Massachusetts bans sale of precise location data in new privacy rights bill

Massachusetts bans sale of precise location data in new privacy rights bill(techcrunch.com)

122 points by 01-_- 2 hours ago | 20 comments

jboggan 46 minutes ago |

California very quietly passed AB-1542 last week which includes precise location data, health data, SSNs, etc. I expect many states to follow suit.

Related, General Motors got hit with a $12.75M fine for reselling OnStar location data last month: https://ccpa.world/enforcement/gm-onstar-smart-driver

danesparza 1 hour ago |

Feels like the word 'sale' may actually turn into a loophole. It should have probably been worded to use 'exchange' or 'transfer' instead. But this is progress.

Cider9986 32 minutes ago | |

Yeah, we need data minimization. As long as it's collected it is a liability for consumers, turn it into a liability for businesses to incentive them to collect as little as possible.

post_break 1 hour ago |

Does this include vehicle data? That's a big one. Your new car selling you out constantly.

stronglikedan 8 minutes ago | |

I've been driving connected cars for a decade and I haven't felt sold out yet. What am I missing?

Cider9986 16 minutes ago |

this is the bill we need to pass in the house instead of them trying to age-(identity)gate social media.

(https://epic.org/press-release-massachusetts-senate-unanimou...)

like_any_other 1 hour ago |

A good first step, but the harm is already done when the data is gathered. Stalking should be illegal even if you don't sell the information you gathered, I don't want Toyota or GM or Google knowing where I've been either, not just their "partners", and it's long past the time the EULA loophole was closed. Contracts exist to serve society, not the other way around.

john_strinlai 1 hour ago |

still waiting for any of the many existing privacy bills, worldwide, to start doing meaningful enforcement.

Cider9986 33 minutes ago | |

We need private right of action. That's the big thing holding up the sweeping Mass privacy law. The house supports a private right to action and the senate only wants the attorney general enforcing the law.

josefritzishere 1 hour ago |

This is very exciting.

ldoughty 2 hours ago |

Will this have reach and teeth though?

I can imagine loopholes to this... nothing stops facebook/google from buying this data from companies not in Massachusetts? and facebook/google don't have to give advertisers the location information but can still use that information when determining the advertisement to return, right? In theory the big silicon valley "targets" of this bill don't actually have a huge incentive to give this data away, do they? They just need to be able to read/access it, which I don't think this law stops? Assuming the data broker is not doing business in Massachusetts itself

fultonn 1 hour ago | |

> Will this have reach and teeth though?

It'll have reach because MA has a long-arm statute and there's a rich history of applying that statute in the context of Chapter 93.

It'll have teeth but probably not to the effect that you hope.

This statute was written such that only the Attorney General can bring action; see Section 10(b). This diverges from a long history in the Commonwealth of allowing private individuals to bring civil suits for most types of Chapter 93 violations.

As a result, I anticipate that the most impactful change will be in the quantity and frequency of political donations to Mass AG candidates (and in the case of contested primaries their aligned block of candidates up and down ticket).

Consumer protection laws should always provide for a private cause of action. Otherwise they just function as a mechanism for legalized corruption.

mindslight 47 minutes ago | | |

I don't disagree with the thrust of your criticism of the dynamic (especially long term). But there is a legitimate concern that the first test cases to hit the courts need to be quite unsympathetic egregious violators rather than surveillance dynamics that have been thoroughly normalized for decades. If people start bringing private suits against neighbors that have deployed Amazon surveillance cameras, "credit bureaus", private investigators, big tech surveillance companies directly (eg Google, and especially with weak legal arguments), it is likely to set some poor precedents and create political pushback.

rolph 1 hour ago | |

once you allow someone to read data, it has been given away.

even if its only retained until buffer refresh, its still given away.

if its read frombuffer space and transformed into a persistent structure, its a gift that indefinately keeps giving.

ldoughty 40 minutes ago | | |

but if facebook/google are the buyers, they do not violate this law... the law seems to focus on the sale & giving of this data... not the reception. This means that they just need a non-Massachusetts based data broker to sell them the data, and then they can store that data to make advertisement decisions (so long as they do not forward it along)

mc32 2 hours ago |

This is good and all States should adopt some. Eventually I’d like to see one at the federal level that supersedes state level ones so that we don’t have to deal the the mess that is taxation across 50 states. A nice uniform privacy bill at the Fed level would be nice.

yndoendo 1 hour ago | |

This seems more symbolic since I don't see were the law has any teeth.

There is no fine nor imprisonment for failing to follow the law.

kmeisthax 6 minutes ago | |

No, we specifically DO NOT want uniformity. We want a minimum that states can go beyond.

In the current environment, tech companies have to bribe 50 states plus the federal legislature in order to block privacy bills. If you have federal preemption, then you just have to bribe Congress, because states can't pass ANY privacy laws whatsoever. And we already know the feds do not want a privacy law: the entire legality of the federal surveillance apparatus hinges on the fact that buying your data from third parties does not trip constitutional scrutiny. Preemption freezes the requirements in time so they will always be a few steps behind the TLAs[0].

The ideal is that every sovereign entity passes their own privacy law that applies to their territory, with a private right of action, and adtech companies are forced to adopt a "50 states legal" posture. This is, deliberately, a ratchet: it's easy for any state to require a higher standard but hard to get every state to reduce it, so privacy laws cannot be walked back in secret.

[0] Three Letter Agencies: CIA, FBI, NSA