After years of proposed state privacy legislation, Massachusetts lawmakers are poised to once again consider enacting a comprehensive state consumer privacy law in the Commonwealth this legislative session. At a hearing of the Joint Committee on Advanced Information Technology, Internet and Cybersecurity on April 9, 2025, Massachusetts lawmakers heard from different stakeholders on several introduced bills, including comprehensive consumer data privacy legislation. At the heart of the discussion were three variations of a comprehensive consumer privacy bill:
H.78 (An Act establishing the Massachusetts consumer data privacy act);
H.80/
S.33 (An Act establishing the Comprehensive Massachusetts Consumer Data Privacy Act); and
H.104/
S.29/
S.45 (An Act establishing the Massachusetts Data Privacy Act)
1.
These laws differ from each other in several key respects, as summarized below:
A key point of contention during the Joint Committee hearing was the growing “patchwork” of state consumer privacy laws in the absence of comprehensive federal legislation. H.80/S.33 is modeled after legislation adopted in Connecticut, Rhode Island, New Hampshire, and 15 other states, while H.78 and H.104/S.29/S.45 feature several provisions which stand out from other state privacy legislation (most notably, a private right of action for injured consumers in addition to AG enforcement).
At the hearing, advocates for the approach taken by H.80/S.33, including representatives of industries likely to be subject to the regulations, argued that passing a law that closely resembles other state laws, particularly in New England, ensures consistency and clear expectations for consumers and for businesses operating across state lines. They also argued that the private right of action found in other bills would be onerous on small businesses and lead to frivolous litigation. Conversely, supporters of H.78, including several non-profit advocacy groups and nonpartisan research centers, argued that Massachusetts consumers may have differing ideas on privacy than other neighboring states, and that small businesses would be protected from liability by the bill’s built-in carveouts.
Other key bills discussed during the Joint Committee hearing include:
H.86/
S.197 (focused on stopping the sale of location data);
H.99 and
S.47 (concerning grocery store surveillance pricing); and
H.103 (protections for neural data and use of neurotechnology).
The Joint Committee will have until June 8, 2025, to decide whether to advance any of the data privacy bills discussed.
1 Another bill, S.301 (An Act advancing the economic development of the commonwealth through comprehensive data privacy), is progressing through the Senate and was referred to the Joint Committee on Economic Development and Emerging Technologies on February 27, 2025.
