Current Actions

This page was last updated on July 6, 2026.

The Moment for Meaningful Privacy Protection Is Now — Senator Creem Needs to Hear from You

Massachusetts is on the verge of passing its first comprehensive data privacy law. The Senate passed its bill (S.2619) unanimously. The House followed with its own version (H.5479) on June 4. Both bills require data minimization standards and ban the sale of sensitive data including precise geolocation, health and biometric data, immigration status, crime victim status, and minors’ data. Now a conference committee is negotiating the final version, and Senator Cindy Creem sits on that committee. Her leadership could be decisive.

The single most important provision for Senator Creem to defend is the Private Right of Action (PRA), the right of individuals to sue large corporations that violate the law. Industry lobbyists are fighting to strip it out because they know it is a key mechanism to ensure compliance. The Attorney General’s office cannot realistically pursue every violation of Big Tech. When corporations can treat an occasional settlement as a cost of doing business, the law becomes a suggestion. Illinois’ Biometric Information Privacy Act proves what happens when individuals can enforce their own rights: companies build compliance into their systems from the start.

The PRA is narrowly drawn. It applies only to “large data holders,” defined as companies that collect, process, or sell the personal data of two million or more consumers per year, or sensitive data of 200,000 or more consumers per year, excluding routine payment processing. This does not reach our neighborhood bakery, local nonprofit, or small employers. It targets the data brokers trading in our digital lives and the ad tech giants tracking us across apps and locations. Our Attorney General supports this limited PRA. This is not a partisan fight: 92% of Massachusetts voters support banning location data sales.

You can use this action alert link to send an email to Senator Creem’s office or contact her office directly via the following:

Call Senator Creem: (617) 722-1639

Email: Cynthia.Creem@masenate.gov

Thank you for calling today. A two-minute call could make the difference between a law with teeth and a paper tiger.

For more talking points/information about the bill, consider the following:  

Talking Points:

1. I am a Newton resident. Please fight for a Private Right of Action (PRA) in the final bill.
2. Without a PRA this bill is a suggestion, not a law. The Attorney General’s privacy office has a handful of attorneys. Meta’s legal team alone is vastly larger. When government enforcers lack the capacity to take on every violation, individuals must have the right to seek justice before a jury of their peers. A bill without meaningful enforcement is no bill at all.
3. The PRA applies only to large data holders, not small businesses. It is limited to companies processing personal data on two million or more consumers per year, or sensitive data on 200,000 or more, excluding routine payment processing. Small businesses would not be sued and will answer only to the Attorney General.
4. Big Tech will treat Attorney General-only enforcement as a cost of doing business. Companies make more money violating privacy than they would pay in rare fines. They will factor occasional settlements into their budgets and continue as before. A PRA makes noncompliance too expensive to ignore, which is exactly why industry lobbyists want it stripped out.
5. The Massachusetts Attorney General supports this limited PRA. So do 92% of Massachusetts voters. Both chambers passed these bills unanimously. Private enforcement is not a partisan idea. It is a basic commitment to checks and balances and the rule of law.
6. Private enforcement is essential to participatory democracy. It empowers people to exercise their right to be heard before a jury of their peers and gives them a fighting chance against immense corporate power when government enforcers lack the capacity or willingness to act. That is what Chapter 93A, the consumer protection law, has always stood for in Massachusetts. Data privacy deserves the same.
7. Massachusetts has always let consumers enforce their own rights. Chapter 93A proves it works. Add one clarifying line establishing that a violation of the privacy law constitutes injury under 93A, so victims are not forced to prove some additional, separate harm to seek justice. Give people a fighting chance.