Alexandra ThornMassachusetts action item: Please sign and share Digital Fourth's petition for three common sense amendments to the House's Massachusetts Consumer Data Privacy Act, and for passage of the act itself: https://actionnetwork.org/letters/tell-your-state-representative-pass-enforceable-privacy-legislation
I've been helping Digital Fourth advocate for robust data privacy legislation in Massachusetts since spring 2025.
We're in the final stages of seeing what this legislature can do.
As a bit of history, earlier this year, the Senate committee on Internet and Cyber Security had put forward a version of the Massachusetts Data Privacy Act, a bill that was a privacy advocate's dream come true, but the bill was rewritten by the Ways and Means Committee, significantly weakening its scope and removing right to private action, which is crucial for enforcement.
Meanwhile, the Massachusetts House committee on Internet and Cybersecurity, took their time developing the MCDPA, which is *substantially* weaker than what the Senate committee had originally put forward, but *much* stronger than the version that passed Senate Ways and Means.
The MCDPA is before the Massachusetts House Ways and Means Committee now, so this is the time to work on strengthening the bill.
Although this opinion piece on WBUR says that the if passed the MCDPA "would be the most privacy protective state privacy law in the country," but it's not quite that simple.
https://www.wbur.org/cognoscenti/2026/03/04/big-tech-data-ai-consumer-privacy-law-woodrow-hartzog-neil-richards
The Massachusetts Consumer Data Privacy Act is in some ways strong and in other ways weaker than both the California and Maryland privacy laws.
Big tech is hungry for consumer data. Mass. needs privacy legislation now
The heart of the privacy bill that the Massachusetts legislature is now considering is a simple but firm rule that companies should collect and use only the personal information that they need to provide services for consumers, write Woodrow Hartzog and Neil Richards.
California's Privacy Rights Act (CPRA) applies to companies earning over $26,625,000 in the preceding calendar year or that buy, sell, or share the personal information of 100,000 or more consumers.
If passed in its current form, the MCDPA would apply only to companies that both have gross revenues above $200,000,000 *and* that handle data of more than 2,000,000 consumers.
The MCDPA has higher thresholds for enforcement than California, and also uses an "and" where California's privacy law uses an "or". That's a big difference.
One of the amendments that Digital Fourth is advocating for in our petition would replace the "and" with an "or", substantially broadening the scope of the bill.
In addition to replacing the "and" with an "or", Digital Fourth would also like to 1) strengthen protections for children and 2) make an extremely common-sense change that would broaden the definition of "genetic data" to include information derived from genetic data, not just the gene sequence itself.
If a genetic test shows that you're predisposed for diabetes or cancer, that test result should be protected, not just the data it was derived from.
For more exhaustive information on how the Massachusetts Consumer Data Privacy Act would compare with existing state laws, one of the Digital Fourth members made a detailed comparison of the MCDPA with the corresponding laws in California and Maryland:
https://docs.google.com/document/d/1oOltbqkxLpIsD76hHEPMpnfn-DdjoiA2UpoqNFmZodM/
Comparison of the MA Consumer Data Privacy Bill to the California Consumer Data Privacy Act and the Maryland Online Data Privacy Act
Comparison of the MA Consumer Data Privacy Bill to the California Consumer Data Privacy Act and the Maryland Online Data Privacy Act Note:The California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA)are CA’s comprehensive privacy legislation.. The CPRA is an amendment...
Again, here's Digital Fourth's petition to strengthen the MCDPA: https://actionnetwork.org/letters/tell-your-state-representative-pass-enforceable-privacy-legislation
If you're able to do so, calling your Massachusetts state representative would also be helpful.
You can look up who your rep is here: https://malegislature.gov/Search/FindMyLegislator