Massachusetts lawmakers are considering banning the sale of cellular location data across the state, which would be the first legislation of its kind in the country. The Massachusetts Location Shield Act was proposed in the House of Representatives (H357) and in the Senate (S148), aiming to strengthen the protections for consumer location data in response to concerns regarding the potential for the collection and sharing of location data without the consumer’s permission or knowledge. The legislation also appears to be, in part, a response to the Supreme Court’s overturning of Roe v. Wade as it seeks to protect an individual’s privacy, safety, access to abortion and other essential health care in Massachusetts. The Act has further been proposed to protect the LGBTQ community, religious liberty, and freedom of movement by banning the sale of cell phone location information. What do employers need to know about this proposed law?

What Does the Proposed Legislation Say?

Under the Act, businesses would be prevented from selling, leasing, trading, or renting location data across Massachusetts, unless they are doing so for a “permissible purpose.” According to the proposed legislation, a “permissible purpose” would include:

• providing a product or service to an individual to whom the location information pertains when that individual requested the provision of such product or service;
• initiating, managing, executing, or completing a financial or commercial transaction or fulfilling an order for specific products or services requested by an individual;
• complying with legal obligations; or
• responding to communications reporting an imminent threat to human life.

If the Act were to pass, it would bar covered entities, which includes any individual or legal entity, from:

• collecting more precise location information than necessary to carry out a permissible purpose;
• retaining information longer than necessary to carry out a permissible purpose;
• selling, renting, trading, or leasing location information to third parties;
• deriving or inferring from location information any data that is not necessary to carry out a permissible purpose; or
• disclosing an individual’s location information to third parties, unless such disclosure is (1) necessary to carry out the permissible purpose for which the information was collected, or (2) requested by the individual to whom the location data pertains.

The Act would also impose strict requirements on businesses pertaining to the collection, use, and disclosure of location information. These requirements include obtaining an individual’s affirmative opt-in consent for collecting location information and providing individuals with a clear, conspicuous, and simple means to opt out of the processing of their location information for targeted advertising.

Penalties for Failure to Comply

Businesses that do not comply with this proposed Act could face legal action by the Massachusetts Attorney General or by a consumer (or class of consumers) bringing a private right of action. If an individual prevails against a business in a civil action, a court may award emotional distress damages or $5,000 per violation, whichever is greater, punitive damages or an injunction.

Since this Act includes a private right of action, we expect businesses may find themselves subject to significant legal risk should this legislation pass. In the event the Act passes, it will take effect one year after enactment.

What Can Employers Do in Anticipation of This Legislation Passing?

In anticipation of this legislation passing, companies should begin to examine their own data collection practices to see whether, and to what extent, they are collecting and sharing location data. In doing so, companies will be in a better position to take the necessary steps to comply with the Act if, and when, it passes.