Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

MA S33: Establishing the Comprehensive Massachusetts Consumer Data Privacy Act

In Committee Massachusetts

Last verified Oct 22, 2026 · official bill text

S33 · where it stands

1 of 5 steps complete
  1. Introduced In committee
  2. Passed first chamber
  3. Passed both chambers
  4. Enacted
  5. Effective
What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Massachusetts S 33 would create a comprehensive consumer data privacy act. After a joint committee hearing on April 9, 2025, the committee folded it into new draft S2516 on May 12, 2025, so S33 itself does not move further. The successor, redrafted as S2608 and passed by the Senate 40-0 on September 25, 2025 as S2619, would let consumers opt out of profiling for solely automated decisions with legal or similarly significant effects. The House passed different text on June 4, 2026 and a conference committee was appointed in June 2026; nothing is law.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None yet: the bill has not been enacted. If a final act resembles the Senate text, larger data-handling businesses would owe privacy rights, opt-outs from automated profiling and assessments.

Key provisions

  1. Senate version (S2619): applies to persons that processed data of 60,000+ consumers, or 20,000+ consumers with 20% of gross revenue from data sales, or handled reproductive or sexual health data
  2. Would let consumers opt out of profiling for solely automated decisions with legal or similarly significant effects; for any profiling-based decision with such effects, consumers could question the result, learn the reason and have inaccurate data corrected
  3. Controllers would have to run data protection assessments for profiling that risks unfair treatment, disparate impact or other substantial injury
  4. Attorney general would have exclusive enforcement under chapter 93A, with civil penalties up to $5,000 per violation and a 60-day cure notice (cure repealed June 1, 2027)
  5. Senate version would take effect January 1, 2027, with section 2 (repeal of the cure period) on June 1, 2027
  6. Bill history: S2516 reported May 12, 2025; S2619 passed Senate September 25, 2025; House passed amended text June 4, 2026; Senate non-concurred June 11, 2026; conference committee appointed

Latest legislative action

May 12, 2025. Accompanied a new draft, see S2516

Sponsors (showing 5 of 21)

NameRole
D Primary
D Primary
D Primary
Primary
Cosponsor

Related and companion bills

Topics and industries

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error