6 ms·

Massachusetts bans sale of precise location data in new privacy rights bill

369 points by 01-_- 5mo ago

mc32 5mo ago
This is good and all States should adopt some. Eventually I’d like to see one at the federal level that supersedes state level ones so that we don’t have to deal the the mess that is taxation across 50 states. A nice uniform privacy bill at the Fed level would be nice.
- yndoendo 5mo ago
  This seems more symbolic since I don't see were the law has any teeth. There is no fine nor imprisonment for failing to follow the law.
- kmeisthax 5mo ago
  No, we specifically DO NOT want uniformity. We want a minimum that states can go beyond. In the current environment, tech companies have to bribe 50 states plus the federal legislature in order to block privacy bills. If you have federal preemption, then you just have to bribe Congress, because states can't pass ANY privacy laws whatsoever. And we already know the feds do not want a privacy law: the entire legality of the federal surveillance apparatus hinges on the fact that buying your data from third parties does not trip constitutional scrutiny. Preemption freezes the requirements in time so they will always be a few steps behind the TLAs[0]. The ideal is that every sovereign entity passes their own privacy law that applies to their territory, with a private right of action, and adtech companies are forced to adopt a "50 states legal" posture. This is, deliberately, a ratchet: it's easy for any state to require a higher standard but hard to get every state to reduce it, so privacy laws cannot be walked back in secret. [0] Three Letter Agencies: CIA, FBI, NSA
  - mindslight 5mo ago
    > The ideal is that every sovereign entity passes their own privacy law that applies to their territory, with a private right of action, and adtech companies are forced to adopt a "50 states legal" posture. This is, deliberately, a ratchet: it's easy for any state to require a higher standard but hard to get every state to reduce it, so privacy laws cannot be walked back in secret. You put this so well it kind of dislodged where I was coming from on my other comment you had responded to. I don't want to be disheartened and cynical. It's just hard to have seen this privacy issue openly festering for over two decades now, and think that things are ever going to change. I think a private right of action with a two year delay would be great. And perhaps county DA's should be able to bring actions as well as the AG (legal policy adjacent actions aren't really in their wheelhouse, but it could help nudge the AG into action). I think the time period is a balance between giving the AG enough time to act (or be pressured into action), versus not making it too long so that illegal businesses can simply lobby to neuter the whole law before it actually goes into effect.
ldoughty 5mo ago
Will this have reach and teeth though? I can imagine loopholes to this... nothing stops facebook/google from buying this data from companies not in Massachusetts? and facebook/google don't have to give advertisers the location information but can still use that information when determining the advertisement to return, right? In theory the big silicon valley "targets" of this bill don't actually have a huge incentive to give this data away, do they? They just need to be able to read/access it, which I don't think this law stops? Assuming the data broker is not doing business in Massachusetts itself
- fultonn 5mo ago
  > Will this have reach and teeth though? It'll have reach because MA has a long-arm statute and there's a rich history of applying that statute in the context of Chapter 93. It'll have teeth but probably not to the effect that you hope. This statute was written such that only the Attorney General can bring action; see Section 10(b). This diverges from a long history in the Commonwealth of allowing private individuals to bring civil suits for most types of Chapter 93 violations. As a result, I anticipate that the most impactful change will be in the quantity and frequency of political donations to Mass AG candidates (and in the case of contested primaries their aligned block of candidates up and down ticket). Consumer protection laws should always provide for a private cause of action. Otherwise they just function as a mechanism for legalized corruption.
  - mindslight 5mo ago
    I don't disagree with the thrust of your criticism of the dynamic (especially long term). But there is a legitimate concern that the first test cases to hit the courts need to be quite unsympathetic egregious violators rather than surveillance dynamics that have been thoroughly normalized for decades. If people start bringing private suits against neighbors that have deployed Amazon surveillance cameras, "credit bureaus", private investigators, big tech surveillance companies directly (eg Google, and especially with weak legal arguments), it is likely to set some poor precedents and create political pushback.
    - 5mo ago
josefritzishere 5mo ago
This is very exciting.
like_any_other 5mo ago
A good first step, but the harm is already done when the data is gathered. Stalking should be illegal even if you don't sell the information you gathered, I don't want Toyota or GM or Google knowing where I've been either, not just their "partners", and it's long past the time the EULA loophole was closed. Contracts exist to serve society, not the other way around.
john_strinlai 5mo ago
still waiting for any of the many existing privacy bills, worldwide, to start doing meaningful enforcement.
- Cider9986 5mo ago
  We need private right of action. That's the big thing holding up the sweeping Mass privacy law. The house supports a private right to action and the senate only wants the attorney general enforcing the law.
  - throwaway85825 5mo ago
    California already has a million toothless laws. Anything without a private right of action may as well not exist.
  - analog31 5mo ago
    Indeed, and I think possession of the information should be what's actionable.
  - mindslight 5mo ago
    Do you have any links that elaborate on this? I haven't been following the Mass privacy law, but if this is true it seems like now is the time to pressure the state senate into adopting the private right of action.
    - Cider9986 5mo ago
      Here (https://epic.org/press-release-massachusetts-house-stands-up-for-privacy-rights-passes-massachusetts-consumer-data-privacy-act/ https://epic.org/press-release-massachusetts-house-stands-up...)
      - mindslight 5mo ago
        Thank you. I had seen that while digging, but I was hoping for some kind of direct comparison, description of where the law is in the process, call to action page, etc. But regardless, your comment prompted me to look at the details myself, see what you were saying is true, and just call my [state] senator to express support for a private right of action as they reconcile the two versions. I'm hopeful that with both versions being passed unanimously, and the more recent one having the private right of action, that it has the momentum.
post_break 5mo ago
Does this include vehicle data? That's a big one. Your new car selling you out constantly.
- stronglikedan 5mo ago
  I've been driving connected cars for a decade and I haven't felt sold out yet. What am I missing?
  - criddell 5mo ago
    I bought a car earlier this year and it took about a week before I started getting car warranty junk mail for the new car.
    - cogogo 5mo ago
      I always thought that is from companies that get their hands on registration data. Or I could be wrong and it is the dealer itself selling it on not the manufacturer.
      - Loughla 5mo ago
        Pretty sure it's registration data. Anything public is now used for junk. We transferred a piece of property this year and have been getting constant spam for realtors to sell it for us. We bought a used car from an individual and started getting spam for warranties once we registered it and got plates.
        mindslight 5mo ago
        Just to be clear: real estate is generally public records viewable by anybody, while vehicle titles/registrations generally aren't (without having been deliberately sold by the state).
  - chaps 5mo ago
    Are you asking for articles that show how connected car data is being sold left and right?
danesparza 5mo ago
Feels like the word 'sale' may actually turn into a loophole. It should have probably been worded to use 'exchange' or 'transfer' instead. But this is progress.
- Cider9986 5mo ago
  Yeah, we need data minimization. As long as it's collected it is a liability for consumers, turn it into a liability for businesses to incentive them to collect as little as possible.
- bobro 5mo ago
  https://malegislature.gov/Bills/194/S2619/BillHistory https://malegislature.gov/Bills/194/S2619/BillHistory SECTION 1. The General Laws are hereby amended by inserting after chapter 93L the following chapter:- Chapter 93M. Massachusetts Data Privacy Act Section 1. As used in this chapter, the following words shall have the following meanings unless the context otherwise requires: ... “Sale of personal data”, the transfer of personal data in exchange for monetary or other valuable consideration by the controller to a third party; provided, however, that “sale of personal data” shall not include: (i) the disclosure of personal data to a processor that processes the personal data on behalf of the controller if limited to the purposes of the processing; (ii) the disclosure of personal data to a third party for purposes of providing a product or service affirmatively requested by the consumer; (iii) the disclosure or transfer of personal data to an affiliate of the controller; (iv) the disclosure of personal data with the consumer’s affirmative consent, where the consumer affirmatively directs the controller to disclose the personal data or intentionally uses the controller to interact with a third party; (v) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy or other transaction or a proposed merger, acquisition, bankruptcy or other transaction, in which the third party assumes control of all or part of the controller’s assets; or (vi) the disclosure of personal data that the consumer: (A) intentionally made available to the general public via a channel of mass media; and (B) did not restrict to a specific audience.
jboggan 5mo ago
California very quietly passed AB-1542 last week which includes precise location data, health data, SSNs, etc. I expect many states to follow suit. Related, General Motors got hit with a $12.75M fine for reselling OnStar location data last month: https://ccpa.world/enforcement/gm-onstar-smart-driver https://ccpa.world/enforcement/gm-onstar-smart-driver
- yencabulator 5mo ago
  > I expect many states to follow suit. More importantly, many companies will follow California rules even outside California. My car was built to California emissions spec at a time when very few states had stricter rules. (The one major exception seems to be the "sell my data" opt-out and such privacy rules, that industry is sleazy enough that they'll go through extra trouble to keep screwing over non-CA residents.)
  - jboggan 5mo ago
    Well, CT and VT passed their own version of the California DROP system last week and there are 5 other states in play for the current 2026 legislative sessions. I think it will be a slow patchwork for more states to take similar action, but it is coming. I will note that many "data brokers" will just honor non-California residents' requests as if they were California residents and subject to the CCPA, simply because they would rather remove a potentially litigious consumer from their databases. Given the relatively low potential revenue for a single consumer's data it just doesn't make sense to hold on to information for the kind of person who currently goes out of their way to make that kind of request. At the same time, many data brokers do go out of their way to deny as many privacy requests as possible. Given that the CPPA/CalPrivacy is starting audits very soon I don't see this as a winning strategy for them in the long run.
  - themafia 5mo ago
    Watching "The Price is Right" made California a mythical place for me as a child in the Midwest. All the cars being given away, they were sure to mention, followed "California emissions standards!" No surprise. I ended up moving here.
Cider9986 5mo ago
this is the bill we need to pass in the house instead of them trying to age-(identity)gate social media. (https://epic.org/press-release-massachusetts-senate-unanimously-passes-strong-privacy-bill/ https://epic.org/press-release-massachusetts-senate-unanimou...)
throwaway85825 5mo ago
Only data that does not exist cannot be misused.
- themafia 5mo ago
  A moment of high drama in the courtroom: "Did you notice anything odd about the defendants vehicle?" "Yes." "What was that?" "He had disabled his GPS and telemetry systems."
timeninja 5mo ago
Massachusetts allows the use of Cellebrite software. In which case "precise location data" is moot.
- hoppyhoppy2 5mo ago
  Sure, if the cops seize your phone from you and try to suck out its data, then they clearly already know your precise location. But in some situations you would've been able to avoid getting your phone sucked out by the cops if they hadn't been able to purchase precise location data about where you were in the hours/days/weeks leading up to that.
- ezfe 5mo ago
  What is your point here? That's not what this law is about.
loeg 5mo ago
Does this criminalize Strava?
- markerz 5mo ago
  If Strava is sharing or reselling users GPS locations to third parties without user consent, yes.
- ezfe 5mo ago
  Why would it?
nxy 5mo ago
Thank god if this is true! If not and this is just a "coverup".. Wouldn't be the first time.
deleted 5mo ago
[deleted]
m463 5mo ago
later in the article it said not only selling, but sharing. important because "sharing" is much more prevalent than "selling" data. that said, I wonder how "precise location", and statistics/algorithms will combine? for example, what if someone moves from zipcode 1 to zipcode 2? would that work out to a more precise position?
testytestyroo 5mo ago
What prevents law enforcement from collecting this data/other signals and anonymizing it and then running models against it? Are there any laws against this?
cmxch 5mo ago
Criminals rejoice.

369 points by 01-_- 5mo ago

mc32 5mo ago

This is good and all States should adopt some. Eventually I’d like to see one at the federal level that supersedes state level ones so that we don’t have to deal the the mess that is taxation across 50 states. A nice uniform privacy bill at the Fed level would be nice.

yndoendo 5mo ago
This seems more symbolic since I don't see were the law has any teeth. There is no fine nor imprisonment for failing to follow the law.
kmeisthax 5mo ago
No, we specifically DO NOT want uniformity. We want a minimum that states can go beyond. In the current environment, tech companies have to bribe 50 states plus the federal legislature in order to block privacy bills. If you have federal preemption, then you just have to bribe Congress, because states can't pass ANY privacy laws whatsoever. And we already know the feds do not want a privacy law: the entire legality of the federal surveillance apparatus hinges on the fact that buying your data from third parties does not trip constitutional scrutiny. Preemption freezes the requirements in time so they will always be a few steps behind the TLAs[0]. The ideal is that every sovereign entity passes their own privacy law that applies to their territory, with a private right of action, and adtech companies are forced to adopt a "50 states legal" posture. This is, deliberately, a ratchet: it's easy for any state to require a higher standard but hard to get every state to reduce it, so privacy laws cannot be walked back in secret. [0] Three Letter Agencies: CIA, FBI, NSA
- mindslight 5mo ago
  > The ideal is that every sovereign entity passes their own privacy law that applies to their territory, with a private right of action, and adtech companies are forced to adopt a "50 states legal" posture. This is, deliberately, a ratchet: it's easy for any state to require a higher standard but hard to get every state to reduce it, so privacy laws cannot be walked back in secret. You put this so well it kind of dislodged where I was coming from on my other comment you had responded to. I don't want to be disheartened and cynical. It's just hard to have seen this privacy issue openly festering for over two decades now, and think that things are ever going to change. I think a private right of action with a two year delay would be great. And perhaps county DA's should be able to bring actions as well as the AG (legal policy adjacent actions aren't really in their wheelhouse, but it could help nudge the AG into action). I think the time period is a balance between giving the AG enough time to act (or be pressured into action), versus not making it too long so that illegal businesses can simply lobby to neuter the whole law before it actually goes into effect.

ldoughty 5mo ago

Will this have reach and teeth though? I can imagine loopholes to this... nothing stops facebook/google from buying this data from companies not in Massachusetts? and facebook/google don't have to give advertisers the location information but can still use that information when determining the advertisement to return, right? In theory the big silicon valley "targets" of this bill don't actually have a huge incentive to give this data away, do they? They just need to be able to read/access it, which I don't think this law stops? Assuming the data broker is not doing business in Massachusetts itself

fultonn 5mo ago
> Will this have reach and teeth though? It'll have reach because MA has a long-arm statute and there's a rich history of applying that statute in the context of Chapter 93. It'll have teeth but probably not to the effect that you hope. This statute was written such that only the Attorney General can bring action; see Section 10(b). This diverges from a long history in the Commonwealth of allowing private individuals to bring civil suits for most types of Chapter 93 violations. As a result, I anticipate that the most impactful change will be in the quantity and frequency of political donations to Mass AG candidates (and in the case of contested primaries their aligned block of candidates up and down ticket). Consumer protection laws should always provide for a private cause of action. Otherwise they just function as a mechanism for legalized corruption.
- mindslight 5mo ago
  I don't disagree with the thrust of your criticism of the dynamic (especially long term). But there is a legitimate concern that the first test cases to hit the courts need to be quite unsympathetic egregious violators rather than surveillance dynamics that have been thoroughly normalized for decades. If people start bringing private suits against neighbors that have deployed Amazon surveillance cameras, "credit bureaus", private investigators, big tech surveillance companies directly (eg Google, and especially with weak legal arguments), it is likely to set some poor precedents and create political pushback.
  - 5mo ago

josefritzishere 5mo ago

This is very exciting.

like_any_other 5mo ago

A good first step, but the harm is already done when the data is gathered. Stalking should be illegal even if you don't sell the information you gathered, I don't want Toyota or GM or Google knowing where I've been either, not just their "partners", and it's long past the time the EULA loophole was closed. Contracts exist to serve society, not the other way around.

john_strinlai 5mo ago

still waiting for any of the many existing privacy bills, worldwide, to start doing meaningful enforcement.

Cider9986 5mo ago
We need private right of action. That's the big thing holding up the sweeping Mass privacy law. The house supports a private right to action and the senate only wants the attorney general enforcing the law.
- throwaway85825 5mo ago
  California already has a million toothless laws. Anything without a private right of action may as well not exist.
- analog31 5mo ago
  Indeed, and I think possession of the information should be what's actionable.
- mindslight 5mo ago
  Do you have any links that elaborate on this? I haven't been following the Mass privacy law, but if this is true it seems like now is the time to pressure the state senate into adopting the private right of action.
  - Cider9986 5mo ago
    Here (https://epic.org/press-release-massachusetts-house-stands-up-for-privacy-rights-passes-massachusetts-consumer-data-privacy-act/ https://epic.org/press-release-massachusetts-house-stands-up...)
    - mindslight 5mo ago
      Thank you. I had seen that while digging, but I was hoping for some kind of direct comparison, description of where the law is in the process, call to action page, etc. But regardless, your comment prompted me to look at the details myself, see what you were saying is true, and just call my [state] senator to express support for a private right of action as they reconcile the two versions. I'm hopeful that with both versions being passed unanimously, and the more recent one having the private right of action, that it has the momentum.

post_break 5mo ago

Does this include vehicle data? That's a big one. Your new car selling you out constantly.

stronglikedan 5mo ago
I've been driving connected cars for a decade and I haven't felt sold out yet. What am I missing?
- criddell 5mo ago
  I bought a car earlier this year and it took about a week before I started getting car warranty junk mail for the new car.
  - cogogo 5mo ago
    I always thought that is from companies that get their hands on registration data. Or I could be wrong and it is the dealer itself selling it on not the manufacturer.
    - Loughla 5mo ago
      Pretty sure it's registration data. Anything public is now used for junk. We transferred a piece of property this year and have been getting constant spam for realtors to sell it for us. We bought a used car from an individual and started getting spam for warranties once we registered it and got plates.
      - mindslight 5mo ago
        Just to be clear: real estate is generally public records viewable by anybody, while vehicle titles/registrations generally aren't (without having been deliberately sold by the state).
- chaps 5mo ago
  Are you asking for articles that show how connected car data is being sold left and right?

danesparza 5mo ago

Feels like the word 'sale' may actually turn into a loophole. It should have probably been worded to use 'exchange' or 'transfer' instead. But this is progress.

Cider9986 5mo ago
Yeah, we need data minimization. As long as it's collected it is a liability for consumers, turn it into a liability for businesses to incentive them to collect as little as possible.
bobro 5mo ago
https://malegislature.gov/Bills/194/S2619/BillHistory https://malegislature.gov/Bills/194/S2619/BillHistory SECTION 1. The General Laws are hereby amended by inserting after chapter 93L the following chapter:- Chapter 93M. Massachusetts Data Privacy Act Section 1. As used in this chapter, the following words shall have the following meanings unless the context otherwise requires: ... “Sale of personal data”, the transfer of personal data in exchange for monetary or other valuable consideration by the controller to a third party; provided, however, that “sale of personal data” shall not include: (i) the disclosure of personal data to a processor that processes the personal data on behalf of the controller if limited to the purposes of the processing; (ii) the disclosure of personal data to a third party for purposes of providing a product or service affirmatively requested by the consumer; (iii) the disclosure or transfer of personal data to an affiliate of the controller; (iv) the disclosure of personal data with the consumer’s affirmative consent, where the consumer affirmatively directs the controller to disclose the personal data or intentionally uses the controller to interact with a third party; (v) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy or other transaction or a proposed merger, acquisition, bankruptcy or other transaction, in which the third party assumes control of all or part of the controller’s assets; or (vi) the disclosure of personal data that the consumer: (A) intentionally made available to the general public via a channel of mass media; and (B) did not restrict to a specific audience.

jboggan 5mo ago

California very quietly passed AB-1542 last week which includes precise location data, health data, SSNs, etc. I expect many states to follow suit. Related, General Motors got hit with a $12.75M fine for reselling OnStar location data last month: https://ccpa.world/enforcement/gm-onstar-smart-driver https://ccpa.world/enforcement/gm-onstar-smart-driver

yencabulator 5mo ago
> I expect many states to follow suit. More importantly, many companies will follow California rules even outside California. My car was built to California emissions spec at a time when very few states had stricter rules. (The one major exception seems to be the "sell my data" opt-out and such privacy rules, that industry is sleazy enough that they'll go through extra trouble to keep screwing over non-CA residents.)
- jboggan 5mo ago
  Well, CT and VT passed their own version of the California DROP system last week and there are 5 other states in play for the current 2026 legislative sessions. I think it will be a slow patchwork for more states to take similar action, but it is coming. I will note that many "data brokers" will just honor non-California residents' requests as if they were California residents and subject to the CCPA, simply because they would rather remove a potentially litigious consumer from their databases. Given the relatively low potential revenue for a single consumer's data it just doesn't make sense to hold on to information for the kind of person who currently goes out of their way to make that kind of request. At the same time, many data brokers do go out of their way to deny as many privacy requests as possible. Given that the CPPA/CalPrivacy is starting audits very soon I don't see this as a winning strategy for them in the long run.
- themafia 5mo ago
  Watching "The Price is Right" made California a mythical place for me as a child in the Midwest. All the cars being given away, they were sure to mention, followed "California emissions standards!" No surprise. I ended up moving here.

Cider9986 5mo ago

this is the bill we need to pass in the house instead of them trying to age-(identity)gate social media. (https://epic.org/press-release-massachusetts-senate-unanimously-passes-strong-privacy-bill/ https://epic.org/press-release-massachusetts-senate-unanimou...)

throwaway85825 5mo ago

Only data that does not exist cannot be misused.

themafia 5mo ago
A moment of high drama in the courtroom: "Did you notice anything odd about the defendants vehicle?" "Yes." "What was that?" "He had disabled his GPS and telemetry systems."

timeninja 5mo ago

Massachusetts allows the use of Cellebrite software. In which case "precise location data" is moot.

hoppyhoppy2 5mo ago
Sure, if the cops seize your phone from you and try to suck out its data, then they clearly already know your precise location. But in some situations you would've been able to avoid getting your phone sucked out by the cops if they hadn't been able to purchase precise location data about where you were in the hours/days/weeks leading up to that.
ezfe 5mo ago
What is your point here? That's not what this law is about.

loeg 5mo ago

Does this criminalize Strava?

markerz 5mo ago
If Strava is sharing or reselling users GPS locations to third parties without user consent, yes.
ezfe 5mo ago
Why would it?

nxy 5mo ago

Thank god if this is true! If not and this is just a "coverup".. Wouldn't be the first time.

deleted 5mo ago

[deleted]

m463 5mo ago

later in the article it said not only selling, but sharing. important because "sharing" is much more prevalent than "selling" data. that said, I wonder how "precise location", and statistics/algorithms will combine? for example, what if someone moves from zipcode 1 to zipcode 2? would that work out to a more precise position?

testytestyroo 5mo ago

What prevents law enforcement from collecting this data/other signals and anonymizing it and then running models against it? Are there any laws against this?

cmxch 5mo ago

Criminals rejoice.