Massachusetts H 103: An Act relative to the utilization of the systematic alien verification for entitlements program by the Commonwealth

Bill Text

1 of 1
HOUSE DOCKET, NO. 4127 FILED ON: 1/17/2025
HOUSE . . . . . . . . . . . . . . . No. 103

The Commonwealth of Massachusetts
_________________
PRESENTED BY:
Andres X. Vargas and Simon Cataldo
_________________
To the Honorable Senate and House of Representatives of the Commonwealth of Massachusetts in General
Court assembled:
The undersigned legislators and/or citizens respectfully petition for the adoption of the accompanying bill:
An Act to establish the Massachusetts neural data privacy protection act.
_______________
PETITION OF:

NAME: DISTRICT/ADDRESS: DATE ADDED:
Andres X. Vargas 3rd Essex 1/17/2025
Simon Cataldo 14th Middlesex 1/17/2025
Mindy Domb 3rd Hampshire 3/31/2025

1 of 43
HOUSE DOCKET, NO. 4127 FILED ON: 1/17/2025
HOUSE . . . . . . . . . . . . . . . No. 103
By Representatives Vargas of Haverhill and Cataldo of Concord, a petition (accompanied by bill,
House, No. 103) of Andres X. Vargas and Simon Cataldo for legislation to establish the
Massachusetts neural data privacy protection act. Advanced Information Technology, the
Internet and Cybersecurity.

The Commonwealth of Massachusetts

_______________
In the One Hundred and Ninety-Fourth General Court
(2025-2026)
_______________

An Act to establish the Massachusetts neural data privacy protection act.

Be it enacted by the Senate and House of Representatives in General Court assembled, and by the authority
of the same, as follows:

1 SECTION 1.
2 The General Laws, as appearing in the 2022 Official Edition, are hereby amended by
3 inserting after chapter 93L the following chapter:
4 Chapter 93N. Massachusetts Neural Data Privacy Protection Act
5 Section 1. Definitions
6 (a) As used in this chapter, the following words shall, unless the context clearly
7 requires otherwise, have the following meanings:
8 (1) “authentication”, the process of verifying an individual or entity for security
9 purposes.

2 of 43
10 (2) "chapter”, this chapter of the General Laws, as from time to time may be
11 amended, and any regulations promulgated under said chapter.
12 (3) “collect” and “collection”, buying, renting, licensing, gathering, obtaining,
13 receiving, accessing, or otherwise acquiring covered data by any means.
14 (4) “consent”, a clear affirmative act signifying an individual’s freely given, specific,
15 informed, and unambiguous agreement to allow the processing of specific categories of personal
16 information relating to the individual for a narrowly defined particular purpose after having been
17 informed, in response to a specific request from a covered entity that meets the requirements of
18 this chapter; provided, however, that “consent” may include a written statement, including a
19 statement written by electronic means, or any other unambiguous affirmative action; and
20 provided further, that the following shall not constitute “consent”:
21 (i) acceptance of a general or broad terms of use or similar document that contains
22 descriptions of personal information processing along with other, unrelated information;
23 (ii) hovering over, muting, pausing, or closing a given piece of content; or
24 (iii) agreement obtained through dark patterns or a false, fictitious, fraudulent, or
25 materially misleading statement or representation.
26 (5) “control”, with respect to an entity:
27 (i) ownership of, or the power to vote, more than 50 percent of the outstanding shares
28 of any class of voting security of the entity;
29 (ii) control over the election of a majority of the directors of the entity (or of
30 individuals exercising similar functions); or

3 of 43
31 (iii) the power to exercise a controlling influence over the management of the entity.
32 (6) “covered data”, information, including derived data, inferences, and unique
33 persistent identifiers that identifies or is linked or reasonably linkable, alone or in combination
34 with other information, to an individual or a device that identifies or is linked or reasonably
35 linkable to an individual. However, the term “covered data” does not include de-identified data
36 or publicly available information.
37 (7) “covered entity”, any entity or any person, other than an individual acting in a
38 non-commercial context, that alone or jointly with others determines the purposes and means of
39 collecting, processing, or transferring covered data.
40 The term “covered entity” does not include:
41 (i) government agencies or service providers to government agencies that exclusively
42 and solely process information provided by government entities;
43 (8) “covered high-impact social media company”, a covered entity that provides any
44 internet-accessible platform where:
45 (i) such covered entity generates $3,000,000,000 or more in annual revenue;
46 (ii) such platform has 300,000,000 or more monthly active users for not fewer than 3
47 of the preceding 12 months on the online product or service of such covered entity; and
48 (iii) such platform constitutes an online product or service t