Lawmakers in the Massachusetts House and Senate currently are negotiating the differences between two sweeping data privacy bills that each chamber has passed.
Julie Centrella had a hard enough time ensuring her small business survived the economic meltdown during the COVID-19 pandemic.
She had to shutter the brick-and-mortar store she opened in 2008. And advertising on Facebook and Instagram turned into a lifeline.
“We were closed for so long in the state of Massachusetts,” Centrella, who owns Aine’s Boutique, a women’s clothing store, in Reading, recalled earlier this week.
“And right when we were open, you couldn’t have more than three people at a time, so you really had to rely on the internet,” she said. “I started doing live sales from my empty store with what merchandise we had, or were able to get, and my business actually really grew.”
So she never expected to have to wage a fight against her own state government just a few short years later to keep those livelihood-saving tools from being taken away from her.
But that’s exactly what she’s found herself doing as lawmakers on Beacon Hill work out their differences over sweeping data privacy bills.
“As a small (business), it’s a struggle to survive. And as someone who’s survived for almost 20 years — some days, I don’t know how — to take away this edge would not be good,” she told MassLive on Thursday.
The bills that overwhelmingly passed the majority-Democrat state House and Senate would, among other things, give state residents greater control over the blizzard of data that tech companies collect every time they open an app or surf the web.
The proposals are now before a joint House and Senate conference committee, where lawmakers are trying to work out their differences.
The debate has drawn in a constellation of influential and well-funded interest groups, each with something to lose. The stakes — along with the cash on the line — are huge.
How we got here
The Senate approved its iteration of the bill last September, while the House passed its version in June.
Both proposals share some common ground by requiring businesses to limit data collection and honor consumer requests to access or delete their personal information.
But there’s a big split between the two chambers on the sale and collection of sensitive personal data, according to State House News Service.
The Senate’s version bans outright the sale of sensitive personal information, including precise geolocation data, health information and biometric identifiers
It also would require companies to collect or process sensitive data only when “strictly necessary” to provide a product or service requested by a consumer, according to a Senate summary of the bill.
The House’s version would require companies to obtain “unambiguous, affirmative” consent from consumers.
The bill is “a must for the 21st century,” Rep. Tricia Farley-Bouvier, D-2nd Berkshire, one of the lead negotiators on the proposal, said, adding that it’s a “critical step to hold companies accountable, protect minors and establish strong consumer protections.”
Both bills include tough new protections for children aged 18 and younger, including a ban on targeted ads for minors.
Similar efforts have unfolded in other New England states.
A proposal to create a comprehensive data privacy law in Maine was unable to recover after sizable business pushback led several Democrats to join Republicans in opposition.
It marked the second time that lawmakers failed to get such a plan over the finish line; the Maine Morning Star, a nonprofit news site focused on state government, reported.
Last month, New Hampshire Gov. Kelly Ayotte, a Republican, signed a bill amending the state’s existing data privacy law to ban the sale of a child’s personal data.
In June, Vermont Gov. Phil Scott, also a Republican, signed a data privacy bill into law. That legislation includes a broad definition of sensitive data and “heightened protection” for consumer health data, according to one analysis.
And in 2025, state lawmakers in Connecticut amended the Nutmeg State’s data privacy law to, among other things, toughen the protection of minors.
The argument
In the Bay State, advocates, including the state’s branch of the American Civil Liberties Union and Reproductive Equity Now, welcomed the efforts here, arguing that it would protect children and such vulnerable people as immigrants and those seeking reproductive care.
The House’s bill “positions Massachusetts as a leader in protecting personal privacy and curbing digital surveillance. Strong, enforceable privacy law is also a critical firewall for our democracy,” Carol Rose, the executive director of the state’s branch of the ACLU, said in a statement last month. “It’s so important for Massachusetts residents to know they can attend protests and speak freely without risk that their location data will be sold.”
But that’s exactly where Brendan Thomas raises a red flag.
He’s the executive director of Internet for Growth, an industry trade group. And he says the new restrictions on geolocation data will make it harder for small businesses to reach customers.
You’re probably familiar with these ads: They’re the promotions for local businesses that pop up when you open a radio app such as Audacy or the location-specific Google ads you see while searching the web.
“Anybody under the sun who’s a small business and depends on digital tools, particularly interconnected advertising, marketing media, personalized online media to connect with consumers,” he said.
Centrella stressed that she’s not getting specific personal information, such as names and addresses, when she places her ads.
“So when I’m creating an ad, I put in, I want women between 45 and 65 that live 30 minutes away … and their interests are shopping, fashion and home,” she said.
“So I have no idea what their race is, how much money they make. It’s a very broad base. But it helps me get in front of people who are interested (in my business),” she continued, adding that “we’re just trying to find people who would like what we provide.”
What’s next
Earlier this week, Thomas’ group led a coalition of businesses in a joint letter to legislative negotiators, urging them to remember that “consumer privacy and small-business success are not competing goals.”
And “like our customers, we support strong consumer privacy protections and believe people should have transparency, access and control over their personal information,” they added.
Legislative negotiators held their first face-to-face meeting earlier this month, according to State House News Service. The session mostly established the rules of the road and found them willing to meet again.
One big task: Deciding which businesses the law should cover.
The Senate proposal applies to companies that process data from at least 60,000 Massachusetts residents annually, compared to the House’s 100,000-person threshold, the wire service reported.
And that could well sweep up such smaller businesses as Centrella’s boutique.
“Consumers deserve to understand what’s happening with their information. Yes, it should be secure,” Thomas said. “It should be anonymized (and) businesses need to be careful with it.”
“And that is a real concern because that’s not always the case and bad actors should be punished and there shouldn’t be fraud,” he continued. “But in protecting consumers, some of these bills could go too far, and consumers aren’t aware of what the effects could be.”
State Sen. Cynthia Stone Creem, D-Norfolk/Middlesex, has called the legislation “critical,” and said both chambers want to see “meaningful safeguards to protect the personal data of Massachusetts residents,” eventually signed into law,
“For too long, tech companies have profited off of our personal information without transparency, accountability or limitation,” Creem, who’s helping lead negotiations for the upper chamber, said, according to State House News Service.
“By advancing a strong data privacy bill, we’re going to be protecting our residents, our decisions, and a right to live free from constant surveillance,” she said.
John L. Micek, Political columnist, MassLive