Text of MA S 2619 (2026)

1 of 34 FILED ON: 9/25/2025 SENATE . . . . . . . . . . . . . . No. 2619 Senate, September 25, 2025 -- Text of the Senate Bill establishing the Massachusetts data privacy act (being the text of Senate document 2608, printed as amended) The Commonwealth of Massachusetts _______________ In the One Hundred and Ninety-Fourth General Court (2025-2026) _______________ An Act establishing the Massachusetts data privacy act. Be it enacted by the Senate and House of Representatives in General Court assembled, and by the authority of the same, as follows: 1 SECTION 1. The General Laws are hereby amended by inserting after chapter 93L the 2 following chapter:- 3 Chapter 93M. Massachusetts Data Privacy Act 4 Section 1. As used in this chapter, the following words shall have the following meanings 5 unless the context otherwise requires: 6 “Affiliate”, a legal entity that shares common branding with another legal entity or 7 controls, is controlled by or is under common control with another legal entity; provided, 8 however, that “control” and “controlled” shall mean the: (i) ownership of, or the power to vote, 9 more than 50 per cent of the outstanding shares of any class of voting security of a company; (ii) 10 control in any manner over the election of a majority of the directors or of individuals exercising 11 similar functions; or (iii) power to exercise controlling influence over the management of a 12 company. 2 of 34 13 “Affirmative consent”, a clear affirmative act, signifying a consumer’s freely given, 14 specific, informed and unambiguous authorization for an act or practice after having been 15 informed, in response to a specific request from a controller; provided, however, that 16 “affirmative consent” shall include a written statement, including by electronic means, or any 17 other unambiguous affirmative action; and provided further, that “affirmative consent” shall not 18 include: (i) acceptance of a general or broad terms of use or similar document that contains 19 descriptions of personal data processing along with other, unrelated information; (ii) hovering 20 over, muting, pausing or closing a given piece of content; or (iii) agreement obtained through the 21 use of dark patterns or deceptive design. 22 “Authenticate”, to use reasonable means to determine that a request to exercise any of the 23 rights afforded under this chapter is being made by, or on behalf of, the consumer who is entitled 24 to exercise such rights with respect to the personal data at issue. 25 “Biometric data”, data generated by automatic measurements of a consumer’s biological 26 characteristics, such as a fingerprint, a voiceprint or vocal biomarker, eye retinas, irises, gait or 27 personally identifying physical movement or patterns, or other unique biological patterns or 28 characteristics that allow or confirm the unique identification of the consumer; provided, 29 however, that “biometric data” shall not include: (i) a digital or physical photograph; (ii) an 30 audio or video recording; or (iii) any data generated from a digital or physical photograph or an 31 audio or video recording, unless such data is generated to identify a specific individual. 32 “Business associate”, as defined in the Health Insurance Portability and Accountability 33 Act of 1996, Pub. L. 104–191. 34 “Child”, as defined in the Children’s Online Privacy Protection Act, 15 USC 6501. 3 of 34 35 “Collect”, buying, renting, gathering, obtaining, receiving, accessing or otherwise 36 acquiring personal data by any means. 37 “Consumer”, an individual who is a resident of the commonwealth; provided, however, 38 that “consumer” shall not include an individual acting as an employee, an owner, a director, an 39 officer or a contractor of a company, a partnership, a sole proprietorship, a nonprofit 40 organization or a governmental unit whose communications or transactions with a controller 41 occur only within the context of the individual’s role with such company, partnership, sole 42 proprietorship, nonprofit organization or governmental unit. 43 “Controller”, a person who, alone or jointly with others, determines the purpose and 44 means of collecting or processing personal data. 45 “Covered entity”, as defined in the Health Insurance Portability and Accountability Act 46 of 1996, Pub. L. 104–191. 47 “Dark pattern or deceptive design”, a user interface designed or manipulated with the 48 substantial effect of subverting or impairing user autonomy, decision-making or choice, which 49 shall include, but not be limited to, any practice the Federal Trade Commission refers to as a 50 “dark pattern”. 51 “Decisions that produce legal or similarly significant effects concerning the consumer”, 52 decisions that result in access to, or the provision or denial by the controller of, financial or 53 lending services, housing, insurance, education enrollment or opportunity, criminal justice, 54 employment opportunities, health care services or access to essential goods or services. 4 of 34 55 “De-identified data”, data that does not identify and cannot reasonably be used to infer 56 information about, or otherwise be linked to, an identified or identifiable individual, or a device 57 linked to such individual, if the controller that possesses such data: (i) takes reasonable physical, 58 administrative and technical measures to ensure that such data cannot be associated with an 59 individual or be used to re-identify any individual or device that identifies or is linked or 60 reasonably linkable to an individual; and (ii) contractually obligates any recipients of such data 61 to meet the obligations of clause (i). 62 “Gender-affirming health care services”, as defined in section 11I1/2 of chapter 12. 63 “Gender-affirming health data”, any personal data concerning any effort made by a 64 consumer to seek, or a consumer’s receipt of, gender-affirming health care services. 65 “Genetic information”, any data, regardless of its format, that concerns a consumer’s 66 genetic characteristics, including, but not limited to: (i) raw sequence data that results from the 67 sequencing of the complete, or a portion of the, extracted deoxyribonucleic acid of a consumer; 68 or (ii) genotypic and phenotypic information that results from analyzing raw sequence data 69 described in clause (i). 70 “Identified or identifiable individual”, a consumer who can be readily identified, directly 71 or indirectly. 72 “Legally-protected health care activity”, as defined in section 11I1/2 of chapter 12. 73 “Legally-protected health care data”, any personal data concerning any effort made by a 74 consumer to seek, or a consumer’s receipt of, legally-protected health care activity. 75 “Minor”, a consumer who has not attained 18 years of age. 5 of 34 76 “Neural data”, any information that is generated by measuring the activity of a 77 consumer’s central or peripheral nervous system. 78 “Person”, an individual, association, company, limited liability company, corporation, 79 partnership, sole proprietorship, trust or other legal entity. 80 “Personal data”, any information that is linked or reasonably linkable to an identified or 81 identifiable consumer; provided, however, that “personal data” shall not include de-identified 82 data or publicly available information. 83 “Precise geolocation data”, information derived from technology or a device, including, 84 but not limited to, latitude and longitude coordinates from global positioning system mechanisms 85 or other similar positional data, that reveals the past or present physical location of a individual 86 or device that identifies or is linked or reasonably linkable to 1 or more individuals with 87 precision and accuracy within a radius of not more than 1,750 feet; provided, however, that 88 “precise geolocation data” shall not include the content of communications, a photograph or 89 video, metadata associated with a photograph or video that cannot be linked to a individual. 90 “Process”, any operation or set of operations performed, whether by manual or automated 91 means, on personal data or on sets of personal data, such as the use, storage, disclosure, analysis, 92 deletion or modification of personal data. 93 “Processor”, a person who collects, processes or transfers personal data on behalf of, and 94 at the direction of, a controller or another processor or a federal, state, tribal or local government 95 entity. 6 of 34 96 “Profiling”, any form of processing performed on personal data to evaluate, analyze or 97 predict personal aspects including a consumer’s economic situation, health, personal preferences, 98 interests, reliability, behavior, location or movements. 99 “Protected health information”, as defined in 45 CFR 160.103. 100 “Publicly available information”, information that: (i) is lawfully made available through 101 federal, state or municipal government records or widely distributed media; or (ii) a controller 102 has reasonable basis to believe a consumer has lawfully made available to the general public; 103 provided, however, that “publicly available information” shall not include biometric data. 104 “Reproductive or sexual health care”, any supplies, care and services of a medical, 105 behavioral health, mental health, surgical, psychiatric, therapeutic, diagnostic, preventative, 106 rehabilitative or supportive nature relating to pregnancy, contraception, assisted reproduction, 107 miscarriage management, the termination of a pregnancy, a consumer’s reproductive system or 108 sexual well-being, including, but not limited to, any such supplies, care and services rendered or 109 provided concerning: (i) a consumer’s health condition, status, disease, diagnosis, diagnostic test 110 or treatment; (ii) a social, psychological, behavioral or medical intervention; (iii) a surgery or 111 procedure, including, but not limited to, an abortion; (iv) use or purchase of a medication, 112 including, but not limited to, a medication used or purchased for the purposes of an abortion; (v) 113 a bodily function, vital sign or symptom; (vi) a measurement of a bodily function, vital sign or 114 symptom; or (vii) an abortion, including, but not limited to, medical or nonmedical services, 115 products, diagnostics, counseling or follow-up services for an abortion. 116 “Reproductive or sexual health data”, personal data concerning any effort made by a 117 consumer to seek, or a consumer's receipt of, reproductive or sexual health care. 7 of 34 118 “Sale of personal data”, the transfer of personal data in exchange for monetary or other 119 valuable consideration by the controller to a third party; provided, however, that “sale of 120 personal data” shall not include: (i) the disclosure of personal data to a processor that processes 121 the personal data on behalf of the controller if limited to the purposes of the processing; (ii) the 122 disclosure of personal data to a third party for purposes of providing a product or service 123 affirmatively requested by the consumer; (iii) the disclosure or transfer of personal data to an 124 affiliate of the controller; (iv) the disclosure of personal data with the consumer’s affirmative 125 consent, where the consumer affirmatively directs the controller to disclose the personal data or 126 intentionally uses the controller to interact with a third party; (v) the disclosure or transfer of 127 personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy or other 128 transaction or a proposed merger, acquisition, bankruptcy or other transaction, in which the third 129 party assumes control of all or part of the controller’s assets; or (vi) the disclosure of personal 130 data that the consumer: (A) intentionally made available to the general public via a channel of 131 mass media; and (B) did not restrict to a specific audience. 132 “Sensitive data”, personal data that includes: (i) a government-issued identifier, 133 including, but not limited to, a social security number, passport number, state identification card 134 or driver’s license number; provided, however, that “sensitive data” shall not include a 135 government-issued identifier required by law to be displayed in public; (ii) any personal 136 information that describes or reveals a consumer’s mental or physical health condition, 137 diagnosis, disability or treatment, including, but not limited to, gender-affirming health data, 138 reproductive or sexual health data, legally-protected health care data and neural data; (iii) 139 biometric data or genetic information or information derived therefrom; (iv) precise geolocation 140 information; (v) account or device log-in credentials or security or access codes for an account or 8 of 34 141 device; (vi) personal data of a consumer who a controller or processor knows or should have 142 known is a child; (vii) a consumer’s race, color, ethnicity, religion, national origin, citizenship or 143 immigration status; (viii) information revealing a consumer’s sex life, sexual orientation or status 144 as transgender or non-binary; or (ix) information that reveals the status of a consumer as a victim 145 of a crime. 146 “Targeted advertising”, displaying advertisements to a consumer where the advertisement 147 is selected based on personal data obtained or inferred from that consumer’s activities over time 148 and across nonaffiliated internet web sites or online applications to predict such consumer’s 149 preferences or interests; provided, however, that “targeted advertising” shall not include: (i) 150 advertisements based on activities within a controller’s own web sites or online applications; (ii) 151 advertisements based on the context of a consumer’s current search query, visit to a web site or 152 online application; (iii) advertisements directed to a consumer in response to the consumer’s 153 request for information or feedback; or (iv) processing personal data solely to measure or report 154 advertising frequency, performance or reach. 155 “Third party”, a person other than the consumer to whom the data pertains or a controller 156 or processor, or affiliate of the controller or processor of the relevant personal data. 157 “Transfer”, disclose, release, disseminate, make available, license, rent or share personal 158 data to a third party orally, in writing, electronically or by any other means. 159 Section 2. This chapter shall apply to persons that during the preceding calendar year: (i) 160 collected or processed the personal data of not less than 60,000 consumers, excluding personal 161 data controlled or processed solely for the purpose of completing a payment transaction; (ii) 162 collected or processed the personal data of not less than 20,000 consumers and derived not less 9 of 34 163 than 20 per cent of its gross revenue from the sale of personal data; or (iii) collected, processed 164 or transferred reproductive or sexual health data of consumers. This chapter shall also apply to an 165 affiliate of a person described under this section if such affiliate transferred sensitive data to the 166 person or the person’s other affiliates in the preceding calendar year. 167 Section 3. (a) Notwithstanding section 2, this chapter shall not apply to: (i) a federal, 168 state, tribal, territorial or local government entity, including, but not limited to, a body, authority, 169 board, bureau, commission, district or agency of the commonwealth or of any political 170 subdivision of the commonwealth; (ii) a nonprofit organization established to detect and prevent 171 fraudulent acts in connection with insurance; (iii) a national securities association registered 172 pursuant to section 15A of the Securities Exchange Act of 1934 and the rules and implementing 173 regulations promulgated thereunder; (iv) a registered futures association designated pursuant to 174 section 17 of the Commodity Exchange Act and the rules and implementing regulations 175 promulgated thereunder; (v) a bank, credit union or any affiliate or subsidiary thereof that: (A) is 176 only and directly engaged in financial activities as described in 12 USC 1843(k); (B) is regulated 177 and examined by the division of banks or an applicable federal bank regulatory agency; and (C) 178 has established a program to comply with all applicable requirements established by the 179 commissioner of banks or the applicable federal bank regulatory agency concerning personal 180 data; (vi) an agent, broker-dealer, investment adviser or investment adviser representative, as 181 defined in section 401 of chapter 110A, who is regulated by the secretary of the commonwealth 182 or the United States Securities and Exchange Commission; and (vii) a covered entity or a 183 covered entity’s business associate that collected or processed the personal data of not more than 184 60,000 consumers. Notwithstanding this subsection, a controller or processor who would 185 otherwise be subject to this chapter under section 2 shall not sell sensitive data. 10 of 34 186 (b) The following information and data shall be exempt from the provisions of this 187 chapter if said information and data are processed, collected or transferred, as applicable, in 188 compliance with relevant federal statutes or regulations, as applicable: 189 (i) protected health information that a covered entity or business associate collects or 190 processes in accordance with, or documents that a covered entity or business associate creates for 191 the purpose of complying with, the Health Insurance Portability and Accountability Act of 1996, 192 Pub. L. 104–191, and the rules and implementing regulations promulgated thereunder; 193 (ii) patient-identifying information for purposes of 42 USC 290dd-2; 194 (iii) identifiable private information for purposes of the federal policy for the protection 195 of human subjects under 45 CFR 46; 196 (iv) identifiable private information that is otherwise information collected as part of 197 human subjects research pursuant to the good clinical practice guidelines issued by the 198 International Council for Harmonisation of Technical Requirements for Pharmaceuticals for 199 Human Use; 200 (v) identifiable private information collected or processed for the protection of human 201 subjects under 21 CFR Parts 50 and 56 or personal data used or shared in research, as defined in 202 45 CFR 164.501, that is conducted in accordance with this clause and clauses (iii) and (iv), or 203 other research conducted in accordance with applicable law; 204 (vi) information and documents created for purposes of the Health Care Quality 205 Improvement Act of 1986, 42 USC 11101 et seq.; 11 of 34 206 (vii) patient safety work product for purposes of the Patient Safety and Quality 207 Improvement Act of 2005, 42 USC 299b-21 et seq.; 208 (viii) information derived from any of the health care-related information listed in this 209 subsection that is de-identified in accordance with the requirements for de-identification pursuant 210 to Health Insurance Portability and Accountability Act of 1996, Pub. L. 104–191; 211 (ix) personal data regulated by Title V of the Gramm-Leach-Bliley Act, 15 USC 6801 et 212 seq.; 213 (x) personal data regulated by the Driver’s Privacy Protection Act of 1994, 18 USC 2721 214 et seq.; 215 (xi) personal data regulated by the Family Educational Rights and Privacy Act, 20 USC 216 1232g et seq.; 217 (xii) any personal information bearing on a consumer’s credit worthiness, credit standing, 218 credit capacity, character, general reputation, personal characteristics or mode of living collected, 219 processed or transferred by a consumer reporting agency, furnisher or user that provides 220 information for use in a consumer report, and by a user of a consumer report, but only to the 221 extent that such activity is regulated by and authorized under the Fair Credit Reporting Act, 15 222 USC 1681 et seq.; and 223 (xiii) data collected, processed or transferred: (A) in the course of a consumer applying 224 to, employed by or acting as an agent or independent contractor of a controller, processor or third 225 party, to the extent that the data are collected and used within the context of that role; (B) as the 226 emergency contact information of a consumer under this chapter used for emergency contact 12 of 34 227 purposes; or (C) that are necessary to retain to administer benefits for another individual relating 228 to the consumer who is the subject of the information under clause (i) and used for the purposes 229 of administering such benefits. 230 (c) Controllers and processors that comply with the verifiable parental consent 231 requirements of the Children’s Online Privacy Protection Act, 15 USC 6501 shall be deemed 232 compliant with any obligation to obtain parental consent pursuant to this chapter. 233 Section 4. (a) A consumer shall have the right to: 234 (i) confirm whether a controller is collecting or processing the consumer’s personal data, 235 including, but not limited to, any inferences about the consumer derived from such personal data, 236 and access such personal data; 237 (ii) obtain from a controller a list of third parties to which the controller has transferred 238 the consumer’s personal data; provided, however, that the attorney general may issue regulations 239 providing for reasonable exemptions or alternatives to this requirement if necessary to protect a 240 controller’s trade secrets; 241 (iii) correct inaccuracies in the consumer’s personal data, taking into account the nature 242 of the personal data and the purposes of the processing of the consumer’s personal data; 243 (iv) delete personal data provided by, or obtained about, the consumer, including personal 244 data the consumer provided to the controller and personal data the controller obtained from 245 another source; 246 (v) obtain a copy of the consumer’s personal data collected or processed by the controller 247 in a portable and, to the extent technically feasible, readily usable format that allows the 13 of 34 248 consumer to transmit the data to another controller without hindrance, where the processing is 249 carried out by automated means; and 250 (vi) opt out of the collection and processing of the consumer’s personal data for purposes 251 of: (A) targeted advertising; (B) the sale of personal data; or (C) profiling in furtherance of solely 252 automated decisions that produce legal or similarly significant effects concerning the consumer. 253 (b) (1) If a consumer’s personal data is profiled in furtherance of a decision that produces 254 legal or similarly significant effects concerning a consumer, the consumer shall have the right to: 255 (i) question the result of such profiling; (ii) be informed of the reason why the profiling resulted 256 in the decision; (iii) be informed of what actions the consumer might have taken to secure a 257 different decision and the actions that the consumer might take to secure a different decision in 258 the future, where feasible; and (iv) review the consumer’s personal data used in such profiling. 259 (2) If the decision is determined to have been based upon inaccurate personal data, the 260 consumer shall have the right to have the data corrected and the profiling decision reevaluated 261 based upon the corrected data. 262 (c) Except as otherwise provided in this chapter, a controller shall comply with a request 263 by a consumer to exercise rights pursuant to this subsection. 264 (1) A controller shall respond to the consumer without undue delay and not more than 45 265 days after receipt of the request; provided, however, that the controller may extend the response 266 period once by 20 additional days when reasonably necessary, considering the complexity and 267 number of the consumer’s requests; provided further, that the controller informs the consumer of 268 any such extension within the initial 45 day response period and of the reason for the extension. 14 of 34 269 (2) If a controller declines to take action regarding the consumer’s request, the controller 270 shall inform the consumer without undue delay and not more than 45 days after receipt of the 271 request of the justification for declining to take action and instructions for how to appeal the 272 decision. 273 (3) Information provided in response to a consumer request shall be provided by a 274 controller, free of charge, not less than 2 times per consumer per right during any 12-month 275 period; provided; however, that if requests from a consumer are manifestly unfounded, excessive 276 or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative 277 costs of complying with the request or decline to act on the request; provided further, that the 278 controller bears the burden of demonstrating the manifestly unfounded, excessive or repetitive 279 nature of the request. 280 (4) If a controller is unable to authenticate a request to exercise any of the rights afforded 281 under clauses (i) to (v), inclusive, of subsection (a) using commercially reasonable efforts, the 282 controller shall not be required to comply with a request to initiate an action pursuant to this 283 section and shall provide notice to the consumer that the controller is unable to authenticate the 284 request to exercise such right until the consumer provides additional information reasonably 285 necessary to authenticate the consumer and the consumer's request to exercise such right; 286 provided, however, that any such information shall not be used for any purposes other than the 287 authentication of such consumer. A controller shall not require authentication to exercise an opt- 288 out request, but a controller may deny an opt-out request if the controller has a good faith, 289 reasonable and documented belief that such request is fraudulent; provided, however, that if a 290 controller denies an opt-out request because the controller believes such request is fraudulent, the 291 controller shall send a notice to the person who made the request disclosing that the controller 15 of 34 292 believes the request is fraudulent, why the controller believes the request is fraudulent and that 293 the controller will not comply with such request; provided further, that if the request was placed 294 through an agent, both the agent and the person who appointed the agent shall receive that notice. 295 (5) A controller that has obtained personal data about a consumer from a source other 296 than the consumer shall be deemed in compliance with a consumer’s request to delete such data 297 pursuant to clause (iv) of subsection (a) by deleting the consumer’s personal data retained by the 298 controller, retaining a record of the deletion request and the minimum data necessary for the 299 purpose of ensuring the consumer’s personal data remains deleted from the controller's records 300 and not using such retained data for any other purpose pursuant to this chapter. 301 (d) A controller shall establish a process for a consumer to appeal the controller’s refusal 302 to take action on a request within a reasonable period of time after the consumer’s receipt of the 303 decision. The appeal process shall be conspicuously available and similar to the process for 304 submitting requests to initiate action pursuant to this section. Not more than 60 days after receipt 305 of an appeal, the controller shall inform the consumer in writing of any action taken or not taken 306 in response to the appeal, including a written explanation of the reasons for the decision. If the 307 appeal is denied, the controller shall also provide the consumer with an online mechanism, if 308 available, or other method through which the consumer may contact the attorney general to 309 submit a complaint. 310 (e) A controller shall not condition, effectively condition, attempt to condition or attempt 311 to effectively condition the exercise of a right described in this section through the use of: (i) any 312 false, fictitious, fraudulent or materially misleading statement or representation; or (ii) dark 313 patterns or deceptive design. 16 of 34 314 (f) A controller shall not collect, process or transfer personal data in a manner that 315 discriminates against, or threaten to discriminate against, an individual or class of individuals, or 316 otherwise makes unavailable the equal enjoyment of goods or services, on the basis of an 317 individual's or class of individuals’ actual or perceived race, color, ethnicity, sex, sexual 318 orientation, gender identity, gender expression, disability, religion, genetic information, 319 pregnancy or condition related to pregnancy, status as a veteran, ancestry, national origin, 320 citizenship, immigration status or any other basis protected by chapter 151B. 321 This subsection shall not apply to: (i) the collection, processing or transfer of personal 322 data for the sole purpose of: (A) a controller self-testing to prevent or mitigate unlawful 323 discrimination or otherwise to ensure compliance with federal or state law; or (B) diversifying an 324 applicant, participant or customer pool; or (ii) a private establishment, as described in 42 USC 325 2000a(e). 326 (g) (1) A consumer shall be able to exercise rights under this section by a secure and 327 reliable means established by the controller and described to the consumer in the controller’s 328 privacy notice. 329 (2) A consumer may designate an authorized agent to exercise the rights specified in 330 clause (vi) of subsection (a). A parent or legal guardian of a child may exercise a consumer right 331 under subsections (a) and (b) on the child’s behalf. For a consumer subject to a guardianship, 332 conservatorship or other protective arrangement, the guardian or conservator of the consumer 333 may exercise a consumer right under said subsections (a) and (b) on the consumer’s behalf. 17 of 34 334 (3) A controller shall comply with a request received from an authorized agent if the 335 controller is able to verify, with commercially reasonable effort, the identity of the consumer and 336 the authorized agent’s authority to act on such consumer’s behalf. 337 (4) A consumer may designate an authorized agent by technological means, including, 338 but not limited to, an internet link or a browser setting, browser extension or global device 339 setting, that indicates the consumer’s intent to opt out of processing for at least 1 of the purposes 340 specified in clause (vi) of subsection (a). 341 Section 5. (a) A controller shall: 342 (i) limit the collection of personal data to what is reasonably necessary to provide or 343 maintain a specific product or service requested by the consumer to whom the data pertains; 344 (ii) unless the controller obtains the consumer’s affirmative consent, not process personal 345 data for a purpose that is neither reasonably necessary to, nor compatible with, the disclosed 346 purposes for which the personal data is processed, as disclosed to the consumer; 347 (iii) not collect, process or transfer sensitive data concerning a consumer except when 348 such collection, processing or transfer is strictly necessary to provide or maintain a specific 349 product or service requested by the consumer to whom the sensitive data pertains; 350 (iv) not sell sensitive data; 351 (v) not transfer sensitive data concerning a consumer without obtaining the consumer’s 352 affirmative consent or, in the case of the collection or processing of personal data concerning a 353 known child, without collecting or processing such data in accordance with Children’s Online 354 Privacy Protection Act, 15 USC 6501 et seq.; 18 of 34 355 (vi) not collect or process the personal data of a consumer for purposes of targeted 356 advertising or sell the consumer’s personal data under circumstances where a controller knows or 357 should have known that the consumer is a minor; 358 (vii) establish, implement and maintain reasonable administrative, technical and physical 359 data security practices to protect the confidentiality, integrity and accessibility of personal data 360 appropriate to the volume and nature of the personal data at issue; 361 (viii) provide an effective mechanism for a consumer that does not use dark patterns or 362 deceptive design to revoke the consumer’s affirmative consent that is at least as easy as the 363 mechanism by which the consumer provided affirmative consent and, upon revocation of such 364 affirmative consent, cease to process the data as soon as practicable, but not later than 30 days 365 after the receipt of such request, and shall immediately prevent the transfer of any sensitive data; 366 (ix) not discriminate or retaliate against, or threaten to discriminate or retaliate against, a 367 consumer for exercising any of the consumer rights contained in this chapter, including denying 368 goods or services, charging different prices or rates for goods or services or providing a different 369 level of quality of goods or services to the consumer; and 370 (x) not sell the precise geolocation data of any individual collected within the 371 commonwealth, regardless of the residency of the individual. 372 (b) Nothing in clause (ix) of subsection (a) shall be construed to: (i) require a controller to 373 provide a product or service that requires the personal data of a consumer that the controller does 374 not collect or maintain; or (ii) prohibit a controller from offering a different price, rate, level, 375 quality or selection of goods or services to a consumer, including offering goods or services for 376 no fee, if the offering is in connection with a consumer's voluntary participation in a bona fide 19 of 34 377 loyalty, rewards, premium features, discounts or club card program; provided, however, that the 378 controller shall not transfer personal data to a third party as part of such program unless the 379 transfer of personal data to the third party is clearly disclosed in the terms of the program. 380 (c) (1) A controller shall provide consumers with a reasonably accessible, 381 understandable, clear, meaningful and not misleading privacy notice that includes: 382 (i) the categories of personal data collected and processed by the controller, including a 383 separate list of categories of sensitive data collected and processed by the controller, described in 384 a level of detail that provides consumers with a meaningful understanding of the type of personal 385 data collected or processed; 386 (ii) the purpose for collecting and processing each category of personal data the controller 387 collects or processes described in a way that gives consumers a meaningful understanding of 388 how each category of their personal data will be used; 389 (iii) how consumers may exercise their consumer rights, including how a consumer may 390 appeal a controller’s decision with regard to the consumer’s request; 391 (iv) the categories of personal data that the controller transfers to third parties, if any, and 392 the purposes for those transfers; 393 (v) the categories of third parties, if any, to which the controller transfers personal data; 394 (vi) an active electronic mail address or other online mechanism that the consumer may 395 use to contact the controller for privacy and data security inquiries; 20 of 34 396 (vii) information identifying the controller, including any business name under which the 397 controller registered with the secretary of the commonwealth and any assumed business name 398 that the controller uses in the commonwealth; 399 (viii) a clear and conspicuous description of any processing of personal data in which the 400 controller engages for the purposes of targeted advertising, sale of personal data to third parties 401 or profiling the consumer in furtherance of decisions that produce legal or similarly significant 402 effects concerning the consumer and a procedure by which the consumer may opt out of this type 403 of processing; 404 (ix) a general description of the controller’s data security practices; and 405 (x) the effective date of the privacy notice. 406 (2)(A) The privacy notice shall be: (i) provided directly to consumers in a manner that is 407 reasonably accessible to and usable by individuals with disabilities; and (ii) made available 408 online to the general public. 409 (B) If a controller makes a material change to its privacy notice, the controller shall notify 410 each consumer affected by the material change prior to implementing the material change with 411 respect to prospectively collected personal data and provide a reasonable opportunity for each 412 consumer to withdraw affirmative consent obtained pursuant to subsection (a). A controller shall 413 provide a reasonable opportunity for each consumer to give affirmative consent to further 414 materially different processing or transfer of previously collected personal data under the 415 changed notice. The controller shall take all reasonable electronic measures to provide direct 416 notification regarding material changes to the privacy notice to each affected consumer taking 417 into account available technology and the nature of the relationship. 21 of 34 418 (d) If a controller sells personal data to a third party or processes personal data for 419 targeted advertising, the controller shall clearly and conspicuously disclose such sales or 420 processing, as well as the manner in which a consumer may exercise the right to opt out of such 421 sales or processing. 422 (e) A controller shall establish, and shall describe in a privacy notice, not less than 2 423 secure and reliable means for consumers to submit a request to exercise their consumer rights 424 pursuant to this chapter. Such means shall take into account the ways in which consumers 425 normally interact with the controller, the need for secure and reliable communication of such 426 requests and the ability of the controller to verify the identity of the consumer making the 427 request. A controller shall not require a consumer to create a new account in order to exercise 428 consumer rights but may require a consumer to use an existing account. The requirements of this 429 subsection are met if the controller: 430 (i) provides a clear and conspicuous link on the controller’s internet website to an internet 431 webpage that enables a consumer, or an agent of the consumer, to opt out of the targeted 432 advertising, the sale of the consumer’s personal data and profiling in furtherance of solely 433 automated decisions that produce legal or similarly significant effects concerning the consumer; 434 and 435 (ii) allows a consumer to opt out of any collection or processing of the consumer’s 436 personal data for the purposes of targeted advertising or any sale of the consumer’s personal data 437 through an opt-out preference signal sent, with such consumer’s affirmative consent, by a 438 platform, technology or mechanism to the controller indicating such consumer's intent to opt out 439 of any such processing or sale; provided, however, that such platform, technology or mechanism 22 of 34 440 shall: (A) be consumer-friendly and easy to use by the average consumer; (B) not use dark 441 patterns or deceptive design; (C) require the consumer to provide affirmative consent in order to 442 opt out of any processing of the consumer’s personal data; and (D) enable the controller to 443 reasonably determine whether the consumer is a resident of the commonwealth and whether the 444 consumer has made a legitimate request to opt out of any sale of the consumer’s personal data or 445 any collection or processing of the consumer’s data for targeted advertising; provided further, 446 that for purposes of this subsection, the use of an internet protocol address to estimate the 447 consumer’s location shall be considered sufficient to reasonably determine residency. 448 If a consumer’s decision to opt out of any processing of the consumer’s personal data for 449 the purposes of targeted advertising or any sale of personal data through an opt-out preference 450 signal sent in accordance with this subsection conflicts with the consumer’s existing controller- 451 specific privacy setting or voluntary participation in a controller’s financial incentive program or 452 bona fide loyalty, rewards, premium features, discounts or club card program, the controller shall 453 comply with such consumer’s opt-out preference signal but may notify the consumer of such 454 conflict and provide to the consumer the choice to confirm such controller-specific privacy 455 setting or participation in such program. 456 (f) If a controller responds to a consumer opt‐out request received pursuant to subsection 457 (e) by informing the consumer of a change in the price, rate, level, quality or selection of goods 458 or services, the controller shall present the terms of any financial incentive offered pursuant to 459 subsection (b) for the processing, sale or transfer of the consumer's personal data. 23 of 34 460 Section 6. (a) A processor shall adhere to the instructions of a controller and shall assist 461 the controller in meeting the controller’s obligations under this chapter. Such assistance shall 462 include: 463 (i) utilizing appropriate technical and organizational measures, as far as is reasonably 464 practicable, to fulfill the controller’s obligation to respond to consumer rights requests, taking 465 into account the nature of processing and the information available to the processor; 466 (ii) assisting the controller in meeting the controller’s obligations in relation to the 467 security of processing personal data and in relation to the notification of a breach of security of 468 the system of the processor, taking into account the nature of processing and the information 469 available to the processor; and 470 (iii) providing necessary information to enable the controller to conduct and document 471 data protection assessments. 472 (b) A contract between a controller and a processor shall govern the processor’s data 473 processing procedures with respect to processing performed on behalf of the controller. The 474 contract shall be in writing, binding and shall include, but not be limited to, clearly set forth 475 instructions for processing data and protecting the confidentiality of the data, the nature and 476 purpose of processing, the type of data subject to processing, the duration of processing and the 477 rights and obligations of both parties including a method by which the processor shall notify the 478 controller of material changes to its privacy practices. The processor shall adhere to the 479 instructions of the controller and only process and transfer the data it receives from the controller 480 to the extent necessary to provide a service requested by the controller, as set out in the contract. 481 The contract shall also require that the processor: 24 of 34 482 (i) ensure that each person processing personal data is subject to a duty of confidentiality 483 with respect to the data; 484 (ii) at the controller’s direction, delete or return all personal data to the controller as 485 requested, unless retention of the personal data is required by law; 486 (iii) upon the reasonable request of the controller, make available to the controller all 487 information in its possession necessary to demonstrate the processor’s compliance with the 488 obligations in this chapter; 489 (iv) after providing the controller an opportunity to object, engage any subcontractor 490 pursuant to a written contract that requires the subcontractor to meet the contractual, statutory 491 and regulatory obligations of the processor with respect to personal data; 492 (v) be prohibited from combining personal data that the processor receives from or on 493 behalf of a controller with personal data that the processor receives from or on behalf of another 494 person or collects from the interaction of the processor with an individual; and 495 (vi) allow, and cooperate with, reasonable assessments by the controller or the 496 controller’s designated assessor; provided, however, that the processor may arrange for a 497 qualified and independent assessor to conduct an assessment of the processor’s policies and 498 technical and organizational measures in support of the obligations under this chapter; provided 499 further, that commonly accepted industry assessment procedures for data protection are utilized 500 for any such assessments; and provided further, that the processor shall provide a report of any 501 such assessment to the controller upon request. 25 of 34 502 (c) A processor shall establish, implement and maintain reasonable administrative, 503 technical and physical data security practices to protect the confidentiality, integrity and 504 accessibility of personal data that are consistent with chapter 93H and appropriate to the volume 505 and nature of the personal data at issue. 506 (d) Nothing in the contract required pursuant to subsection (b) shall relieve a controller or 507 processor from the liabilities imposed on the controller or processor by virtue of such controller’s 508 or processor’s role in the processing relationship. 509 (e) Determining whether a person is acting as a controller or processor with respect to a 510 specific processing of data is a fact-based determination that depends upon the context in which 511 personal data is to be processed. A person who is not limited in such person’s processing of 512 personal data pursuant to a controller’s instructions, or who fails to adhere to such instructions, is 513 a controller and not a processor with respect to a specific processing of data. A processor that 514 continues to adhere to a controller’s instructions with respect to a specific processing of personal 515 data remains a processor. If a processor begins, alone or jointly with others, determining the 516 purposes and means of the processing of personal data, the processor is a controller with respect 517 to such processing and may be subject to an enforcement action under this chapter. 518 (f) A processor shall not process or transfer personal data on behalf of a controller if the 519 processor knows or has reason to believe that the controller has willfully disregarded or violated 520 this chapter with respect to such personal data. 521 (g) A controller that acquires personal data as part of a merger, acquisition, bankruptcy or 522 other transaction in which the controller assumes control of all or part of another person’s assets 523 shall provide affected consumers with notice of such acquisition following the acquisition. 26 of 34 524 Notice to consumers under this subsection shall include the name of the controller receiving the 525 consumer’s personal data, the applicable privacy policies of the controller and notice of the 526 rights available to consumers under section 4. The attorney general may issue rules and 527 promulgate regulations prescribing the form of notice under this subsection and establishing 528 mechanisms to facilitate a consumer’s exercise of rights pursuant to clause (iv) of subsection (a) 529 of section 4 or other provisions of this chapter. 530 Section 7. (a) A controller shall not conduct processing that presents a heightened risk of 531 harm to a consumer without conducting and documenting a data protection assessment for each 532 of the controller’s processing activities that presents such heightened risk of harm to a consumer. 533 For the purposes of this section, processing that presents a heightened risk of harm to a consumer 534 shall include, but not be limited to, the: 535 (i) collection or processing of personal data for the purposes of targeted advertising; 536 (ii) sale of personal data; 537 (iii) processing of personal data for the purposes of profiling, where such profiling 538 presents a reasonably foreseeable risk of: (A) unfair or deceptive treatment of, or unlawful 539 disparate impact on, a consumer; (B) financial, physical or reputational injury to a consumer; (C) 540 a physical or other intrusion upon the solitude or seclusion or the private affairs or concerns of a 541 consumer, where such intrusion would be offensive to a reasonable person; or (D) other 542 substantial injury to a consumer; and 543 (iv) collection or processing of sensitive data. 27 of 34 544 (b) Data protection assessments conducted pursuant to subsection (a) shall identify the 545 categories of personal data collected, the purposes for collecting such personal data, whether 546 personal data is being transferred and identify and weigh the benefits that may flow, directly and 547 indirectly, from the processing to the controller, the consumer, other stakeholders and the public 548 against the potential risks to the rights of the consumer associated with such processing, as 549 mitigated by safeguards that are employed by the controller to reduce such risks. The controller 550 shall factor into any such data protection assessment the use of de-identified data and the 551 reasonable expectations of consumers, as well as the context of the processing and the 552 relationship between the controller and the consumer whose personal data will be processed. 553 (c) A single data protection assessment may address a comparable set of processing 554 operations that include similar activities. 555 (d) If a controller conducts a data protection assessment for the purpose of complying 556 with another applicable law or regulation, the data protection assessment shall satisfy the 557 requirements established in this section if such data protection assessment is similar in scope and 558 effect to the data protection assessment that would otherwise be conducted pursuant to this 559 section. 560 (e) (1) A controller shall, upon request of the attorney general, disclose a data protection 561 assessment to the attorney general. 562 (2) The attorney general may evaluate a data protection assessment for the controller’s 563 compliance with the requirements of this chapter. A controller’s data protection assessment may 564 be used in an action to enforce this chapter. 28 of 34 565 (3) To the extent that any information contained in the data protection assessment 566 disclosed to the attorney general includes information subject to the attorney-client privilege or 567 work product protection, the disclosure shall not constitute a waiver of such privilege or 568 protection. 569 (4) A data protection assessment obtained by the attorney general shall be confidential 570 and shall be exempt from section 10 of chapter 66. 571 Section 8. (a) Nothing in this chapter shall be construed to: (i) require a controller or 572 processor to re-identify de-identified data; (ii) maintain data in identifiable form or collect, 573 obtain, retain or access any data or technology in order to be capable of associating an 574 authenticated consumer request with personal data; or (iii) require a controller or processor to 575 comply with an authenticated consumer rights request if the controller: (A) is not reasonably 576 capable of associating the request with the personal data or it would be unreasonably 577 burdensome for the controller to associate the request with the personal data; and (B) does not 578 use the personal data to recognize or respond to the specific consumer who is the subject of the 579 personal data or associate the personal data with other personal data about the same specific 580 consumer. 581 (b) A controller that transfers de-identified data shall exercise reasonable oversight to 582 monitor compliance with any contractual commitments to which the de-identified data is subject 583 and shall take appropriate steps to address any breaches of those contractual commitments. 584 Section 9. (a). Nothing in this chapter shall be construed to restrict a controller’s or 585 processor’s ability to: 586 (i) comply with federal law or other laws of the commonwealth; 29 of 34 587 (ii) comply with a civil, criminal or regulatory inquiry, investigation, subpoena or 588 summons by federal, state, municipal or other governmental authorities, except as prohibited by 589 another law, including, but not limited to, section 115 of chapter 93; 590 (iii) cooperate with a federal law enforcement agency or any law enforcement agency of 591 the commonwealth concerning conduct or activity that the controller or processor reasonably and 592 in good faith believes may violate federal or state law; 593 (iv) investigate, establish, exercise, prepare for or defend legal claims; 594 (v) provide a product or service specifically requested by the consumer; 595 (vi) perform under a contract to which a consumer is a party, including fulfilling the 596 terms of a written warranty; 597 (vii) take steps at the request of a consumer prior to entering into a contract; 598 (viii) take immediate steps to protect an interest that is essential for the life or physical 599 safety of the consumer or another individual and where the processing cannot be manifestly 600 based on another legal basis; 601 (ix) prevent, detect, protect against, investigate, prosecute those responsible for or 602 otherwise respond to security incidents, identity theft, fraud, harassment, malicious or deceptive 603 activities or any other type of illegal activity; 604 (x) preserve the integrity or security of systems; 605 (xi) engage in public or peer-reviewed scientific, historical or statistical research in the 606 public interest that adheres to all relevant laws and regulations governing such research, if 30 of 34 607 applicable, and is approved, monitored and governed by an institutional review board or similar 608 independent oversight entity that determines whether the: (A) deletion of personal data requested 609 by a consumer under clause (iv) of subsection (a) of section 4 is likely to provide substantial 610 benefits that do not accrue exclusively to the controller; (B) expected benefits of the research 611 outweigh the privacy risks; and (C) controller has implemented reasonable safeguards to mitigate 612 privacy risks associated with the research, including any risks associated with re-identification; 613 (xii) assist another controller, processor or third party with any of the obligations under 614 this chapter; 615 (xiii) process personal data for reasons of public interest in the area of public health, 616 community health or population health solely to the extent that such processing is: (A) subject to 617 suitable and specific measures to safeguard the rights of the consumer whose personal data is 618 being processed; and (B) under the responsibility of a professional subject to confidentiality 619 obligations under federal, state or local law; 620 (xiv) ensure the security and integrity of personal data as required by this chapter, protect 621 against spam or protect and maintain networks and systems, including through diagnostics, 622 debugging and repairs; 623 (xv) effectuate a product recall pursuant to federal or state law or fulfill a warranty; 624 (xvi) perform internal operations from data collected in accordance with this section that 625 are reasonably aligned with the expectation of the consumer based on the consumer’s existing 626 relationship with the controller; and 31 of 34 627 (xvii) publish entity-based member or employee contact information where such 628 publication is intended to allow members of the public to contact such member or employee in 629 the ordinary course of the entity’s operations. 630 (b) (1) The obligations imposed on controllers or processors under this chapter shall not 631 apply where compliance by the controller or processor would violate an evidentiary privilege. 632 (2) Nothing in this chapter shall be construed to prevent a controller or processor from 633 providing personal data concerning a consumer to a person covered by an evidentiary privilege 634 under the laws of the commonwealth as part of a privileged communication. 635 (c) Nothing in this chapter shall be construed to: 636 (i) impose any obligation on a controller or processor that adversely affects the rights or 637 freedoms of any person, including, but not limited to, freedom of speech and freedom of the 638 press guaranteed in the First Amendment to the United States Constitution and Article XVI of 639 the Constitution of the Commonwealth; 640 (ii) apply to any person’s collection or processing of personal data in the course of such 641 person’s personal or household activities; 642 (iii) for private schools approved under section 1 of chapter 76 and private institutions of 643 higher education as defined by 20 USC section 1001 et seq., require deletion of personal data 644 that would unreasonably interfere with the provision of education services by or the ordinary 645 operation of the school or institution; 646 (iv) prevent access to the data of a child by the child’s parent or guardian; or 32 of 34 647 (v) for a consumer reporting agency, as defined in 15 USC 1681a(f), require deletion of 648 personal data used for the purpose of evaluating a consumer’s creditworthiness, credit standing, 649 credit capacity, character, general reputation, personal characteristics or mode of living, subject 650 to the provisions of the Fair Credit Reporting Act, 15 USC 1681 et seq. 651 (d) (1) Personal data collected or processed by a controller pursuant to this section may 652 be collected or processed to the extent that such collection and processing is: (i) reasonably 653 necessary to effectuate the purposes listed in this section; (ii) limited to what is necessary in 654 relation to the specific purposes listed in this section; and (iii) compliant with subsection (f) of 655 section 4. 656 (2) Personal data processed pursuant to subsection (a) shall, where applicable, take into 657 account the nature and purpose or purposes of such processing. Such data shall be subject to 658 reasonable administrative, technical and physical measures to protect the confidentiality, 659 integrity and accessibility of the personal data and to reduce reasonably foreseeable risks of harm 660 to consumers relating to such processing of personal data. 661 (e) If a controller collects or processes personal data pursuant to an exemption in this 662 section, the controller bears the burden of demonstrating that such collection or processing 663 qualifies for the exemption and complies with the requirements in this subsection. 664 Section 10. (a) The attorney general may adopt, amend or rescind rules and regulations 665 for the implementation, administration and enforcement of this chapter. 666 (b) A violation of this chapter shall constitute an unfair or deceptive trade practice for 667 purposes of chapter 93A. Notwithstanding sections 9 and 11 of said chapter 93A, the attorney 33 of 34 668 general shall have exclusive authority to bring a civil action against a controller or processor that 669 violates this chapter or a regulation adopted under this chapter to: 670 (i) enjoin an act or practice that is in violation of this chapter or a regulation adopted 671 under this chapter, including an order that an entity retrieve any personal data transferred in such 672 violation; 673 (ii) enforce compliance with this chapter or a regulation adopted under this chapter, 674 including seeking declaratory relief; 675 (iii) obtain damages, including punitive damages, restitution of any money or property 676 obtained directly or indirectly by any such violation, and disgorgement of any profits, assets, 677 property, or data obtained directly or indirectly by any such violation on behalf of the residents 678 of the commonwealth; 679 (iv) impose civil penalties in an amount not more than $5,000 per violation; 680 (v) obtain investigative costs, reasonable attorney’s fees and other litigation costs, 681 including, but not limited to, expert fees, reasonably incurred; and 682 (vi) obtain any such other and further relief as the court may deem proper. 683 (c) The attorney general shall create, maintain and monitor a mechanism for consumers to 684 report potential violations of this chapter. 685 (d) (1) Prior to initiating any action for a violation of any provision of this chapter, the 686 attorney general shall issue a notice of violation to the controller unless the attorney general 687 determines that a cure is not possible or an alleged violation requires immediate enforcement. If 34 of 34 688 the controller fails to cure such violation not more than 60 days after receipt of the notice of 689 violation, the attorney general may bring an action pursuant to this section. 690 (2) In determining whether an alleged violation requires immediate enforcement, the 691 attorney general may consider: (i) the number of violations; (ii) the size and complexity of the 692 controller or processor; (iii) the nature and extent of the controller’s or processor’s processing 693 activities; (iv) the likelihood of injury to the public; (v) the safety of persons or property; (vi) 694 whether the alleged violation was likely caused by a human or technical error; (vii) whether the 695 alleged violation directly or indirectly resulted in or caused unauthorized data access, theft or 696 disclosure; and (viii) the extent to which the controller or processor has violated this chapter or 697 similar laws in the past. 698 SECTION 2. Subsection (d) of section 10 of chapter 93M of the General Laws is hereby 699 repealed. 700 SECTION 3. Section 1 shall take effect on January 1, 2027. 701 SECTION 4. Section 2 shall take effect on June 1, 2027.