What Is the Massachusetts Data Privacy Protection Act?

The Massachusetts Data Privacy Act is a pending state law that would place some of the strictest limits in the country on how businesses and nonprofits collect, use, and sell the personal data of Massachusetts residents. The Massachusetts Senate passed it unanimously, 40-0, in 2025. If the House approves it and the governor signs it in the current form, most provisions take effect January 1, 2027, with a second wave following on June 1, 2027.¹ The bill creates a two-tier data minimization standard, bans the outright sale of sensitive data, gives consumers meaningful opt-out rights, and, unusually among state privacy laws, lets individuals sue violators directly.

Where the Bill Stands

The MDPA passed the Senate as S.2608 and has been engrossed as S.2619. It still needs to clear the Massachusetts House of Representatives and be signed by the governor before becoming law, and provisions can change during the legislative process. Check the Massachusetts Legislature website for the current status before relying on specific language.

As passed by the Senate, the bulk of the law would take effect on January 1, 2027, with additional sections following on June 1, 2027.¹ That staggered timeline gives businesses roughly a year to prepare once the law is signed.

Who the Law Would Cover

The MDPA applies to entities that collect or process the personal data of Massachusetts residents, and it reaches both businesses and nonprofits. That is notable, because most state privacy laws exempt nonprofits entirely. An amendment added during Senate debate makes clear that even entities with other exemptions cannot sell sensitive data.¹

Data already regulated under the Health Insurance Portability and Accountability Act is exempted, which is standard across state privacy laws. Earlier versions of the bill were narrower in their federal-law carve-outs than other states’ statutes, so businesses that rely on Gramm-Leach-Bliley Act exemptions or similar federal regimes should review the final enacted text carefully.

Limits on Data Collection

The MDPA does not require consent for all data collection. It uses a data minimization approach with two tiers. For ordinary personal data, a business may collect and process only what is “reasonably necessary” to provide its product or service. For sensitive data, the standard is higher: collection is permitted only when “strictly necessary.”¹

In practice, that distinction is significant. A retailer might argue that collecting a customer’s browsing history across its site is reasonably necessary to improve recommendations. Collecting the same customer’s GPS location would have to clear the much harder “strictly necessary” bar, because precise geolocation is sensitive data.

Sensitive Data and the Ban on Selling It

The MDPA defines sensitive data more broadly than most state privacy laws. Protected categories include:

Biometric data such as fingerprint scans and facial recognition identifiers
Precise, GPS-level geolocation
Health care information
Citizenship or immigration status
Information revealing sex life or sexual orientation
Race, color, ethnicity, religion, gender identity, or national origin
Any personal information pertaining to a minor
Private communications: voicemails, emails, text messages, direct messages, calendar data, address books, and phone or text logs

The inclusion of private communications sets this bill apart from laws in other states, which typically limit their sensitive-data definitions to demographic categories and biometrics.²

The MDPA does not merely require opt-in consent before a business can sell sensitive data. It bans the sale entirely. No entity, for-profit or nonprofit, may sell a person’s sensitive data under any circumstances.¹ Transferring sensitive data to a third party, as distinct from selling it, is permitted only with the consumer’s affirmative consent, obtained before each specific transfer.² Sensitive data also cannot be processed for targeted advertising at all, whether or not it is being sold or transferred.

The MDPA folds in core provisions of the Location Shield Act, which specifically prohibits the sale of sensitive location data. A Senate amendment extends that protection to anyone who visits Massachusetts for any reason, including people who travel to the state to seek health care.¹

Consumer Rights

The MDPA grants Massachusetts residents several specific rights over their personal data:

Right to access: find out whether a business is collecting your data, see what it has collected, and learn who it has shared your data with.
Right to correct: require a business to fix inaccurate personal data.
Right to delete: request erasure of your personal information.
Right to opt out of targeted advertising: block businesses from using your data for behavioral advertising.
Right to opt out of data sales: prevent the sale of your personal data to third parties.

These rights are enforced through both the Attorney General’s office and private lawsuits.¹

The bill also creates a data broker registry and a one-stop deletion mechanism, so a Massachusetts resident can request removal of their data from all registered brokers in a single step rather than contacting each broker individually.³ Data brokers that fail to register face enforcement without the benefit of a cure period.

Data Protection Assessments

Businesses engaged in higher-risk data processing must conduct and document a data protection assessment before proceeding. Four categories of processing trigger the requirement:

Collecting or processing personal data for targeted advertising
Selling personal data
Profiling consumers in ways that risk unfair treatment, financial harm, reputational injury, or intrusions on privacy
Collecting or processing sensitive data

Each distinct processing activity in these categories needs its own documented assessment. A company that runs targeted ads, sells data to third parties, and collects biometric information would need at least three separate assessments.

Penalties and How the Law Would Be Enforced

The MDPA’s penalty structure scales with the size of the violator, which lets it hit large companies far harder than a flat per-violation fine would.

Attorney General Enforcement

The Massachusetts Attorney General can bring enforcement actions under the state’s existing consumer protection statute, Chapter 93A. If a court finds that a business knew or should have known it was violating the law, penalties start at the greater of 0.15% of annual global revenue or $15,000 per violation. For actions involving multiple violations affecting multiple people, the cap rises to the greater of 4% of annual global revenue or $20,000,000.²

For flagrant, willful, and repeated violations, a court can prohibit the business from operating in Massachusetts entirely or bar it from collecting, processing, or transferring covered data.

Private Right of Action

This is where the MDPA diverges most sharply from the majority of state privacy laws, which limit enforcement to the Attorney General. Under the MDPA, individuals can sue large data holders directly in superior court. Courts can award liquidated damages of at least 0.15% of the entity’s annual global revenue or $15,000 per violation, whichever is greater, plus punitive damages and injunctive relief.²

Cure Period

Before the Attorney General files suit, the business receives written notice identifying the specific violations alleged. It then has 30 days to cure the violation and provide a written statement confirming the fix and pledging no further violations. If it does so, no action proceeds.⁴

The cure period disappears in several situations: when a court has already issued an injunction or penalties against the business, when the AG has evidence of willful and wanton violations, when a data broker fails to register, or when the violator is a large entity (over $1 billion in global revenue and processing data of at least 100,000 individuals) and the violation occurs more than 24 months after the law’s effective date. Large companies effectively get a two-year grace period for cure rights, after which they face immediate enforcement.⁴

Cybersecurity Safe Harbor

Businesses that maintain a written cybersecurity program conforming to an industry-recognized framework get a meaningful defense. Courts cannot assess punitive damages against them in tort claims alleging that a security breach resulted from inadequate controls, as long as the business actually followed its own program.⁴ Adopting a framework like NIST or ISO 27001 and genuinely following it creates a shield against the most expensive category of damages.

Preparing Before the Law Takes Effect

Businesses that process personal data of Massachusetts residents should start compliance work now rather than waiting for the governor’s signature. Privacy programs take months to build, and the January 2027 effective date leaves limited runway once the bill becomes law.

The most immediate priority is a data inventory: cataloging what personal data you collect, where it goes, and whether any of it falls into the sensitive data categories. That inventory drives everything else, from deciding whether your collection practices meet the “reasonably necessary” or “strictly necessary” standard to identifying which processing activities require a documented assessment.

Businesses that sell data or use it for targeted advertising face the largest operational changes. The outright ban on selling sensitive data and the opt-out rights for targeted advertising and data sales require consumer-facing mechanisms that actually work, not controls buried behind account settings. Companies in the data broker space have the registry to contend with on top of that. Evaluating a cybersecurity program against a recognized framework is also worth doing early. The safe harbor is available only to businesses that put the program in place before a breach, not after.

One boundary worth noting: Massachusetts already has a separate data breach notification law, administered through the Office of Consumer Affairs and Business Regulation and the Attorney General’s Office, which requires notification within a “reasonable amount of time” after a breach is discovered.⁵ That obligation sits alongside the MDPA rather than inside it, and it already applies today.

1
General Court of Massachusetts. Senate Passes the Massachusetts Data Privacy Act
2
General Court of Massachusetts. Bill S45 – Primary Sponsor Summary
3
Electronic Privacy Information Center. Massachusetts Senate Committee Approves Robust Comprehensive Privacy Law
4
General Court of Massachusetts. Bill H4514
5
Mass.gov. Requirements for Data Breach Notifications