Representative Steven S. Howitt supports data privacy protection bill

Will give consumers more control over the sharing of their personal information

Boston – Saying consumers have a fundamental right to privacy and should be able to decide how their personal data is being used and shared, State Representative Steven S. Howitt (R-Seekonk) recently supported a comprehensive data privacy protection bill.

House Bill 5472, An Act establishing the Massachusetts consumer data privacy act, was unanimously engrossed by the House of Representatives on a 146-0 vote on June 4. It will now be sent to the Senate, which passed its own version of the bill, Senate Bill 2619, on September 25, 2025, by a vote of 40-0.

Representative Howitt noted that House Bill 5472 would empower consumers by establishing a comprehensive statewide framework regulating the collection, processing, transfer, and sale of their personal data. In addition to imposing a ban on the sale of precise geolocation data, it would also require that consumers affirmatively consent to the selling or sharing of their personal information with third parties while implementing strong safeguards banning the sale of minors’ personal data and empowering parents to have any sensitive data on their child deleted.

Under the House bill, companies would be required to limit their data collection to what is reasonably necessary and proportionate for requested service. They would also need to maintain security safeguards and provide detailed privacy notices to consumers. Consumers would have the right to know exactly what data is being collected and would be able to request the deletion of their personal data.

According to Representative Howitt, the House bill defines a wide range of protected data categories and regulated activities. “Personal data” would include information linked or reasonably linkable to an identified or identifiable individual, while “sensitive data” would include information concerning details on an individual’s race, religion, health conditions, sexual orientation, immigration status, biometric data, neural data, genetic data, precise geolocation data and minors’ information.

The bill also creates specialized protections for reproductive-health data, gender-affirming health-care data and legally protected health-care activity data. There are some exemptions provided for in the bill, such as health information regulated under the federal Health Insurance Portability and Accountability Act (HIPAA), certain financial data regulated under federal law, employment-related data and specified nonprofit and governmental entities.

House Bill 5472 would apply to businesses that meet specified data-processing thresholds. According to Representative Howitt, this would include entities that process the personal data of at least 100,000 consumers and derive at least $100,000 in revenue from the sale of personal data or processing of sensitive data.

The Attorney General would be granted the authority to enforce the provision of House Bill 5472, violations of which would be considered unfair and deceptive acts under Chapter 93A of the Massachusetts General Laws. The legislation grants the Attorney General the authority to seek injunctive relief, restitution, damages, civil penalties and other remedies.