Massachusetts Consumer Data Privacy Act: Banning the Sale of Precise Location Data
Massachusetts lawmakers have passed the Consumer Data Privacy Act, a landmark piece of legislation that bans the sale and sharing of precise location data and other sensitive personal information without explicit user consent. The bill passed the House with a unanimous 146-0 vote and is expected to be signed into law following a final combination of House and Senate versions.
Core Protections and Scope of the Law
The Consumer Data Privacy Act establishes new rights for residents to access and delete their personal data and strictly regulates the handling of sensitive information.
Restricted Data Categories
Companies are prohibited from sharing or selling the following types of sensitive data without explicit consent:
- Precise Geolocation Data: The law applies to both residents and visitors, effectively creating a blanket ban on the sale of location data within the state.
- Biometrics: This includes fingerprints, genetic information, and health data.
- Other Sensitive Markers: Information regarding sexual orientation, immigration status, and religion.
Applicability
The law targets entities that handle or process the personal data of more than 100,000 consumers. This threshold ensures the legislation primarily impacts medium-sized startups and large technology companies rather than small businesses.
Addressing the Data Broker Ecosystem
The legislation specifically targets the commercial pipeline where app developers sell user location data to data brokers, who then resell that information to third parties, including governments and private actors.
Closing the Warrant Loophole
Historically, government agencies have bypassed the need for warrants by purchasing commercially available location data on the open market. By banning the sale of this data within Massachusetts, the law aims to disrupt this procurement method. This state-level action follows the scrapping of a federal attempt by the Trump administration to block the sale of sensitive data by brokers.
Industry Implications and Expert Perspectives
The law is expected to have a broad impact on advertising companies and startups whose business models rely on the collection and monetization of location-based data.
Advocacy and Legal Support
Privacy advocates have praised the move as a critical step in curbing digital surveillance. Evan Greer of Fight for the Future described the bill as a "major step toward cracking down on Big Tech’s surveillance abuses," while the ACLU noted that the bill positions Massachusetts as a leader in protecting personal privacy.
Critical Analysis and Potential Loopholes
Despite the legislative victory, technical and legal experts have raised concerns regarding the practical enforcement and potential gaps in the law.
Definitions of "Sale" vs. "Exchange"
Some critics argue that focusing on the "sale" of data may create a loophole.
"Feels like the word 'sale' may actually turn into a loophole. It should have probably been worded to use 'exchange' or 'transfer' instead."
While the bill does mention "sharing," there is concern that non-monetary exchanges of data might still occur.
Enforcement and Jurisdictional Challenges
Questions remain regarding whether the law can stop companies outside of Massachusetts from purchasing data gathered from users within the state, or if companies can still use the data internally for ad-targeting without "selling" it to a third party. Additionally, some observers point to existing law enforcement tools, such as Cellebrite software, as potential bypasses to these privacy protections.
Broader Trends in US Privacy Law
Massachusetts is part of a growing trend of state-level privacy legislation in the absence of a federal law. Similar movements are appearing in other states; for example, California recently passed AB-1542, which also covers precise location and health data. This has led to calls for a uniform federal privacy bill to avoid a patchwork of conflicting state regulations.