Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

MA H78: Establishing the Massachusetts consumer data privacy act

In Committee Massachusetts

Last verified Oct 22, 2026 · official bill text

H78 · where it stands

1 of 5 steps complete
  1. Introduced In committee
  2. Passed first chamber
  3. Passed both chambers
  4. Enacted
  5. Effective
What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Massachusetts H 78 would create the Massachusetts Consumer Data Privacy Act, giving consumers rights over personal data, including opting out of profiling for solely automated decisions with legal or similarly significant effects. After a hearing on April 9, 2025, the committee folded it into new draft H4746 on November 17, 2025, which was referred to House Ways and Means; the page shows no later action. Separately, Senate bill S2619 is in a conference committee (June 2026). Neither bill has passed both houses.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None yet: the bill has not been enacted. If enacted, businesses meeting the thresholds would have to honor opt-outs from automated profiling and assess risky profiling.

Key provisions

  1. Would apply to persons doing business in Massachusetts or targeting its residents that processed data of 25,000+ consumers in the prior year or derived revenue from selling personal data
  2. Consumers could opt out of targeted advertising, transfers of personal data, and profiling in furtherance of solely automated decisions with legal or similarly significant effects
  3. Controllers would have to complete data protection assessments for profiling that risks unfair or deceptive treatment, disparate impact or other substantial injury; first ones due within one year of the effective date
  4. Attorney general could seek civil penalties of not less than $15,000 per individual per violation; consumers could sue unless the violator is a small business
  5. Would take effect 180 days after enactment

Latest legislative action

Nov 17, 2025. Accompanied a new draft, see H4746

Sponsors (showing 5 of 49)

NameRole
Primary
Primary
Primary
D Primary
D Cosponsor

Related and companion bills

Topics and industries

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error