House and Senate negotiators began talks Tuesday to establish the state’s first comprehensive consumer data privacy law, kicking off what is expected to be a closely watched effort to reconcile competing approaches to regulating the collection, sale and use of personal information.
The negotiations arrive as Massachusetts has become one of the latest battlegrounds in a broader national fight over how far states should go in limiting the data practices of technology companies, drawing the attention of well-funded industry groups and a coalition of civil liberties, reproductive rights and consumer advocates pressing lawmakers to adopt some of the country’s strongest privacy protections.
The six-member conference committee — Reps. Michael Moran, Tricia Farley-Bouvier and David Vieira, and Sens. Cindy Creem, Barry Finegold and Patrick O’Connor — convened publicly for nearly an hour Tuesday afternoon to begin the talks. Much of the public meeting was spent walking through the House and Senate bills (H 5479 / S 2619) section by section, identifying provisions that are nearly identical and directing staff to reconcile technical language differences while setting aside the more contentious policy disputes for later negotiations.
“At least this is what my staff is saying to me, but there’s like 30% of this is definitions that are similar, and then the rest of it is, the last 70 is some differences, so hopefully, hopefully just by today we can get rid of 30% of the bill,” Moran remarked to Creem during the meeting.
Farley-Bouvier expressed optimism that the remaining disagreements are manageable.
“I agree that the differences between these two bills are not so great that we cannot come to a solution in a relatively quick manner,” she said, noting lawmakers have held “dozens and dozens and dozens” of stakeholder meetings over the last three years. “We have worked to balance the needs of both industry and consumers, but on the House side, I will say we put consumer in the name of this bill, because the consumer is at the very center of this bill. This is, in essence, a consumer protection bill.”
Creem called the legislation “critical” and said both chambers share the goal of creating “meaningful safeguards to protect the personal data of Massachusetts residents.”
“For too long, tech companies have profited off of our personal information without transparency, accountability, or limitation,” Creem said. “By advancing a strong data privacy bill, we’re going to be protecting our residents, our decisions, and a right to live free from constant surveillance.”
Vying for lawmakers’ ears, lobbyists and advocacy groups are already jockeying over several provisions expected to become the negotiations’ biggest flashpoints.
Andrew Kingman, who represents the State Privacy & Security Coalition that has members including Google, Meta, Amazon, Target and Walgreens, registered to lobby in Massachusetts late last year.
Nationally, Kingman has advocated for privacy laws that remain compatible across states while cautioning lawmakers against creating regulatory outliers. Contacted Monday, Kingman declined to discuss the Massachusetts negotiations, saying he would not speak publicly while talks are actively underway.
Caitriona Fitzgerald, deputy director and policy director at the Electronic Privacy Information Center, is among those lobbying for consumer privacy interests. Fitzgerald, a former chief of staff to Finegold (who sits on the conference committee) and former counsel to the Legislature’s Telecommunications and Energy Committee, has become one of the country’s leading advocates for stronger state privacy laws emphasizing data minimization and limits on online tracking.
Also registered on the issue is former House Ways and Means Chairman Brian Dempsey, whose firm represents the Massachusetts Alliance for Data Privacy.
Meanwhile, the ACLU of Massachusetts is part of a broader coalition that includes Planned Parenthood, Reproductive Equity Now, GLAAD, Jane Doe Inc. and other advocacy organizations pushing negotiators to strengthen the final bill. The coalition supports the Senate’s stricter limits on data collection and sale while backing the House’s enforcement provisions allowing consumers to directly sue the largest technology companies.
Kade Crockford, director of the ACLU of Massachusetts’s Technology for Liberty Program, said the coalition’s position has remained consistent throughout the legislative process.
“Our coalition has three key asks of the conference committee,” Crockford said. “We’re looking for, number one, data minimization standards in statute” that place “clear statutory limitations on the collection and processing of our personal information,” particularly sensitive data.
Rather than relying on consumers to navigate privacy settings and pop-up notices, Crockford argued the law should place the burden on technology companies. “We strongly believe that putting the burden on individual technology users … is not going to result in the best privacy outcomes.”
The Senate approved its bill in September, while the House passed a different version in June. Although the two proposals share a common framework requiring businesses to limit data collection, honor consumer requests to access or delete personal information, and allow consumers to opt out of targeted advertising and certain data sales, negotiators will need to resolve substantial differences over how broadly the law should apply and how aggressively it should regulate companies’ handling of sensitive information.
One of the biggest philosophical divides centers on the sale and collection of sensitive personal data.
The Senate bill would prohibit companies from selling sensitive information outright, including precise geolocation data, health information, biometric identifiers and other protected categories. It also would require companies to collect or process sensitive data only when “strictly necessary” to provide a product or service requested by a consumer.
“The Senate language is very good,” Crockford said. Under the Senate bill, general personal information must be limited to what is reasonably necessary to provide a requested service, while sensitive information could be collected or processed only when “strictly necessary.”
The House instead would allow companies to sell most categories of sensitive data if consumers affirmatively opt in, while separately imposing an outright ban on the sale of precise geolocation information. The House also relies on an opt-in consent model for collecting sensitive data rather than the Senate’s stricter necessity standard.
Crockford said the coalition hopes negotiators adopt the Senate’s broader prohibition on sales of sensitive information, while celebrating that both chambers agreed on banning companies from selling any person in Massachusetts’s exact geolocation data.
“We want to see the final bill extend that protection to all of the types of sensitive data that are protected by the legislation,” Crockford said. “Companies should not be able to sell any of that information.”
Negotiators also must decide which businesses the law should cover.
The Senate proposal applies to companies that process data from at least 60,000 Massachusetts residents annually, compared to the House’s 100,000-person threshold.
The Senate also automatically covers any business handling reproductive or sexual health information regardless of size, a provision absent from the House bill.
Another possible flashpoint involves enforcement.
The House bill creates a “large data holder” category designed for Big Tech companies that maintain data on at least 2 million people, or sensitive data on 200,000 people, exposing those firms to private lawsuits. The Senate does not create a comparable category.
Crockford called preserving that private right of action one of the coalition’s top priorities, arguing it would ensure the law has meaningful consequences for the largest technology companies.
“If the AG is the only cop on the beat, companies like Meta, who have huge legal departments and essentially endless amounts of money are likely to view a privacy law … as a set of suggestions and not a business requirement,” Crockford said. “The private right of action is the number one target of big business in this process.”
Because the House provision applies only to the largest data holders, Crockford said most businesses would not face private lawsuits. For coalition members including Planned Parenthood and Reproductive Equity Now, the enforcement mechanism is essential to protecting people seeking reproductive healthcare and preventing companies from profiting from highly sensitive information.
The House also expands the definition of sensitive data to include consumer health and wellness information collected through apps tracking sleep, stress, nutrition or similar metrics, while the Senate uses a narrower list focused on traditional health, biometric and financial categories.
The controversial provisions in the bill reflect a broader national debate over whether privacy laws should focus primarily on giving consumers choices about their data or instead limit companies’ ability to collect information in the first place.
That debate has intensified as states increasingly adopt comprehensive privacy laws in the absence of federal legislation. Twenty-three states have now enacted broad consumer privacy statutes, though no states had similar laws a decade ago, according to the International Association of Privacy Professionals.
The conference committee’s work comes as Massachusetts lawmakers seek to position the state at the forefront of technology regulation. Privacy legislation has increasingly become intertwined with debates over artificial intelligence, children’s online safety and digital advertising.
Sam Drysdale is a reporter for State House News Service and State Affairs Pro Massachusetts. Reach her at sdrysdale@statehousenews.com.
