Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

MA S45: Establishing the Massachusetts Data Privacy Act

In Committee Massachusetts

Last verified Oct 21, 2026 · official bill text

S45 · where it stands

1 of 5 steps complete
  1. Introduced In committee
  2. Passed first chamber
  3. Passed both chambers
  4. Enacted
  5. Effective
What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Massachusetts S45 would add G.L. Chapter 93M (Massachusetts Data Privacy Act) and Chapter 93N (location data), with an opt-out of profiling used for automated decisions with legal or similarly significant effects. Referred to committee February 27, 2025; on May 12, 2025 it was folded into new draft S2516 (reported to Senate Ways and Means that day; replaced by S2608 on September 25, 2025).

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None yet: the bill has not been enacted. If enacted, businesses processing residents' data would face profiling opt-out duties, Attorney General penalties and private lawsuits.

Key provisions

  1. Small-entity exclusion: average annual revenue not above $20,000,000 and data of no more than 25,000 individuals; large data holders have $200,000,000 or more in revenue.
  2. Biometric data includes a map or scan of hand or face geometry; a high-impact social media company has $3,000,000,000 or more in revenue and 300,000,000 monthly active users.
  3. Individuals may opt out of profiling used for automated decisions with legal or similarly significant effects (Section 10(d)).
  4. Private right of action against covered entities, service providers and large-data-holder third parties; Attorney General penalties not less than 0.15% of global revenue or $15,000 per violation, up to 4% or $20,000,000.
  5. No cure period; takes effect 1 year after enactment. The text does not use the term artificial intelligence.

Latest legislative action

May 12, 2025. Accompanied a new draft, see S2516

Sponsors (showing 5 of 28)

NameRole
Primary
Primary
Primary
R Primary
Cosponsor

Related and companion bills

Topics and industries

Affected industries

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error