S2516 would create a broad Massachusetts Data Privacy Act and a separate Location Shield Act. The data privacy chapter would establish consumer rights over personal data, including the rights to access, correct, delete, and obtain a portable copy of data, as well as to opt out of targeted advertising, data sales, and certain profiling. It also imposes duties on controllers and processors to minimize data collection, secure data, provide detailed privacy notices, conduct data protection assessments for higher-risk processing, and restrict the use and transfer of sensitive data. The bill includes special protections for minors, biometric data, precise geolocation data, reproductive or sexual health data, gender-affirming health data, neural data, and social care information, and it creates a registration and deletion framework for data brokers.
The bill would amend Massachusetts law by inserting new chapters 93M and 93N into the General Laws and by tying violations to existing consumer protection law under chapter 93A. It authorizes enforcement by the Attorney General and also creates a private right of action for consumers, with statutory damages, injunctive relief, punitive damages, and attorney’s fees in some cases. It also requires data brokers to register with the Office of Consumer Affairs and Business Regulation, participate in an accessible deletion mechanism, and follow credentialing rules for downstream users of brokered data. The Location Shield Act would separately limit the collection, retention, disclosure, and monetization of location information, require opt-in consent for most collection and processing, and bar government entities from monetizing location data.
Because there are no committee transcripts or recorded votes provided, the available context does not show formal debate or amendments, but the bill’s structure suggests a strong privacy-protection orientation. The overall sentiment implied by the text is protective of consumers and skeptical of commercial data practices, especially targeted advertising, data brokerage, and the use of sensitive or location data. The bill also reflects concern for vulnerable groups, including minors and people seeking reproductive or gender-affirming health care.
The main points of contention likely center on compliance burden, enforcement exposure, and the breadth of the restrictions. Businesses, especially large data holders, data brokers, ad-tech firms, and companies relying on profiling or location-based services, would face substantial new obligations, notice requirements, opt-out systems, and potential civil liability. The bill also contains detailed exemptions and carve-outs for research, public health, employment-related data, financial services, and other regulated sectors, which suggests an effort to balance privacy protections with operational and legal necessities. The most likely policy disputes are over the scope of sensitive data, the private right of action, the data broker deletion mechanism, and the limits on targeted advertising and location tracking.
The bill would add two new chapters to the General Laws, creating a comprehensive consumer privacy regime and a separate location-data privacy regime. It would regulate controllers, processors, and data brokers that do business in Massachusetts or target Massachusetts residents, impose affirmative consent and opt-out requirements, require privacy notices and data protection assessments, and make violations actionable under chapter 93A and through private lawsuits. It would also establish new registration, deletion, and credentialing obligations for data brokers through OCABR and restrict the collection, retention, disclosure, and monetization of location information, with enforcement by the Attorney General and private plaintiffs.
No committee testimony or vote record was provided, so there is no documented legislative debate to summarize. Based on the bill text alone, the measure is clearly consumer-privacy oriented and appears designed to strengthen protections for personal, sensitive, and location data. The tone of the bill is precautionary and enforcement-focused, indicating support for stronger privacy rights and skepticism toward data monetization and targeted advertising practices.
The likely areas of contention are the bill’s breadth and compliance costs. Large data holders, ad-tech companies, data brokers, and other businesses that rely on profiling, targeted advertising, or location tracking would likely object to the new restrictions, opt-out mechanisms, data deletion duties, and potential statutory damages. There may also be debate over the private right of action, the scope of sensitive data categories, and the operational burden of data protection assessments and broker registration. At the same time, privacy advocates would likely support the bill’s strong protections for minors, reproductive and gender-affirming health data, and location information, as well as its limits on dark patterns and deceptive design.