Massachusetts Consumer Privacy Law

Which privacy laws apply to your business in Massachusetts?

There is no comprehensive Massachusetts consumer-privacy law in force. What governs today is a prescriptive sectoral stack: c. 93H requires notice of a breach of security — the unauthorized acquisition or use of unencrypted personal information that creates a substantial risk of identity theft or fraud against a resident ; 201 CMR 17.00, the regulation issued under c. 93H, applies to all persons that own or license personal information about a Massachusetts resident and requires a written information security program ; c. 93I sets minimum standards for destroying records that contain personal information ; and c. 93A declares unfair or deceptive acts or practices in trade or commerce unlawful, supplying the enforcement backbone for all of it .

Massachusetts residents currently have no general state-law rights to access, delete, correct, or port their personal data, no right to opt out of its sale, and businesses face no state notice-at-collection, consent, or data-protection-assessment duties. That may change soon: the Massachusetts Consumer Data Privacy Act has passed both chambers in differing versions and, as of June 12, 2026, is before a conference committee — the next question covers exactly where it stands and what each version would require. Until a merged bill is enacted, none of its duties is law.

Two more Massachusetts statutes belong on the map. The wiretap act, c. 272, § 99 — an all-party-consent statute with a severe civil remedy — matters for chat widgets and other person-to-person communication capture, though the Supreme Judicial Court took ordinary browsing-activity tracking outside it in 2024; and c. 214, § 1B gives residents a general right against unreasonable, substantial or serious interference with privacy. Both are developed in the consumer-lawsuit question below.

The rest of a Massachusetts-facing program rides the federal overlay. Section 5 of the FTC Act reaches deceptive or unfair privacy practices nationwide ; the Gramm-Leach-Bliley Act bars a financial institution from disclosing nonpublic personal information to nonaffiliated third parties without the required consumer notice ; HIPAA gives individuals a right to notice of how a covered entity uses and discloses their protected health information ; and COPPA makes it unlawful for child-directed online services — or any operator with actual knowledge it is collecting a child's data — to collect children's personal information in violation of the FTC's rules . None of those is a Massachusetts statute, but together with the c. 93H stack they shape what a compliant program looks like today — and a program built to this stack upgrades rather than restarts if the pending comprehensive act becomes law.

Sources for this answer

Primary law

A.1 Mass. Gen. Laws ch. 93H, § 1

Chapter 93H defines a breach of security as the unauthorized acquisition or use of unencrypted data (or encrypted data plus the key) that compromises personal information and creates a substantial risk of identity theft or fraud against a Massachusetts resident.

''Breach of security'', the unauthorized acquisition or unauthorized use of unencrypted data or, encrypted electronic data and the confidential process or key that is capable of compromising the security, confidentiality, or integrity of personal information, maintained by a person or agency that creates a substantial risk of identity theft or fraud against a resident of the commonwealth.

See Mass. Gen. Laws ch. 93H, § 1(a).

Regulation

A.2 201 CMR 17.01(2)

201 CMR 17.00 applies to all persons that own or license personal information about a Massachusetts resident, with no revenue, size, or in-state-presence threshold.

201 CMR 17.00 applies to all persons that own or license personal information about a resident of the Commonwealth.

See 201 CMR 17.01(2).

Primary law

A.3 Mass. Gen. Laws ch. 93I, § 2

Chapter 93I sets minimum disposal standards: paper records containing personal information must be redacted, burned, pulverized, or shredded, and electronic media destroyed or erased, so the information cannot practicably be read or reconstructed.

When disposing of records, each agency or person shall meet the following minimum standards for proper disposal of records containing personal information: (a) paper documents containing personal information shall be either redacted, burned, pulverized or shredded so that personal data cannot practicably be read or reconstructed; (b) electronic media and other non-paper media containing personal information shall be destroyed or erased so that personal information cannot practicably be read or reconstructed.

See Mass. Gen. Laws ch. 93I, § 2.

Primary law

A.4 Mass. Gen. Laws ch. 93A, § 2

Chapter 93A declares unfair methods of competition and unfair or deceptive acts or practices in trade or commerce unlawful, supplying the enforcement backbone for Massachusetts privacy and data-security matters.

Unfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce are hereby declared unlawful.

See Mass. Gen. Laws ch. 93A, § 2(a).

Primary law

A.5 FTC Act § 5

Section 5 of the FTC Act declares unfair or deceptive acts or practices in or affecting commerce unlawful, which reaches privacy and data-security practices nationwide.

Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.

See 15 U.S.C. § 45(a)(1).

Primary law

A.6 GLBA — Disclosure of nonpublic personal information

The Gramm-Leach-Bliley Act prohibits a financial institution from disclosing nonpublic personal information to a nonaffiliated third party unless it has provided the consumer the required privacy notice.

Except as otherwise provided in this subchapter, a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 6803 of this title.

See 15 U.S.C. § 6802(a).

Primary law

A.7 HIPAA Notice of Privacy Practices

HIPAA gives individuals a right to adequate notice of a covered entity's uses and disclosures of their protected health information and of their rights and the entity's legal duties.

an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information

See 45 C.F.R. § 164.520(a)(1).

Primary law

A.8 COPPA — Collection of children's personal information

COPPA makes it unlawful for an operator of a child-directed website or online service, or any operator with actual knowledge it is collecting personal information from a child, to collect that information in violation of the FTC's implementing regulations.

It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b).

See 15 U.S.C. § 6502(a)(1).

Is Massachusetts about to adopt a comprehensive consumer privacy law?

Quite possibly, but it is not law yet. As of June 12, 2026, the Massachusetts Consumer Data Privacy Act is in conference-committee reconciliation: the Senate passed its version, S.2619, 40 to 0 on September 25, 2025; the House passed S.2619 as amended — substituting its own text, published as H.5479 — 146 to 0 on June 4, 2026; and on June 11, 2026 the Senate non-concurred in the House amendment, so a conference committee is forming (the Senate has named conferees; the House had not yet appointed its conferees as of this review). Both versions would insert a new chapter 93M giving consumers rights to access, correct, delete, and port their personal data and to opt out of targeted advertising, the sale of personal data, and profiling that feeds significant automated decisions . None of those duties applies today, and no effective date exists until a merged bill passes both chambers and is signed.

The two versions agree on the architecture — controller and processor duties, sensitive-data protections, data-protection assessments, recognition of an opt-out preference signal, and Attorney General enforcement through c. 93A — but they differ in both directions, and the differences are the conference agenda. Neither chamber's text is uniformly stricter.

Where the Senate text is stricter. The Senate version flatly bans the sale of sensitive data — its exemption section provides that a controller or processor who would otherwise be covered shall not sell sensitive data, so the ban follows entities even into the exemptions . Its data-minimization rule ties collection to what is reasonably necessary to provide or maintain a specific product or service the consumer requested , where the House rule ties collection to disclosed purposes consistent with the consumer's reasonable expectations . And its minors rule bars targeted advertising to, and sales of the data of, a consumer the controller knows or should have known is a minor — a constructive-knowledge standard — where the House requires actual knowledge or willful disregard .

Where the House text goes further. The House version adds a consent-proof ban on selling precise geolocation data collected or processed in the commonwealth, regardless of the individual's residency — consent cannot cure it — while allowing other sensitive data to be sold with the consumer's affirmative consent . Its applicability section is also broader: alongside a 100,000-consumer trigger and a revenue-from-sales trigger, it reaches any covered business that collected or processed sensitive data at all, with no consumer-count floor — compared with the Senate's thresholds of 60,000 consumers, or 20,000 consumers plus a sales-revenue share, or any handling of reproductive or sexual health data . And the House version opens a private right of action against the largest companies: a violation would constitute an unfair or deceptive trade practice under c. 93A, and the Attorney General's otherwise-exclusive enforcement authority carves out large data holders — controllers or processors handling the personal data of more than 2,000,000 consumers or the sensitive data of more than 200,000 consumers . The Senate version has no private action at all: the Attorney General would have exclusive authority across the board .

Practice caution

Do not build to either version yet, and do not rely on any circulating effective date — each engrossed text carries its own date, and the conference committee will pick the final one along with the final sensitive-data-sale rule, applicability thresholds, and private-right-of-action scope. What is safe to do now is gap-assess against the duties both versions share — data inventories, a rights-request intake channel, opt-out plumbing for targeted advertising and sales (including an opt-out preference signal), processor contracts, and data-protection assessments — because that common core appears in both engrossed texts .

Sources for this answer

Primary law · 2025-09-25

B.1 S.2619 — Massachusetts Data Privacy Act (Senate text, in conference)PDF

The Senate-engrossed MCDPA would give consumers the right to opt out of collection and processing for targeted advertising, the sale of personal data, and profiling in furtherance of solely automated decisions with legal or similarly significant effects.

opt out of the collection and processing of the consumer’s personal data for purposes of: (A) targeted advertising; (B) the sale of personal data; or (C) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.

See S.2619, 194th Gen. Court (Mass. 2025), proposed ch. 93M, § 4(a) (not enacted; in conference).

Primary law · 2026-06-04

B.2 H.5479 — House-passed text of S.2619 as amended (in conference)PDF

The House-passed MCDPA text would likewise give consumers an opt-out of targeted advertising, sales of personal data, and profiling in furtherance of solely automated decisions with significant effects.

opt out of the collection and processing of the consumer’s personal data for purposes of: (i) targeted advertising; (ii) the sale of personal data; or (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.

See H.5479, 194th Gen. Court (Mass. 2026), proposed ch. 93M, § 4(a) (not enacted; in conference).

Primary law · 2025-09-25

B.11 S.2619 — Massachusetts Data Privacy Act (Senate text, in conference)PDF

The Senate version would apply to persons that in the preceding calendar year processed personal data of at least 60,000 consumers (payment-only data excluded), or 20,000 consumers with at least 20 percent of revenue from data sales, or any reproductive or sexual health data.

This chapter shall apply to persons that during the preceding calendar year: (i) collected or processed the personal data of not less than 60,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; (ii) collected or processed the personal data of not less than 20,000 consumers and derived not less than 20 per cent of its gross revenue from the sale of personal data; or (iii) collected, processed or transferred reproductive or sexual health data of consumers.

See S.2619, 194th Gen. Court (Mass. 2025), proposed ch. 93M, § 2 (not enacted; in conference).

Primary law · 2026-06-04

B.10 H.5479 — House-passed text of S.2619 as amended (in conference)PDF

The House version's applicability triggers would be 100,000 consumers' personal data, or $100,000 in revenue from data sales, or — with no consumer-count floor — any collection or processing of sensitive data.

This chapter shall apply to persons that conduct business in the commonwealth and produce products or provide services that are targeted to residents of the commonwealth and that, during the preceding calendar year: (i) collected or processed the personal data of not less than 100,000 consumers; provided, however, that said personal data shall not include personal data controlled or processed solely for the purpose of completing a payment transaction; (ii) derived gross revenue of not less than $100,000 from the sale of personal data; or (iii) collected or processed sensitive data; provided, however, that sensitive data shall not include personal data controlled or processed solely for the purpose of completing a payment transaction.

See H.5479, 194th Gen. Court (Mass. 2026), proposed ch. 93M, § 2 (not enacted; in conference).

Primary law · 2025-09-25

B.3 S.2619 — Massachusetts Data Privacy Act (Senate text, in conference)PDF

The Senate version would flatly ban the sale of sensitive data, and the ban would reach controllers and processors even when they otherwise fall within the chapter's exemptions.

Notwithstanding this subsection, a controller or processor who would otherwise be subject to this chapter under section 2 shall not sell sensitive data.

See S.2619, 194th Gen. Court (Mass. 2025), proposed ch. 93M, § 3(a) (not enacted; in conference).

Primary law · 2026-06-04

B.8 H.5479 — House-passed text of S.2619 as amended (in conference)PDF

The House version would ban selling precise geolocation data collected or processed in the commonwealth regardless of the individual's residency, and affirmative consent could not cure the ban.

sell: (A) precise geolocation data of any individual or consumer collected or processed within the commonwealth, regardless of the residency of the individual or consumer; provided, that precise geolocation data shall not be sold even with the affirmative consent of an individual or consumer

See H.5479, 194th Gen. Court (Mass. 2026), proposed ch. 93M, § 7(a) (not enacted; in conference).

Primary law · 2025-09-25

B.4 S.2619 — Massachusetts Data Privacy Act (Senate text, in conference)PDF

The Senate version's data-minimization rule would limit collection to what is reasonably necessary to provide or maintain a specific product or service the consumer requested.

limit the collection of personal data to what is reasonably necessary to provide or maintain a specific product or service requested by the consumer to whom the data pertains

See S.2619, 194th Gen. Court (Mass. 2025), proposed ch. 93M, § 5(a) (not enacted; in conference).

Primary law · 2026-06-04

B.5 H.5479 — House-passed text of S.2619 as amended (in conference)PDF

The House version's data-minimization rule would limit collection to what is reasonably necessary and proportionate to the purposes disclosed to the consumer.

limit the collection of personal data to what is reasonably necessary and proportionate in relation to the purposes for which the personal data is collected or processed, as disclosed to the consumer; provided, that such purposes shall be consistent with the reasonable expectations of the consumer

See H.5479, 194th Gen. Court (Mass. 2026), proposed ch. 93M, § 6 (not enacted; in conference).

Primary law · 2025-09-25

B.6 S.2619 — Massachusetts Data Privacy Act (Senate text, in conference)PDF

The Senate version would bar targeted advertising to, and sale of the personal data of, a consumer the controller knows or should have known is a minor — a constructive-knowledge standard.

not collect or process the personal data of a consumer for purposes of targeted advertising or sell the consumer’s personal data under circumstances where a controller knows or should have known that the consumer is a minor

See S.2619, 194th Gen. Court (Mass. 2025), proposed ch. 93M, § 5(a) (not enacted; in conference).

Primary law · 2026-06-04

B.7 H.5479 — House-passed text of S.2619 as amended (in conference)PDF

The House version's minors rule would apply where the controller has actual knowledge of minor status or willfully disregards it — a narrower knowledge standard than the Senate's.

collect or process the personal data of a consumer for purposes of targeted advertising or sell the consumer’s personal data under circumstances where a controller has actual knowledge or willfully disregards that the consumer is a minor

See H.5479, 194th Gen. Court (Mass. 2026), proposed ch. 93M, § 7(a) (not enacted; in conference).

Primary law · 2026-06-04

B.12 H.5479 — House-passed text of S.2619 as amended (in conference)PDF

Under the House version, a violation would constitute an unfair or deceptive trade practice under chapter 93A, and the Attorney General's exclusive enforcement authority would except large data holders — leaving them exposed to private c. 93A actions.

A violation of this chapter shall constitute an unfair or deceptive trade practice for purposes of chapter 93A. (2) Notwithstanding sections 9 and 11 of chapter 93A, the attorney general shall have exclusive authority to bring a civil action against any controller or processor other than a large data holder that violates this chapter

See H.5479, 194th Gen. Court (Mass. 2026), proposed ch. 93M, § 14(a) (not enacted; in conference).

Primary law · 2026-06-04

B.13 H.5479 — House-passed text of S.2619 as amended (in conference)PDF

The House version would define a large data holder as a controller or processor that in the most recent calendar year handled the personal data of more than 2,000,000 consumers or the sensitive data of more than 200,000 consumers.

“Large data holder”, a controller or processor that in the most recent calendar year collected, processed or sold the: (i) personal data of more than 2,000,000 consumers; provided, however, that said personal data shall not include personal data collected and processed solely for the purpose of initiating, rendering, billing for, finalizing, completing or otherwise collecting payment for a requested product or service; or (ii) sensitive data of more than 200,000 consumers.

See H.5479, 194th Gen. Court (Mass. 2026), proposed ch. 93M, § 1 (not enacted; in conference).

Primary law · 2025-09-25

B.14 S.2619 — Massachusetts Data Privacy Act (Senate text, in conference)PDF

Under the Senate version, a violation would constitute an unfair or deceptive trade practice under chapter 93A, but the Attorney General would have exclusive authority to sue — no private right of action.

A violation of this chapter shall constitute an unfair or deceptive trade practice for purposes of chapter 93A. Notwithstanding sections 9 and 11 of said chapter 93A, the attorney general shall have exclusive authority to bring a civil action against a controller or processor that violates this chapter

See S.2619, 194th Gen. Court (Mass. 2025), proposed ch. 93M, § 10(b) (not enacted; in conference).

Does your business need a written information security program (WISP) in Massachusetts?

Yes, if you own or license personal information about even one Massachusetts resident. Under 201 CMR 17.00 — the regulation the Office of Consumer Affairs and Business Regulation adopted under c. 93H, § 2 — every such person must develop, implement, and maintain a comprehensive information security program, written in one or more readily accessible parts, with administrative, technical, and physical safeguards . Businesses that store or transmit the data electronically must also build a computer-system security layer that, to the extent technically feasible, covers authentication, access controls, monitoring, firewalls, patching, malware protection, and training — including encryption of personal information in transit over public networks or wireless connections and on laptops and portable devices .

Full compliance with 201 CMR 17.00 has been required since March 1, 2010 , and the regulation remains the center of a Massachusetts compliance program. The mandatory program elements go well beyond a policy document: designating one or more employees to run the program, a documented risk assessment that identifies and evaluates reasonably foreseeable internal and external risks across electronic and paper records , employee training and discipline, cutting off terminated employees' access, service-provider oversight (covered in the vendor question below), physical access restrictions, regular monitoring, and a review of the program at least annually or whenever a material business change implicates the security of records . The required safeguards scale with the size, scope, and type of business, available resources, and the amount of stored data — the rule is risk-calibrated, not one-size-fits-all .

The program's end-of-life duty comes from a separate statute: when records containing personal information are disposed of, c. 93I requires that paper be redacted, burned, pulverized, or shredded and that electronic media be destroyed or erased so the data cannot practicably be read or reconstructed, on pain of civil fines of up to $100 per data subject, capped at $50,000 per instance of improper disposal .

Practice caution

Keep the WISP current and provable, not just written. The breach-notification statute requires the regulator-facing breach notice to disclose whether the business maintains a written information security program — so a missing or stale WISP surfaces automatically in the worst possible moment. Re-run the risk assessment and document the annual review .

Sources for this answer

Primary law

C.1 Mass. Gen. Laws ch. 93H, § 2

Chapter 93H directs the Department of Consumer Affairs and Business Regulation to adopt safeguards regulations for any person that owns or licenses personal information about a Massachusetts resident — the statutory hook for 201 CMR 17.00.

The department of consumer affairs and business regulation shall adopt regulations relative to any person that owns or licenses personal information about a resident of the commonwealth. Such regulations shall be designed to safeguard the personal information of residents of the commonwealth and shall be consistent with the safeguards for protection of personal information set forth in the federal regulations by which the person is regulated.

See Mass. Gen. Laws ch. 93H, § 2(a).

Regulation

C.2 201 CMR 17.03(1)

Every person that owns or licenses personal information about a Massachusetts resident must develop, implement, and maintain a written comprehensive information security program with administrative, technical, and physical safeguards appropriate to the business's size, resources, data volume, and confidentiality needs.

develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to: (a) the size, scope and type of business of the person obligated to safeguard the personal information under such comprehensive information security program; (b) the amount of resources available to such person; (c) the amount of stored data; and (d) the need for security and confidentiality of both consumer and employee information.

See 201 CMR 17.03(1).

Regulation

C.3 201 CMR 17.04

A business that electronically stores or transmits Massachusetts residents' personal information must include in its WISP a computer security system with enumerated minimum elements, to the extent technically feasible.

Every person that owns or licenses personal information about a resident of the Commonwealth and electronically stores or transmits such information shall include in its written, comprehensive information security program the establishment and maintenance of a security system covering its computers, including any wireless system, that, at a minimum, and to the extent technically feasible, shall have the following elements:

See 201 CMR 17.04.

Regulation

C.4 201 CMR 17.04(3)

The computer-security requirements include encryption of personal information transmitted across public networks and of personal information transmitted wirelessly.

Encryption of all transmitted records and files containing personal information that will travel across public networks, and encryption of all data containing personal information to be transmitted wirelessly.

See 201 CMR 17.04(3).

Regulation

C.5 201 CMR 17.04(5)

The computer-security requirements include encryption of all personal information stored on laptops or other portable devices.

Encryption of all personal information stored on laptops or other portable devices

See 201 CMR 17.04(5).

Regulation

C.6 201 CMR 17.05

Every person that owns or licenses personal information about a Massachusetts resident has been required to be in full compliance with 201 CMR 17.00 since March 1, 2010.

Every person who owns or licenses personal information about a resident of the Commonwealth shall be in full compliance with 201 CMR 17.00 on or before March 1, 2010.

See 201 CMR 17.05(1).

Regulation

C.7 201 CMR 17.03(2)(b)

The WISP must include a risk assessment that identifies reasonably foreseeable internal and external risks across electronic and paper records and evaluates and improves the existing safeguards.

Identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper or other records containing personal information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks

See 201 CMR 17.03(2)(b).

Regulation

C.8 201 CMR 17.03(2)(i)

The WISP's scope must be reviewed at least annually, and whenever a material change in business practices may implicate the security or integrity of records containing personal information.

Reviewing the scope of the security measures at least annually or whenever there is a material change in business practices that may reasonably implicate the security or integrity of records containing personal information.

See 201 CMR 17.03(2)(i).

Primary law

C.9 Mass. Gen. Laws ch. 93I, § 2

Improper disposal of records containing personal information carries a civil fine of up to $100 per affected data subject, capped at $50,000 for each instance of improper disposal.

Any agency or person who violates the provisions of this chapter shall be subject to a civil fine of not more than $100 per data subject affected, provided said fine shall not exceed $50,000 for each instance of improper disposal.

See Mass. Gen. Laws ch. 93I, § 2.

Primary law

C.10 Mass. Gen. Laws ch. 93H, § 3

The breach notice to the Attorney General and the Director of Consumer Affairs and Business Regulation must state whether the business maintains a written information security program.

The notice to be provided to the attorney general and said director, and consumer reporting agencies or state agencies if any, shall include, but not be limited to: (i) the nature of the breach of security or unauthorized acquisition or use; (ii) the number of residents of the commonwealth affected by such incident at the time of notification; (iii) the name and address of the person or agency that experienced the breach of security; (iv) name and title of the person or agency reporting the breach of security, and their relationship to the person or agency that experienced the breach of security; (v) the type of person or agency reporting the breach of security; (vi) the person responsible for the breach of security, if known; (vii) the type of personal information compromised, including, but not limited to, social security number, driver's license number, financial account number, credit or debit card number or other data; (viii) whether the person or agency maintains a written information security program; and (ix) any steps the person or agency has taken or plans to take relating to the incident, including updating the written information security program.

See Mass. Gen. Laws ch. 93H, § 3(b).

What must your Massachusetts privacy policy contain?

No Massachusetts statute requires a general-audience commercial website to post a privacy policy or fixes its contents today. The enforceable rule is that whatever you publish must be true: a policy that misstates how you collect, use, share, or secure data is a deceptive practice under c. 93A, § 2 — which is construed in line with FTC interpretations — and under Section 5 of the FTC Act . Where a sectoral regime applies, that regime supplies the contents: a HIPAA covered entity, for example, must give individuals notice of the uses and disclosures of their protected health information and of their rights and the entity's duties .

This is the prong the pending Massachusetts Consumer Data Privacy Act would change most visibly. Both engrossed versions would mandate a consumer-facing privacy notice with prescribed contents. The Senate text requires a reasonably accessible, understandable, clear, meaningful and not misleading notice enumerating, among other items, the categories of personal data collected (with a separate list of sensitive-data categories), the purposes of processing, how consumers exercise and appeal rights, the categories of third parties receiving data, a privacy contact channel, a description of any targeted advertising, sales, or significant profiling with the opt-out procedure, and the notice's effective date . The House text requires a reasonably accessible, clear and not misleading notice with a similar enumeration that adds retention periods for each category of personal data, or the criteria used to determine them . Neither requirement is law while the bill sits in conference, so do not treat any circulating notice checklist as binding yet.

A practical drafting approach for today: build the policy from the federal and sectoral overlay where it applies (GLBA privacy notices, the HIPAA notice of privacy practices, a COPPA notice for child-directed services), describe actual practices accurately — categories collected, purposes, sharing, retention, choices — and then honor every statement, because consistency between the statement and the conduct is the obligation Massachusetts and federal regulators can already enforce . A policy drafted to the both-versions common core of the pending act will also need little surgery if the conference report becomes law.

Sources for this answer

Primary law

D.1 Mass. Gen. Laws ch. 93A, § 2

Chapter 93A makes unfair or deceptive acts or practices unlawful and directs courts to follow FTC and federal-court constructions of FTC Act § 5 — the basis for treating a misleading privacy policy as a deceptive practice.

It is the intent of the legislature that in construing paragraph (a) of this section in actions brought under sections four, nine and eleven, the courts will be guided by the interpretations given by the Federal Trade Commission and the Federal Courts to section 5(a)(1) of the Federal Trade Commission Act (15 U.S.C. 45(a)(1)), as from time to time amended.

See Mass. Gen. Laws ch. 93A, § 2(b).

Primary law

D.2 FTC Act § 5

Section 5 of the FTC Act declares unfair or deceptive acts or practices unlawful, which reaches a privacy policy that misstates a business's actual data practices.

Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.

See 15 U.S.C. § 45(a)(1).

Primary law

D.3 HIPAA Notice of Privacy Practices

A HIPAA covered entity must give individuals a notice describing the uses and disclosures of their protected health information and their rights and the entity's legal duties.

an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information

See 45 C.F.R. § 164.520.

Primary law · 2025-09-25

D.4 S.2619 — Massachusetts Data Privacy Act (Senate text, in conference)PDF

The Senate version would require controllers to provide consumers a reasonably accessible, understandable, clear, meaningful and not misleading privacy notice with enumerated contents.

A controller shall provide consumers with a reasonably accessible, understandable, clear, meaningful and not misleading privacy notice that includes: (i) the categories of personal data collected and processed by the controller, including a separate list of categories of sensitive data collected and processed by the controller, described in a level of detail that provides consumers with a meaningful understanding of the type of personal data collected or processed; (ii) the purpose for collecting and processing each category of personal data the controller collects or processes described in a way that gives consumers a meaningful understanding of how each category of their personal data will be used; (iii) how consumers may exercise their consumer rights, including how a consumer may appeal a controller’s decision with regard to the consumer’s request; (iv) the categories of personal data that the controller transfers to third parties, if any, and the purposes for those transfers; (v) the categories of third parties, if any, to which the controller transfers personal data; (vi) an active electronic mail address or other online mechanism that the consumer may use to contact the controller for privacy and data security inquiries; (vii) information identifying the controller, including any business name under which the controller registered with the secretary of the commonwealth and any assumed business name that the controller uses in the commonwealth; (viii) a clear and conspicuous description of any processing of personal data in which the controller engages for the purposes of targeted advertising, sale of personal data to third parties or profiling the consumer in furtherance of decisions that produce legal or similarly significant effects concerning the consumer and a procedure by which the consumer may opt out of this type of processing; (ix) a general description of the controller’s data security practices; and (x) the effective date of the privacy notice.

See S.2619, 194th Gen. Court (Mass. 2025), proposed ch. 93M, § 5(c) (not enacted; in conference).

Primary law · 2026-06-04

D.5 H.5479 — House-passed text of S.2619 as amended (in conference)PDF

The House version would require controllers to provide consumers a reasonably accessible, clear and not misleading privacy notice with enumerated contents.

A controller shall provide consumers with a reasonably accessible, clear and not misleading privacy notice that shall include: (i) the categories of personal data collected and processed by the controller, including a separate list of categories of sensitive data collected and processed by the controller, described in a level of detail that provides consumers with an understanding of the type of personal data collected or processed; (ii) the purpose for collecting and processing each category of personal data the controller collects or processes described in a way that gives consumers an understanding of how each category of their personal data will be used; (iii) how consumers may exercise their consumer rights, including how a consumer may appeal a controller’s decision with regard to the consumer’s request; (iv) the categories of personal data that the controller sells to third parties, if any, and the purposes for those sales; (v) the categories of third parties, if any, to which the controller sells personal data; (vi) the length of time the controller intends to retain each category of personal data, or, if it is not possible to identify the length of time, the criteria used to determine the length of time the controller intends to retain categories of personal data; and (vii) an active electronic mail address or other online mechanism that the consumer may use to contact the controller.

See H.5479, 194th Gen. Court (Mass. 2026), proposed ch. 93M, § 8(a) (not enacted; in conference).

What must your contracts with vendors say in Massachusetts?

Massachusetts already imposes a real vendor-contract duty — through the security regulation, not an omnibus privacy act. Under 201 CMR 17.03(2)(f), every business covered by the WISP rule must oversee its service providers by taking reasonable steps to select and retain providers capable of maintaining appropriate security measures , and by requiring those providers by contract to implement and maintain such measures for personal information . A service provider is any person permitted access to personal information through services provided directly to a covered business .

That security flow-down is narrower than the data-processing agreements comprehensive-statute states require — Massachusetts law today does not prescribe processing-instruction clauses, audit rights, deletion-or-return duties, or subprocessor controls. Sectoral regimes fill part of that gap: the GLBA Safeguards Rule requires financial institutions to oversee service providers by contract , and HIPAA requires a business-associate agreement before protected health information is shared .

The pending act would close the rest of the gap. Both engrossed MCDPA versions would require a written, binding controller-processor contract governing processing on the controller's behalf — the Senate text, for example, requires the contract to set out processing instructions, confidentiality protections, the nature, purpose, and duration of processing, and both parties' rights and obligations, with downstream duties for subcontractors, deletion or return of data, and compliance demonstrations . A prudent move now is to draft vendor terms to that fuller template — the 201 CMR 17.00 security clause is already mandatory, and the rest becomes mandatory if the conference report is enacted .

Sources for this answer

Regulation

E.1 201 CMR 17.03(2)(f)1.

A covered business must take reasonable steps to select and retain service providers capable of maintaining appropriate security measures for personal information.

Taking reasonable steps to select and retain third-party service providers that are capable of maintaining appropriate security measures to protect such personal information consistent with 201 CMR 17.00 and any applicable federal regulations

See 201 CMR 17.03(2)(f)1.

Regulation

E.2 201 CMR 17.03(2)(f)2.

A covered business must require its service providers by contract to implement and maintain appropriate security measures for personal information.

Requiring such third-party service providers by contract to implement and maintain such appropriate security measures for personal information

See 201 CMR 17.03(2)(f)2.

Regulation

E.3 201 CMR 17.02

A service provider is any person permitted access to personal information through its provision of services directly to a person subject to 201 CMR 17.00.

Service Provider, any person that receives, stores, maintains, processes, or otherwise is permitted access to personal information through its provision of services directly to a person that is subject to 201 CMR 17.00.

See 201 CMR 17.02.

Primary law

E.4 GLBA Safeguards Rule

The GLBA Safeguards Rule requires a financial institution to oversee its service providers, including by requiring them by contract to implement and maintain appropriate safeguards for customer information.

Requiring your service providers by contract to implement and maintain such safeguards

See 16 C.F.R. § 314.4.

Primary law

E.5 HIPAA Business Associate Contracts

HIPAA requires a written business-associate contract that establishes the permitted uses and disclosures of protected health information and binds the business associate to safeguard it.

A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity, except that: (A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section; and (B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity. (ii) Provide that the business associate will: (A) Not use or further disclose the information other than as permitted or required by the contract or as required by law; (B) Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract

See 45 C.F.R. § 164.504.

Primary law · 2025-09-25

E.6 S.2619 — Massachusetts Data Privacy Act (Senate text, in conference)PDF

The Senate version would require a written, binding contract to govern a processor's data processing on a controller's behalf — the data-processing-agreement mandate Massachusetts law currently lacks.

A contract between a controller and a processor shall govern the processor’s data processing procedures with respect to processing performed on behalf of the controller. The contract shall be in writing, binding and shall include, but not be limited to, clearly set forth instructions for processing data and protecting the confidentiality of the data, the nature and purpose of processing, the type of data subject to processing, the duration of processing and the rights and obligations of both parties including a method by which the processor shall notify the controller of material changes to its privacy practices. The processor shall adhere to the instructions of the controller and only process and transfer the data it receives from the controller to the extent necessary to provide a service requested by the controller, as set out in the contract. The contract shall also require that the processor: (i) ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data; (ii) at the controller’s direction, delete or return all personal data to the controller as requested, unless retention of the personal data is required by law; (iii) upon the reasonable request of the controller, make available to the controller all information in its possession necessary to demonstrate the processor’s compliance with the obligations in this chapter; (iv) after providing the controller an opportunity to object, engage any subcontractor pursuant to a written contract that requires the subcontractor to meet the contractual, statutory and regulatory obligations of the processor with respect to personal data

See S.2619, 194th Gen. Court (Mass. 2025), proposed ch. 93M, § 6(b) (not enacted; in conference).

When must you notify people of a data breach in Massachusetts?

As soon as practicable and without unreasonable delay — there is no fixed day-count. A business that owns or licenses data including a resident's personal information must notify the Attorney General, the Director of Consumer Affairs and Business Regulation, and the affected resident when it knows or has reason to know of a breach of security, or that personal information was acquired or used by an unauthorized person or for an unauthorized purpose . Notice cannot wait for a complete headcount: it may not be delayed on the ground that the total number of affected residents is not yet ascertained . Personal information means a resident's name combined with a Social Security number, driver's license or state ID number, or a financial-account or payment-card number that would permit account access .

Massachusetts inverts the consumer-notice rule most states follow. The notice to the resident must cover the right to obtain a police report, how to request a security freeze at no charge, and the mitigation services offered — but it must not describe the nature of the breach or the number of residents affected; those details go to the regulators instead . The regulator-facing notice has its own content list, including whether the business maintains a written information security program (see the WISP question above).

Two further duties round out the response plan. If the breach involves Social Security numbers, the business must contract with a third party to offer affected residents free credit monitoring for at least 18 months — at least 42 months if the breached business is a consumer reporting agency — and it may not condition that offer on the resident waiving the right to sue . Notice may be delayed only when law enforcement determines, in writing to the Attorney General, that it would impede a criminal investigation . A business that follows breach-response procedures under federal law is deemed compliant — but only if it still notifies the Massachusetts Attorney General and the Director of Consumer Affairs and Business Regulation without unreasonable delay .

Sources for this answer

Primary law

F.1 Mass. Gen. Laws ch. 93H, § 3

An owner or licensor of data including a resident's personal information must notify the Attorney General, the Director of Consumer Affairs and Business Regulation, and the resident as soon as practicable and without unreasonable delay after learning of a breach of security or unauthorized acquisition or use.

A person or agency that owns or licenses data that includes personal information about a resident of the commonwealth, shall provide notice, as soon as practicable and without unreasonable delay, when such person or agency (1) knows or has reason to know of a breach of security or (2) when the person or agency knows or has reason to know that the personal information of such resident was acquired or used by an unauthorized person or used for an unauthorized purpose, to the attorney general, the director of consumer affairs and business regulation and to such resident, in accordance with this chapter.

See Mass. Gen. Laws ch. 93H, § 3(b).

Primary law

F.2 Mass. Gen. Laws ch. 93H, § 3

Breach notice may not be delayed on the ground that the total number of affected residents is not yet ascertained — Massachusetts requires rolling, supplemental notification.

A notice provided pursuant to this section shall not be delayed on grounds that the total number of residents affected is not yet ascertained.

See Mass. Gen. Laws ch. 93H, § 3(b).

Primary law

F.3 Mass. Gen. Laws ch. 93H, § 1

Personal information under c. 93H is a resident's name combined with a Social Security number, driver's license or state ID number, or a financial-account or payment-card number permitting account access.

''Personal information'' a resident's first name and last name or first initial and last name in combination with any 1 or more of the following data elements that relate to such resident: (a) Social Security number; (b) driver's license number or state-issued identification card number; or (c) financial account number, or credit or debit card number, with or without any required security code, access code, personal identification number or password, that would permit access to a resident's financial account

See Mass. Gen. Laws ch. 93H, § 1(a).

Primary law

F.4 Mass. Gen. Laws ch. 93H, § 3

The consumer-facing notice must cover police-report rights, security freezes at no charge, and mitigation services — but must not include the nature of the breach or the number of residents affected.

The notice to be provided to the resident shall include, but shall not be limited to: (i) the resident's right to obtain a police report; (ii) how a resident may request a security freeze and the necessary information to be provided when requesting the security freeze; (iii) that there shall be no charge for a security freeze; and (iv) mitigation services to be provided pursuant to this chapter; provided, however, that said notice shall not include the nature of the breach of security or unauthorized acquisition or use, or the number of residents of the commonwealth affected by said breach of security or unauthorized access or use.

See Mass. Gen. Laws ch. 93H, § 3(b).

Primary law

F.5 Mass. Gen. Laws ch. 93H, § 3A

A breach involving Social Security numbers obligates the business to offer affected residents free credit monitoring for at least 18 months — at least 42 months when the breached entity is a consumer reporting agency.

the person shall contract with a third party to offer to each resident whose social security number was disclosed in the breach of security or is reasonably believed to have been disclosed in the breach of security, credit monitoring services at no cost to said resident for a period of not less than 18 months; provided, however, that if the person that has experienced a breach of security is a consumer reporting agency, then said consumer reporting agency shall contract with a third party to offer each resident whose social security number was disclosed in the breach of security or is reasonably believed to have been disclosed in the breach of security, credit monitoring services at no cost to such resident for a period of not less than 42 months

See Mass. Gen. Laws ch. 93H, § 3A(a).

Primary law

F.6 Mass. Gen. Laws ch. 93H, § 3A

A breached business may not condition the offer of credit monitoring on the resident waiving the right to a private action.

A person that experienced a breach of security shall not require a resident to waive the resident's right to a private right of action as a condition of the offer of credit monitoring services.

See Mass. Gen. Laws ch. 93H, § 3A(b).

Primary law

F.7 Mass. Gen. Laws ch. 93H, § 4

Breach notice may be delayed only when a law enforcement agency determines notice would impede a criminal investigation and notifies the Attorney General in writing.

notice may be delayed if a law enforcement agency determines that provision of such notice may impede a criminal investigation and has notified the attorney general, in writing, thereof and informs the person or agency of such determination.

See Mass. Gen. Laws ch. 93H, § 4.

Primary law

F.8 Mass. Gen. Laws ch. 93H, § 5

A business following federal breach-response procedures is deemed compliant with c. 93H only if it notifies affected residents under those procedures and still notifies the Massachusetts Attorney General and the Director of Consumer Affairs and Business Regulation without unreasonable delay.

a person who maintains procedures for responding to a breach of security pursuant to federal laws, rules, regulations, guidance, or guidelines, is deemed to be in compliance with this chapter if the person notifies affected Massachusetts residents in accordance with the maintained or required procedures when a breach occurs; provided further that the person also notifies the attorney general and the director of the office of consumer affairs and business regulation of the breach as soon as practicable and without unreasonable delay following the breach

See Mass. Gen. Laws ch. 93H, § 5.

Can a consumer sue your business in Massachusetts over privacy?

Not under the breach statute itself — c. 93H's enforcement section gives the Attorney General an action under c. 93A, § 4 and creates no private right . But Massachusetts consumers have a powerful general-purpose vehicle: c. 93A, § 9 lets a person injured by an unfair or deceptive practice sue after first mailing a written demand for relief at least thirty days before filing , and recover actual damages or $25, whichever is greater — doubled or trebled if the violation was willful or knowing or the response to the demand was made in bad faith — plus attorney's fees . Businesses suing other businesses use § 11, which requires that the conduct have occurred primarily and substantially within the commonwealth .

Data-breach and tracking suits in Massachusetts therefore typically ride c. 93A — deceptive privacy-policy statements or unfair data-security failures — where the plaintiff must still show injury and causation, and the 30-day demand letter is a precondition for most consumer suits . Alongside it sits the privacy statute, c. 214, § 1B, which gives a person a right against unreasonable, substantial or serious interference with privacy, enforceable in equity with damages .

The statute with the harshest remedy is the wiretap act, c. 272, § 99 — but after 2024 its online reach is narrower than the plaintiffs' bar once hoped. The act prohibits secretly hearing or recording the contents of any wire or oral communication unless all parties have authorized it , and it gives any aggrieved person a civil action with liquidated damages of $100 per day of violation or $1,000, whichever is higher, plus punitive damages and fees . In October 2024, the Supreme Judicial Court held in Vita v. New England Baptist Hospital that ordinary website browsing activity — URLs visited, clicks, scrolling shared with third-party analytics and advertising tools — is not the kind of person-to-person conversation or messaging the act unambiguously protects, resolving the ambiguity against coverage under the rule of lenity. Vita did not, however, bless capturing the contents of person-to-person communications: chat widgets, messaging features, and similar exchanges remain the live § 99 exposure, with that $100-per-day-or-$1,000 floor attached .

If the House MCDPA text prevails in conference, the largest companies would face one more private door: a chapter 93M violation would be an unfair or deceptive practice under c. 93A, and the Attorney General's exclusive-enforcement clause would except large data holders — so consumers could bring ordinary c. 93A actions, demand letter and all, against businesses at that scale . The Senate text would keep enforcement exclusively with the Attorney General. Neither version is law.

Practice caution

Treat chat widgets, support messaging, and any tool that records the contents of customer conversations as the highest-risk tracking surface in Massachusetts. Browsing-activity analytics fell out of the wiretap act in 2024, but the statute still prohibits secretly recording the contents of wire or oral communications without all-party authority , and its civil remedy carries a $1,000 minimum per aggrieved person plus punitive damages and fees . Obtain clear consent before any communication-content capture runs, and expect c. 93A § 9 demand letters as the routine opening move in tracking disputes .

Sources for this answer

Primary law

G.1 Mass. Gen. Laws ch. 93H, § 6

Chapter 93H's enforcement section authorizes the Attorney General to bring an action under c. 93A, § 4 to remedy violations; it creates no private right of action.

The attorney general may bring an action pursuant to section 4 of chapter 93A against a person or otherwise to remedy violations of this chapter and for other relief that may be appropriate.

See Mass. Gen. Laws ch. 93H, § 6.

Primary law

G.2 Mass. Gen. Laws ch. 93A, § 9

A consumer suing under c. 93A, § 9 must first mail or deliver a written demand for relief, identifying the claimant and describing the practice and injury, at least thirty days before filing.

At least thirty days prior to the filing of any such action, a written demand for relief, identifying the claimant and reasonably describing the unfair or deceptive act or practice relied upon and the injury suffered, shall be mailed or delivered to any prospective respondent.

See Mass. Gen. Laws ch. 93A, § 9(3).

Primary law

G.3 Mass. Gen. Laws ch. 93A, § 9

A prevailing § 9 plaintiff recovers actual damages or $25, whichever is greater, doubled or trebled for willful or knowing violations or a bad-faith refusal to grant relief on demand.

recovery shall be in the amount of actual damages or twenty-five dollars, whichever is greater; or up to three but not less than two times such amount if the court finds that the use or employment of the act or practice was a willful or knowing violation of said section two or that the refusal to grant relief upon demand was made in bad faith with knowledge or reason to know that the act or practice complained of violated said section two

See Mass. Gen. Laws ch. 93A, § 9(3).

Primary law

G.4 Mass. Gen. Laws ch. 93A, § 11

Business-to-business c. 93A claims under § 11 require that the unfair or deceptive conduct occurred primarily and substantially within Massachusetts.

No action shall be brought or maintained under this section unless the actions and transactions constituting the alleged unfair method of competition or the unfair or deceptive act or practice occurred primarily and substantially within the commonwealth.

See Mass. Gen. Laws ch. 93A, § 11.

Primary law

G.5 Mass. Gen. Laws ch. 214, § 1B

Massachusetts gives every person a statutory right against unreasonable, substantial or serious interference with privacy, enforceable in equity with damages.

A person shall have a right against unreasonable, substantial or serious interference with his privacy. The superior court shall have jurisdiction in equity to enforce such right and in connection therewith to award damages.

See Mass. Gen. Laws ch. 214, § 1B.

Primary law

G.6 Mass. Gen. Laws ch. 272, § 99

The wiretap act defines interception as secretly hearing or recording the contents of any wire or oral communication without prior authority from all parties — Massachusetts's all-party-consent rule.

The term ''interception'' means to secretly hear, secretly record, or aid another to secretly hear or secretly record the contents of any wire or oral communication through the use of any intercepting device by any person other than a person given prior authority by all parties to such communication

See Mass. Gen. Laws ch. 272, § 99(B)(4).

Primary law

G.7 Mass. Gen. Laws ch. 272, § 99

An aggrieved person whose communications are unlawfully intercepted has a civil action for actual damages with a liquidated floor of $100 per day of violation or $1,000, whichever is higher, plus punitive damages and attorney's fees.

Any aggrieved person whose oral or wire communications were intercepted, disclosed or used except as permitted or authorized by this section or whose personal or property interests or privacy were violated by means of an interception except as permitted or authorized by this section shall have a civil cause of action against any person who so intercepts, discloses or uses such communications or who so violates his personal, property or privacy interest, and shall be entitled to recover from any such person— 1. actual damages but not less than liquidated damages computed at the rate of $100 per day for each day of violation or $1000, whichever is higher; 2. punitive damages; and 3. a reasonable attorney's fee and other litigation disbursements reasonably incurred.

See Mass. Gen. Laws ch. 272, § 99(Q).

Primary law · 2026-06-04

G.8 H.5479 — House-passed text of S.2619 as amended (in conference)PDF

Under the House MCDPA text, a violation would be an unfair or deceptive trade practice under chapter 93A, and the Attorney General's exclusive-enforcement authority would except large data holders — opening a private c. 93A path against them if enacted.

A violation of this chapter shall constitute an unfair or deceptive trade practice for purposes of chapter 93A. (2) Notwithstanding sections 9 and 11 of chapter 93A, the attorney general shall have exclusive authority to bring a civil action against any controller or processor other than a large data holder that violates this chapter

See H.5479, 194th Gen. Court (Mass. 2026), proposed ch. 93M, § 14(a) (not enacted; in conference).

How is privacy law enforced in Massachusetts?

By the Attorney General, through c. 93A. The breach statute routes enforcement there expressly: under c. 93H, § 6, the Attorney General may bring an action pursuant to section 4 of chapter 93A, or otherwise, to remedy violations — a remedies pathway, not a declaration that every c. 93H violation is automatically an unfair or deceptive practice. Through § 4, a court may issue restraining orders and injunctions and order restoration of money or property to those who suffered ascertainable loss , and it may impose a civil penalty of up to $5,000 per violation, plus investigation and litigation costs, where the business knew or should have known the conduct violated § 2 . Improper data disposal carries its own fines under c. 93I — up to $100 per data subject, capped at $50,000 per instance — recoverable by the Attorney General .

In practice the Attorney General's office actively enforces this stack — c. 93H notification duties, 201 CMR 17.00 program duties, and c. 93A unfairness theories — in data-security matters, so the framework above is a live enforcement risk rather than a paper one.

One nuance worth getting right: because § 6 routes the Attorney General to c. 93A § 4 remedies rather than declaring a c. 93H violation a per se unfair or deceptive act, whether a consumer can build a private § 9 claim on a bare breach-notification violation is not settled by the statutory text — injury and causation do the work in private breach suits . Both pending MCDPA versions, by contrast, contain an express bridge: a violation of the new chapter would constitute an unfair or deceptive trade practice for purposes of chapter 93A, with the Attorney General's authority exclusive across the board in the Senate text — which would also authorize civil penalties of up to $5,000 per violation — and exclusive except as to large data holders in the House text . The Senate text would also require a pre-suit notice of violation with a 60-day cure window before the Attorney General files, unless cure is impossible or immediate enforcement is required ; the House text has no cure provision — another item on the conference table.

Sources for this answer

Primary law

H.1 Mass. Gen. Laws ch. 93H, § 6

Chapter 93H's enforcement section sends the Attorney General to c. 93A, § 4 for remedies against violators — a routing provision, not an express per se unfair-practice declaration.

The attorney general may bring an action pursuant to section 4 of chapter 93A against a person or otherwise to remedy violations of this chapter and for other relief that may be appropriate.

See Mass. Gen. Laws ch. 93H, § 6.

Primary law

H.2 Mass. Gen. Laws ch. 93A, § 4

In an Attorney General action under c. 93A, § 4, the court may issue restraining orders and injunctions and order restoration of money or property acquired through the unlawful practice.

Said court may issue temporary restraining orders or preliminary or permanent injunctions and make such other orders or judgments as may be necessary to restore to any person who has suffered any ascertainable loss by reason of the use or employment of such unlawful method, act or practice any moneys or property, real or personal, which may have been acquired by means of such method, act, or practice.

See Mass. Gen. Laws ch. 93A, § 4.

Primary law

H.3 Mass. Gen. Laws ch. 93A, § 4

Where a person knew or should have known the practice violated c. 93A, § 2, the court may impose a civil penalty of up to $5,000 per violation plus the reasonable costs of investigation and litigation, including attorney's fees.

If the court finds that a person has employed any method, act or practice which he knew or should have known to be in violation of said section two, the court may require such person to pay to the commonwealth a civil penalty of not more than five thousand dollars for each such violation and also may require the said person to pay the reasonable costs of investigation and litigation of such violation, including reasonable attorneys' fees.

See Mass. Gen. Laws ch. 93A, § 4.

Primary law

H.4 Mass. Gen. Laws ch. 93I, § 2

Improper disposal of records containing personal information is punishable by a civil fine of up to $100 per data subject, capped at $50,000 per instance, recoverable by the Attorney General.

Any agency or person who violates the provisions of this chapter shall be subject to a civil fine of not more than $100 per data subject affected, provided said fine shall not exceed $50,000 for each instance of improper disposal. The attorney general may file a civil action in the superior or district court in the name of the commonwealth to recover such penalties.

See Mass. Gen. Laws ch. 93I, § 2.

Primary law · 2025-09-25

H.5 S.2619 — Massachusetts Data Privacy Act (Senate text, in conference)PDF

The Senate version would make a violation an unfair or deceptive trade practice under chapter 93A and give the Attorney General exclusive authority to bring civil actions — no private right of action.

A violation of this chapter shall constitute an unfair or deceptive trade practice for purposes of chapter 93A. Notwithstanding sections 9 and 11 of said chapter 93A, the attorney general shall have exclusive authority to bring a civil action against a controller or processor that violates this chapter

See S.2619, 194th Gen. Court (Mass. 2025), proposed ch. 93M, § 10(b) (not enacted; in conference).

Primary law · 2025-09-25

H.6 S.2619 — Massachusetts Data Privacy Act (Senate text, in conference)PDF

The Senate version would authorize the Attorney General to seek civil penalties of up to $5,000 per violation in its enforcement actions.

impose civil penalties in an amount not more than $5,000 per violation

See S.2619, 194th Gen. Court (Mass. 2025), proposed ch. 93M, § 10(b)(iv) (not enacted; in conference).

Primary law · 2025-09-25

H.8 S.2619 — Massachusetts Data Privacy Act (Senate text, in conference)PDF

The Senate version would require the Attorney General to issue a pre-suit notice of violation and allow a 60-day cure period before filing, unless cure is impossible or immediate enforcement is required.

Prior to initiating any action for a violation of any provision of this chapter, the attorney general shall issue a notice of violation to the controller unless the attorney general determines that a cure is not possible or an alleged violation requires immediate enforcement. If the controller fails to cure such violation not more than 60 days after receipt of the notice of violation, the attorney general may bring an action pursuant to this section.

See S.2619, 194th Gen. Court (Mass. 2025), proposed ch. 93M, § 10(d) (not enacted; in conference).

Primary law · 2026-06-04

H.7 H.5479 — House-passed text of S.2619 as amended (in conference)PDF

The House version would give the Attorney General exclusive authority to sue any controller or processor other than a large data holder — the carve-out that creates its limited private right of action.

Notwithstanding sections 9 and 11 of chapter 93A, the attorney general shall have exclusive authority to bring a civil action against any controller or processor other than a large data holder that violates this chapter

See H.5479, 194th Gen. Court (Mass. 2026), proposed ch. 93M, § 14(a) (not enacted; in conference).