Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

MA S29: To establish the Massachusetts Data Privacy Act

In Committee Massachusetts

Last verified Oct 21, 2026 · official bill text

S29 · where it stands

1 of 5 steps complete
  1. Introduced In committee
  2. Passed first chamber
  3. Passed both chambers
  4. Enacted
  5. Effective
What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Massachusetts S29 would add G.L. Chapter 93M (Massachusetts Data Privacy Protection Act) and Chapter 93N (location data), giving individuals a right to opt out of profiling that produces legal or similarly significant effects. Referred to committee February 27, 2025; on May 12, 2025 it accompanied new draft S2516 (reported to Senate Ways and Means that day; replaced by S2608 on September 25, 2025).

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None yet: the bill has not been enacted. If enacted, companies handling residents' data would face consent, opt-out and biometric-policy duties and private lawsuits.

Key provisions

  1. Covered entities exclude small entities (average revenue not above $20,000,000 and data of no more than 25,000 individuals); large data holders have $200,000,000 or more in revenue.
  2. Biometric data includes a map or scan of hand or face geometry; covered entities need separate privacy policies for biometric and precise geolocation data.
  3. Individuals may opt out of profiling that produces legal or similarly significant effects (Section 10(d)); targeted advertising to known minors is barred (Section 16).
  4. Individuals may sue covered entities and large-data-holder third parties; liquidated damages of not less than 0.15% of annual global revenue or $15,000 per violation.
  5. Attorney General penalties up to 4% of annual global revenue or $20,000,000 per action; no cure period; takes effect 1 year after enactment.

Latest legislative action

May 12, 2025. Accompanied a new draft, see S2516

Sponsors (showing 5 of 25)

NameRole
D Primary
D Primary
Primary
D Primary
Cosponsor

Related and companion bills

Topics and industries

Related topics

AI PrivacyAutomated Decision-Making

Affected industries

TechnologyConsumer Protection

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error

Related AI laws in Massachusetts

All Massachusetts bills →
H78 Establishing the Massachusetts consumer data privacy act S33 Establishing the Comprehensive Massachusetts Consumer Data Privacy Act H104 Establishing the Massachusetts Data Privacy Act S45 Establishing the Massachusetts Data Privacy Act S2516 Establishing the Massachusetts data privacy act H80 Establishing the Comprehensive Massachusetts Consumer Data Privacy Act

Same topic in other states

Connecticut SB1295 An Act Concerning Broadband Internet, Gaming, Social Media, Online Services and Vermont S0071 An act relating to consumer data privacy and online surveillance Maryland HB603 Consumer Protection - Online Products and Services - Data of Children (Maryland New York A08158 Enacts the New York privacy act to require companies to disclose their methods o Rhode Island H7222 Video Lottery Games, Table Games And Sports Wagering--the Rhode Island Consumer California SB468 High-risk artificial intelligence systems: duty to protect personal information.