Massachusetts lawmakers approved legislation that would give residents new rights to access and delete personal data held by technology companies, and would ban the sale of precise location data.
The Massachusetts House passed the Consumer Data Privacy Act in a 146-0 vote Thursday, months after all 40 state senators voted in September to advance a separate version. The bills will now be combined in the Senate and sent to Gov. Maura Healey’s office.
If signed into law, the measure would apply to companies that handle or process the personal data of more than 100,000 consumers. It would require explicit user consent before sensitive information is shared or sold, including biometrics such as health data, genetic information, and fingerprints, as well as precise geolocation data and data about religion, immigration status, and sexual orientation.
By applying the location-data ban to both residents and visitors, the measure would effectively bar the sale of precise location data across Massachusetts. The bill is expected to affect startups that collect, share, or sell location data in the state, as well as advertising companies that use it for ad targeting.
The collection and sale of location data has been a central issue in privacy debates for years. Data brokers have relied on app developers selling user location data, which is then repackaged and sold to buyers, including stalkers, governments, and militaries. In some cases, the government has said it does not need a warrant to buy data that is commercially available.
The Biden administration came close to banning the sale of Americans’ sensitive data at the federal level, but the Trump administration later scrapped the change.
