide clear privacy notices, implement data security practices, and conduct data protection assessments for high-risk processing activities. The Attorney General is granted exclusive enforcement authority, with the ability to impose civil penalties up to $5,000 per violation and potentially suspend a business's operations for repeated, willful violations. The law also introduces requirements for data processors, mandates special protections for sensitive personal information, and ensures consumers can exercise their data privacy rights through multiple channels, including browser opt-out signals and authorized agent requests. The bill takes effect 180 days after enactment, with the first data protection assessments required within one year of the effective date.

Budget and Finance

Advanced Information Technology, the Internet and Cybersecurity (Joint)

https://malegislature.gov/Bills/194/H4746