Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

MA H80: Establishing the Comprehensive Massachusetts Consumer Data Privacy Act

In Committee Massachusetts

Last verified Oct 21, 2026 · official bill text

H80 · where it stands

1 of 5 steps complete
  1. Introduced In committee
  2. Passed first chamber
  3. Passed both chambers
  4. Enacted
  5. Effective
What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Massachusetts H80 would add G.L. Chapter 93M, the Massachusetts Consumer Privacy Act, giving consumers rights to access, correct, delete and port data and to opt out of targeted advertising, sales and profiling for solely automated decisions with legal or similarly significant effects. Referred to the Advanced Information Technology, the Internet and Cybersecurity Committee February 27, 2025; on November 17, 2025 it accompanied new draft H4746, which was referred to House Ways and Means that day.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None yet: the bill has not been enacted. If enacted, businesses meeting the thresholds would owe consumers opt-outs and consent for sensitive data, with Attorney General enforcement only.

Key provisions

  1. Applies to businesses that processed data of at least 100,000 consumers, or at least 25,000 consumers while deriving more than 25% of gross revenue from selling personal data.
  2. Consumers may opt out of profiling in furtherance of solely automated decisions with legal or similarly significant effects; consent is required to process sensitive data, which includes biometric data used to identify a person.
  3. Data protection assessments are required for targeted advertising, sales, certain profiling and sensitive-data processing; minors receive added protections (Section 7).
  4. Only the Attorney General enforces (Chapter 93A); no private right of action; no penalty amounts stated.
  5. Cure period: from July 1, 2026 through December 31, 2027 the Attorney General must give notice and a 60-day chance to cure where possible.
  6. Takes effect July 1, 2026. The text does not mention artificial intelligence or facial recognition.

Latest legislative action

Nov 17, 2025. Accompanied a new draft, see H4746

Sponsors (showing 5 of 74)

NameRole
D Primary
Primary
D Primary
D Cosponsor
Cosponsor

Related and companion bills

Topics and industries

Affected industries

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error