Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

MA H104: Establishing the Massachusetts Data Privacy Act

In Committee Massachusetts

Last verified Oct 13, 2026 · official bill text

H104 · where it stands

1 of 5 steps complete
  1. Introduced In committee
  2. Passed first chamber
  3. Passed both chambers
  4. Enacted
  5. Effective
What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Massachusetts H104 would add G.L. Chapter 93M (the Massachusetts Data Privacy Act) and Chapter 93N (location data). Individuals could access, correct, delete and port covered data and opt out of profiling used for automated decisions with legal or similarly significant effects; biometric data is sensitive data. Referred to the Advanced Information Technology, the Internet and Cybersecurity Committee February 27, 2025; on November 17, 2025 it accompanied new draft H4746, which was referred to House Ways and Means that day.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None yet: the bill has not been enacted. If enacted, businesses handling Massachusetts residents' data would face consent, opt-out, biometric-policy and private-lawsuit exposure.

Key provisions

  1. Adds Chapter 93M and Chapter 93N (location information from electronic devices) to the General Laws.
  2. Biometric data (including a map or scan of hand or face geometry) is sensitive covered data with a separate policy requirement, and transfers require consent before each transfer.
  3. Individuals may opt out of profiling used for automated decisions with legal or similarly significant effects (Section 10(d)); responses are due within 45 days with one 20-day extension.
  4. Processing with a disparate impact on protected characteristics is prohibited, subject to exceptions (Section 8).
  5. Violations are unfair or deceptive acts under Chapter 93A; individuals may sue covered entities and large-data-holder third parties; the Attorney General may seek civil penalties up to 4% of annual global revenue or $20,000,000 per action. No cure period.
  6. Takes effect one year after enactment. The text does not use the term artificial intelligence.

Latest legislative action

Nov 17, 2025. Accompanied a new draft, see H4746

Sponsors (showing 5 of 129)

NameRole
D Cosponsor
Cosponsor
D Cosponsor
D Cosponsor
D Cosponsor

Related and companion bills

Topics and industries

Affected industries

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error