After thirty years of the commercial internet — thirty years of people’s sensitive data being traded, breached, exploited for scams, hacked by nation-states and their proxies, and sucked relentlessly into the maw of the NSA like a child being sacrificed to Molech, the Massachusetts Senate has actually passed a pretty good commercial privacy bill, the Massachusetts Data Privacy Bill (MDPA), S.2619.
The bill, which passed unanimously, bans the sale of sensitive data, including location data. It is most similar to a law that recently passed in Maryland, which is probably the strongest commercial privacy bill in the country. It contains language requiring companies to meaningfully minimize the collection, storage and retention of our personal information. It prohibits the sale of our sensitive personal information, which includes: precise geolocation; health care information; biometric data, such as face and fingerprint scans; citizenship or immigration status; information revealing someone’s sex life, and any information about a person’s race, color, ethnicity, religion, sexual orientation, gender identity, or national origin; and information that pertains to a child. The bill’s protections for geolocation data extend not just to Massachusetts residents, but crucially, also to people visiting Massachusetts to get reproductive or gender-affirming care.
Nevertheless, the bill falls short of what Digital Fourth and other privacy advocates have pushed for. We fought hard for a private right of action, but that language was removed by the Senate Ways and Means Committee. Thus, when a firm harms a Massachusetts resident or visitor by illegal acts under this bill, private individuals won’t be able to sue the firm directly. Enforcement will depend on the priorities of the overburdened Attorney-General’s office. Industry groups lobbied especially hard to kill that provision. Also, the definition of “sensitive data” doesn’t include your browsing information or search terms, so firms will still be able to sell and share that at will, including with the government. Last, to avoid offense to law enforcement, the Senate Ways and Means Committee also stripped a requirement for law enforcement to get a warrant before they request your location data from a private firm.
At the start of the session, it looked like perhaps all we could get was a narrow bill targeted only at location data. What goes to the House now is something broader and better than that original proposal. We’re genuinely grateful to the Senators who worked to make this bill happen, including Senate President Karen Spilka, Senate Majority Leader Cynthia Creem, Cindy Friedman (the bill’s primary author), and Michael Moore (Chair of the Senate Committee on Advanced Information Technology, the Internet and Cybersecurity). We also worked closely with a whole coalition of organizations, notably including EPIC, Consumer Reports, ACLU of MA, Color of Change, unions, women’s rights and reproductive justice groups, and the Massachusetts chapters of the American Legion, and we’re grateful for their guidance and assistance. One of our most active members did years of outreach to veterans’ groups, who then called and emailed their legislators in support of strong comprehensive privacy legislation, after learning from us that the sensitive personal data and geolocation data of active duty troops and veterans was being purchased from data brokers and could be used to track deployments.
On the House side, House leadership has been waiting to see what the Senate produced, before deciding whether to move a privacy bill forward this session. Legislators including Tricia Farley-Bouvier and Dave Rogers have been working on worthwhile bills. Just as on the Senate side, there has been heavy industry pressure to prevent action on privacy or to make what emerges from committee as weak as possible. Despite the inevitable shortcomings, we desperately need House leadership to act to move this forward.
There is real urgency here. Your data is not safe with the people we’ve given it to. The new Trump administration has moved fast and hard to extinguish the remnants of federal privacy laws left over from the 1970s. Every item of data the government can access, will be integrated, processed, and flagged as necessary for use against you. Bought contraception last weekend? Went to a protest? Expressed a view online that the President might deem “anti-Christian” or “anti-American” or even “anti-fascist”? Good luck — thanks to the administration’s efforts, which build on a quarter-century of bipartisan efforts to expand “data-sharing” in the name of counter-terrorism, it’s now open season on any activity that uses an internet connection, or that involves carrying a cell phone or walking past a security camera.
Worse, thanks to DOGE, well-established data silos for personal data housed by different federal agencies are quickly being broken down. Between these efforts, and the continued expansion of commercial and government surveillance spearheaded by Palantir and similarly malevolent tech companies, your IRS data, your Social Security data, your health, financial, location and Internet data are readily available to not only the federal government, but foreign companies and governments, as well as domestic groups intending to harass, threaten, and even kill people they disagree with.
It turns out that data doesn’t care what it’s being used for. Promises to use it only for good, count only if the person making the promise follows through consistently on that promise and remains in power. The Constitution’s protections of privacy under the Fourth Amendment and under statute aren’t magic; they’re only as powerful as people’s, and especially judges’, continued willingness to prioritize those rights above governmental and commercial administrative convenience.
Swift and decisive action by the Massachusetts House to enact the MDPA would be an easy win for legislators. According to a poll conducted by Beacon Research, 92% of Massachusetts likely voters support banning the sale of location data. Pew found that 78% of Democrats and 68% of Republicans support lawmakers taking action to protect their online privacy. It turns out that most Americans don’t think privacy is dead, and don’t like the endless, intrusive hassle of engaging with an abusively designed digital ecosystem. Whether it’s Massachusetts Founding Father James P. Otis complaining about the British Crown’s unreasonable searches and seizures of people, their papers and effects, or citizens now complaining about comprehensive data dossiers and data sharing, privacy was and is very popular.
If you want to help, please call your State Representative. Tell them that privacy matters to you, and that you want the House to take up and pass a strong bill, like the Senate’s original S. 2516. It should include quality data minimization protections for all people in MA. It should ban the sale of all sensitive data, including browsing data and search terms. It should, like S. 2516, include a private right of action. And it should happen now, so we don’t lose the last shreds of our privacy under federal government assault. The House needs to step up and protect the people – now.
This article contains contributions from volunteers Alex M., Alex T., and anonymous Digital Fourth volunteers.