An Act establishing the Massachusetts Data Privacy Act

This bill establishes the Massachusetts Data Privacy Act to regulate how businesses collect, process, and share personal information about individuals. It directly affects companies that determine the purposes and means of handling data, while explicitly exempting small businesses with low revenues, those serving fewer than 25,000 people annually, and specific government or nonprofit entities. The law defines strict rules for obtaining consent, prohibiting vague terms of service or manipulative design choices that trick users, and sets special requirements for large social media platforms and data brokers. Additionally, the act clarifies what constitutes protected data, such as biometric scans and unique identifiers, while excluding de-identified information and publicly available data from these restrictions.