An Act establishing the Massachusetts Data Privacy Act

This bill establishes Massachusetts' first comprehensive data privacy law, directly affecting businesses that collect personal information from residents. It requires covered entities (primarily commercial businesses handling personal data) to obtain clear, specific consent for data processing - banning deceptive practices like "dark patterns" that trick users into sharing information. Key provisions include strict rules for handling biometric data, prohibiting the use of broad terms of service as consent, and creating new definitions for terms like "data broker." Small businesses with under $20 million annual revenue and certain nonprofits are exempt from most requirements.