Committee co-chair says Congress should act “but we know they will not”
STATE HOUSE, BOSTON, APRIL 9, 2025…..Lawmakers restarted their work Wednesday to bolster data privacy protections for Bay Staters, and some Democrats clashed with an attorney representing major tech companies over the best set of regulations to curtail exactly what type of information can be collected and used.
Reps. Andy Vargas and David Rogers pitched their proposal (H 104), dubbed the Massachusetts Data Privacy Act, as a top priority for the Legislature to safeguard residents’ sensitive information online, particularly as companies collect and sell data without consumers’ full knowledge or consent. The bill would create “data minimization” standards, which limit the information that companies can store and process based on “what is reasonably necessary and proportional to their lawful purpose,” according to a legislative summary.
“Data minimization is just the notion that the company uses it only for the specific purpose the person’s there — they don’t gather all this other information and start selling it to other third parties,” Rogers told the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity during its first hearing of the session. “I mean, it’s just common sense, it really is. It’s not overreaching.”
The bill also installs protections for minors against targeted advertising, gives Bay Staters the ability to sue for data privacy violations, and imposes restrictions on processing sensitive information like geolocation, biometric or genetic data. Bay Staters would also gain more power over the information that companies and other entities collect about them, including requesting the data be corrected or deleted.
Andrew Kingman, who represents the State Privacy & Security Coalition, urged the committee to consider a different data privacy framework on the hearing agenda Wednesday. His coalition represents 35 companies and six trade associations, including Amazon, Google, Netflix and Meta.
Kingman praised a Rep. Kate Hogan bill (H 80), the Comprehensive Massachusetts Consumer Data Privacy Act, which he said uses a framework adopted by Connecticut, Rhode Island, New Hampshire and 15 other states.
He said the bill adds restrictions around reproductive health care and geolocation data, while deploying a data minimization standard that currently applies to 600 million consumers across the globe. It does not give consumers the private right of action, Rep. Steven Owens pointed out.
“A number of the other frameworks today would be novel, distinct — even from Maryland, which was brought up,” Kingman said, referring to a new state data privacy law.
“The data minimization provisions in some of those frameworks are very concerning because companies don’t know what’s expected of them or how to comply,” Kingman continued. “They also unintentionally — clearly, but unintentionally — can have the effect of depriving marginalized populations of goods and services designed for them, and they can make it harder for Massachusetts businesses to reach their own customers than it is for those Massachusetts business to reach customers, again, in New Hampshire, Connecticut and Rhode Island.”
Kingman faced questions from Reps. Joan Meschino and Tommy Vitolo about which companies he represents and the apparent harm of Massachusetts taking a data privacy approach that differs from other states.
“So I push back strongly on the idea that you and your colleagues are incapable of reading MGL (Massachusetts General Laws) and understanding what we expect in our commonwealth, and reading the laws of the great state of North Carolina and figuring out what they want. I believe in you,” Vitolo said. “I just wholeheartedly push back on this idea that we should have a single set of laws in this United States on issues that affect us personally and culturally. And it just might be that the great state of Massachusetts has a different idea on privacy than even my state that I was born and raised in, Connecticut.”
Committee co-chair Rep. Tricia Farley-Bouvier, who also filed a consumer data privacy bill (H 78), said the panel and Kingman will need to work together to iron out differences on data minimization standards. Kingman said Farley-Bouvier’s bill, as well as the proposal from Vargas and Rogers, raises questions over whether companies can offer product recommendations based on purchasing history or provide security updates on apps.
“We look forward to continuing the conversation, to be able to give specific feedback so that we can together reach our shared goals,” Farley-Bouvier said.
In his opening remarks, committee co-chair Sen. Michael Moore decried the increasing frequency of data breaches and how personal data has been “weaponized,” including to “undermine women’s health.”
“Congress should act to protect our residents, but we know they will not,” Moore said. “The Legislature must act to establish real data protections that address these issues and protect our constituents because it is clear that (the) status quo cannot and will not work.”
