Cybersecurity Policy Report, Massachusetts House Passes Consumer Data Privacy Act, (Jun 5, 2026)
The Massachusetts state House voted unanimously yesterday to pass a consumer data privacy bill that would give consumers certain rights over their own data and includes data minimization provisions and enhanced protections for minors’ data. The bill would also ban the sale of precise geolocation data.
HB 5472/SB 2619 would give consumers the right to access, correct, delete, and control use of their personal data. It would also prohibit selling sensitive personal data, including health, reproductive health, gender, biometric/genetic data, geolocation, information concerning minors, and data revealing race, religion, sexual orientation, citizenship, and disability.
The bill would further impose strict requirements on businesses regarding the collection, processing, sale, and security of personal data. Among other things, businesses engaging in “high-risk data processing activities” would be required to conduct and document privacy impact assessments to evaluate risks to consumers.
The bill also would provide enhanced protections for minors’ personal data, including prohibitions on the sale of such data and its use for targeted advertising.
Provisions of the bill would apply to entities that collect or process the personal data of at least 100,000 consumers, derive significant revenue from the sale of personal data, or handle sensitive data, with certain exemptions for government bodies, specific nonprofits, and other entities.
The bill directs the state attorney general to implement and enforce its provisions. The attorney general would have the authority to bring a civil action against any controller or processor that violates the bill and impose civil penalties of up to $5,000 per violation. The bill also would allow for a private right of action under which individuals could file lawsuits against large data companies under certain circumstances.
The Electronic Privacy Information Center (EPIC) released a statement today applauding lawmakers for supporting the bill.
“Every day, companies profit from collecting more information about us than they need and using it in ways we don’t expect. This bill changes that,” said EPIC Deputy Director and Policy Director Caitriona Fitzgerald. “Instead of placing the burden on individuals to navigate endless privacy policies and opt-out forms, it establishes meaningful limits on how much data companies can collect in the first place. EPIC thanks the members of the Massachusetts House of Representatives for their leadership on this bill.”
News: StateLegislation DataPrivacy