October 15, 2026
A BILL ESTABLISHING statewide consumer data privacy protections is currently in conference committee in the Massachusetts Legislature. Arguably the most impactful difference between the House and Senate bills, which must be reconciled if the bill is to survive, asks, who will be allowed to enforce the law, if passed?
According to the Senate version, only the attorney general should have this power, while the House believes that large data holders should also be subject to private lawsuits. Regular people’s ability to sue businesses for the alleged violation of a law is called private right of action, and it is a necessary inclusion if the future Massachusetts data privacy law is to truly protect citizens’ rights, safety, and privacy.
The business of selling private data is large and extremely lucrative. In 2025 alone, the majority of Meta’s $201 billion in revenue came from surveillance advertising, a process by which profiles revealing our demographic characteristics, health, and even our locations are auctioned to thousands of advertisers and data brokers. Evidence shows that this process can be used for much more than advertising. Individuals’ personal information and identities are often exposed and sold to bad actors. Similarly, access to people’s biometric data can be sold to government and private entities alike, helping them to track people without their knowledge or consent.
In Massachusetts, the Senate bill proposes a total ban on the sale of all sensitive data. The House bill would allow the sale of sensitive data, excluding precise geolocation data, with consumer consent. Thus, by clicking “agree,” your demographic, health, and biometric data could be for sale.
This is particularly harmful for vulnerable populations such as immigrants, Black and brown communities, and those seeking reproductive health care. For example, companies have made a business of selling location and biometric data that allows government and private entities to track people at protests, places of worship, and clinics. Demographic data has also been used to enable discriminatory practices in areas such as housing on the basis of race, sex, and disability status. With the business of selling consumer data being this profitable, far-reaching, and covert, how can we ensure that companies selling this data follow new privacy rules?
The answer lies in private right of action, allowing private citizens to take action against companies that have caused them harm in violation of a law. Private lawsuits introduce a much more effective means of holding companies accountable for violating the law. The alternative, which is outlined by the Senate bill, would leave enforcement up to the attorney general’s office, which has limitations. The attorney general does not have the resources to enforce every case in which there is a privacy violation. This fact was emphasized by California Attorney General Xavier Becerra in support of including a private right of action in California’s data privacy act.
Private right of action can be wrongfully weaponized, as seen by its use in the Texas Heartbeat Act to incentivize private citizens to enforce abortion bans. However, when used correctly, the ability of the public to advocate for itself against abuses by more powerful entities is a hallmark of democratic society. And giving citizens the right to challenge corporations directly has led to improvements in citizens’ safety and privacy across the country.
In Massachusetts, among its involvement in various laws protecting residents, private right of action plays a key role in enforcing a law against wiretapping without consent or a court order.
In Illinois, it allowed citizens to raise pivotal lawsuits against Facebook and Clearview AI, effecting improvements in data privacy not just across the state, but across the country. Both companies were in violation of the Illinois Biometric Information Privacy Act (BIPA) due to their use of facial recognition technology to create large databases of people’s faces and identities.
Particularly insidiously, Clearview added to its database of 3 billion faces using images available online without the consent of those pictured and provided its incredibly accurate facial recognition platform to law enforcement agencies, private companies, and individuals, enabling widespread, secret surveillance. Through the private right of action included in the Illinois law, the ACLU, alongside groups representing immigrants, survivors of sexual assault, and others most harmed by data privacy violations, filed a lawsuit against Clearview.
In both the case against Facebook and Clearview AI, the people won. Alongside other stipulations, Clearview AI was banned from giving private entities access to its facial recognition database nationwide, and Facebook chose to shut down its facial recognition system altogether.
While the Massachusetts consumer data privacy bill is in conference committee, big technology companies will likely be lobbying for changes that severely limit the bill’s reach or stop it from passing altogether. In fact, this bill is just one in a series of data privacy bills proposed and subsequently killed in Massachusetts.
The creation of effective data privacy laws remains increasingly important in the face of AI surveillance, expensive cybercrime, and the increased abuse of sensitive information to support authoritarian practices. In order to truly safeguard the population’s privacy, safety, and civil liberties, the Massachusetts Legislature must not only pass this data privacy bill, but include in it the public’s private right of action.
Maler Suresh is a recent Tufts University graduate who worked with the Center for State Policy Analysis at Tufts, where she researched Massachusetts policy questions.
Courtesy of Commonwealth Beacon
