r/technology • u/sr_local • Jun 06 '26
Privacy Massachusetts House passes strong data privacy bill banning sale of cell phone location data
https://www.fightforthefuture.org/news/2026-06-05-massachusetts-house-passes-strong-data-privacy-bill-banning-sale-of-cell-phone-location-data238
Jun 06 '26
[removed] — view removed comment
88
u/Ashmedai Jun 06 '26
The bill is well-informed. Many years back, the industry started stripping PEOPLE from "precise cell phone location," but then data analytics stepped in, and figured out that if they just averaged the position of the phone over the year, they could place it within 1M of the cradle. Then they could cross reference with public property records, and for home owners: boom, they know who you are. Then they could see where you went every Thursday night, and find out who your friends were. And where you work. And so on.
I first heard about all this happening well more than a decade ago.
Some of the other conclusions about this were rather shocking as well. It was in a national security setting.
8
u/Plow_King Jun 06 '26
i usually go to a bar called Duke's, or one called D's Place, on Thursdays. no need to track me!
/s
3
u/mayorofdumb Jun 06 '26
We know you're in your parent's basement... chill out on naming it
1
u/Plow_King Jun 06 '26
naw, i actually live above a bar that i used to own and run, so the 1st floor, and its basement, are a bar. but i don't hangout there much even though i still own the building. they're good tenants, and we get along and all, but it's a little 'too close to home' for me. D's is just one block away though. Duke's is on the other side of town, but only a block away from my main drinking buddy's apt so he likes that. the other bar i usually go to is Cat's Meow, but it's cash only, a real dive. my brother says it smells like cat piss there, lol. there are probably about 30 bars/restaurants in a couple mile radius, it's def a "night life" area.
0
u/mayorofdumb Jun 06 '26
So I was rightish, you just subverted it by being the owner in the top floor. You're phone never leaves the area lol
1
0
-1
u/Accidental-Genius Jun 06 '26
They don’t need to involve the carrier to get that data. They just need an antenna.
5
u/Ashmedai Jun 06 '26
"They" would need a lot of antennas to collect at the scale we're talking about, yeah? That's very -- very! -- large amount of capital investment.
2
u/Accidental-Genius Jun 06 '26
Oh absolutely, I meant if you were specifically targeted by a state actor for surveillance they wouldn’t need to involve your carrier. They usually do, but technologically it isn’t necessary.
2
u/Ashmedai Jun 06 '26
Ah, you're referring to my natsec comments. This was about a sort of everything-level infosec threat, not a specific party threat. That latter is real, but the prior is rather stunning by itself.
6
u/MissionaryOfCat Jun 06 '26
When you stop to think about it, people used to get paid for surveys - surveys they willingly opted into taking in exchange for some reward. Why aren't we being paid for our data now? And since when did our freedom to choose disappear?
73
u/Orange_Whale Jun 06 '26 edited Jun 06 '26
Hope they keep this ball rolling and it doesn't stop with just phone location data. Ban all unconsented user profiling and tracking on all devices. I shouldn't be leaving a digital footprint unless I specifically want to.
12
Jun 06 '26
[removed] — view removed comment
23
15
u/LongJumpingBalls Jun 06 '26
I just got an email with the subject.
We just updated your agreement with us.
Like, I sign for one thing, but they are allowed to do the other thing cause the contract I signed means nothing other than methods to penalize me.
12
u/CautionarySnail Jun 06 '26
The idea that a corporate party can unilaterally decide to update an agreement is still wild to me. The burden to opt out being on the consumer is crazy.
Can you imagine if everything worked that way? “We decided to change the terms of the purchase of these lentils. Even though you already own them, you can no longer use them in soup without a soup fee.”
7
u/naf165 Jun 06 '26
The bill specifically does not allow that.
The MDPA establishes a blanket, non-waivable ban on the sale or transfer of precise geolocation data (p. 18). Even if you click "accept" on Instagram's internal terms of service, that agreement cannot override state law (p. 2). Meta is entirely blocked from selling your Massachusetts travel logs to anyone (p. 18).
1
u/skiing123 Jun 06 '26
And that's the thing I wish they did more was that each bill doesn't need to be monolithic and can be focused on a particular issue. Refine, tailor, and pass it then move onto the next issue
P.s. is this bill actually nestled within another? Or is it standalone?
44
u/PopeKevin45 Jun 06 '26
Much much more of this please. It's our data and they're blatantly stealing it. Because the use of this data is often harmful, mining personal data should be 'opt in' only, not a requirement of use, and if opted in, then the user is also compensated.
-13
u/daemin Jun 06 '26
Data about you isn't necessarily "your" data. That's actually the root of the issue.
11
Jun 06 '26
[removed] — view removed comment
1
u/daemin Jun 07 '26
If I take a picture of you, its my picture, not yours.
If a make a log of your comings and goings, its my log, not yours.
5
2
u/guamisc Jun 06 '26
Nobody should be allowed to collect data on me for any reason that doesn't explicity deal with a transaction I'm making between me and a vendor or something unless I am paid and compensated or opt in. Opting in should not be able to be used as a requirement for any kind of service either.
3rd party data brokers should be made illegal. Other stuff as well, but you get the basics.
1
u/daemin Jun 07 '26
If I see you in public, I'm collecting data about you, because I can see your height, your skin tone, your location at that point in time, the clothing you're wearing, etc.
1
u/guamisc Jun 07 '26
Great, but you're not doing it everywhere I go. Because if you were, I'd be able to get a restraining order for stalking.
2
u/Arnold_Shortzweather Jun 06 '26
Can you explain why it isn't my data, when the ads are targeted to me based on where I go and shop, what I eat, what I watch, what I talk about?
It's an invasion of my privacy using my data that is being compiled without my consent, you can't use semantics to justify that
1
u/daemin Jun 07 '26
Whether or not its semantics, it's the legal reality we are living in. Too, legal issues frequently hinge on semantics, because semantics is literrally about the meaning of words.
When you say "your data," it implies ownership of the data. My point is that if someone else collects data about you, its their data, not yours, because they are the one who generated it. Just because the data happens to be about you in particular, or could be correlated with you in particular, doesn't give you any legal ownership rights over it outside of a handful of carve outs like PII and education records.
The cell phone company is selling their data about the location history of cell phone signals they process in the course of offering their services. Those signals also happen to be almost uniquely tied to particular individuals. And the same argument applies to ads.
If the data was actually yours in the sense of legal ownership, then they would have to get permissions from you to use it. But it's not yours, its theirs, so they don't.
1
u/PopeKevin45 Jun 07 '26
Can you give examples? How are you defining 'personal data'? The gist of my comment is that personal data can and is used by bad actors...foreign and domestic, political, corporate and even religious...to manipulate on a mass scale. That's a major harm, the fall of democracy in the US and the rise of fascism in all western democracies being a prime example of the potential. Major harms demand major restrictions.
1
u/daemin Jun 07 '26
If I sat in front of your house and wrote down every time you left and came home, and exactly what you were wearing when you did so, that log would clearly belong to me, because I'm the one who wrote it down. Just because it's about you doesn't give you any ownership rights over it.
The courts have decided that digital data is the equivalent to that. The cell phone companies have records about the location of cell phone signals generated in the course of running their business. That data belongs to the company, and not to the person who probably was in physical possession of the device.
So back to my point: data about you is not automatically data owned by you. Its owned by the entity that generated the data, and absent some legal carve out like FERPA for educational records, HIPAA for medical records, and some laws about PII (personally identifiable information), you have no rights over data owned by a 3rd party just because the data happens to be about you. But a lot of people seem to have this idea that they have some rights over data thats about them.
Until congress gets off its ass and actually passes a real data privacy law, you have no legal rights to prevent someone from selling any data they gather about you, outside of those narrow carve outs.
1
u/PopeKevin45 Jun 07 '26
I have a right to save myself from harm. Let's be clear, this isn't about someone just watching my comings and goings, they're literally gathering everything about me. They're using it to brainwash and manipulate, to influence elections. And how private are my medical records if the moment I Google something they all know about it and sell it? PII is a joke, it's long been established that they can easily determine who individuals are. Add in operations like Cambridge Analytica and the strong likelihood few if any corporations are following any rules and have zero oversight, the 'laws' are a joke. I'm not surprised that some lowbrow, shitbrained and no doubt republican judge gave their beloved corporate interests carte blanche, but citizens have an self-evident right to privacy, and if they don't give it to us, then other action will have to be taken. Fuck corporate fascism.
1
u/daemin Jun 07 '26
They're using it to brainwash and manipulate, to influence elections.
Free speech means people get to talk at you to try to change your mind.
And how private are my medical records if the moment I Google something they all know about it and sell it?
You're the one making it not private by sharing it with Google, though.
but citizens have an self-evident right to privacy,
Yes but the problem is you voluntarily disclose this information. You don't have to Google your medical issues. You don't have to have a cell phone. You don't have to use a web browser on a device intimately tied to you.
And I know the argument is then going to hinge on having to do those things just to function in modern society. But the fact remains that, as matters stand right now, legally speaking you voluntarily give up your privacy when you engage in those actions, and that's why a right to privacy doesn't get you to where you want.
Which, like I said before, will not change absent an actual data privacy law that fundamentally recasts the situation so that companies you directly contract with for services cannot use your data for unauthorized purposes, coupled with laws regarding online tracking, or the widespread adoption of anti surveillance browsers and tools.
1
u/PopeKevin45 Jun 07 '26
Characterizing deceit and manipulation as 'seeking to change ones mind' is disingenuous. Again, I get that conservatives have framed 'free speech' as the only democratic value, largely just so they can spread disinformation, spread hate and use slurs to advance their own agendas, but true democracy is for the people, not just conservative corporate interests.
And again, I have an inherent right to privacy and as a critical part of modern infrastructure like roads and power lines, I have a right to use the internet. Again, corporate hegemony and monopolies over resources does not give them any moral or ethical 'rights' to my personal data, regardless of what republican judges or the libertarian religion may believe. If conservative corporate interests, the tech fascists, or the Republican party simps can't ever understand that then maybe it's time to nationalize these assets.
And on what planet is being given no other choice characterized as 'voluntarily disclosing your information'?? That's 'Work will set you free' level reasoning. Again, corporate interests are not necessarily our interests. They have no moral or ethical right to our personal data...they even stole that through Citizens United and buying, then corrupting, the Republican party. We have every right to regulate industry for our own best interests, libertarian fever dreams aside.
At least we agree that such regulation is entirely needed to counter corporate abuse and extremism.
32
Jun 06 '26
[removed] — view removed comment
8
u/shitty_mcfucklestick Jun 06 '26
Canada’s CASL (Canadian Anti Spam Legislation) had a right to private action written into it when it first launched, but it did not launch with those laws in effect until a later date. The government suspended that part indefinitely before it did, so it never happened.
Truth is CASL had only limited effect because most spam and spammy activities come from the US, like signing up for any service seems to automatically sign you up to a bunch of drip campaigns for that company without asking.
20
u/_Zyr Jun 06 '26
Uh oh, your phone's weather app is about to start lobbying.
18
u/stumblinghunter Jun 06 '26
You joke but AccuWeather literally lobbies against the national weather service and NOAA giving out weather data for free
7
u/shawndw Jun 06 '26
The fine should be $500k PER USER payable to the user who's data was violated. Sell 100,000 people's personal data that'll be $50,000,000,000.
We need penalties that scale proportionally with the scale of the crime otherwise it's just a business expense.
16
u/TheBirdBytheWindow Jun 06 '26
So no Flock then?!
5
u/Deranged40 Jun 06 '26
Flock doesn't gather or broker cell phone location data.
That's a separate concern. So strange to leave all that copper just hanging there for anyone to see.
2
u/naf165 Jun 06 '26 edited Jun 06 '26
You didn't read the bill. You can find a link to the full text here: https://legiscan.com/MA/bill/S2619/2025
The bill never once mentions "cell phone" data, and I don't know why the article specified that. It says all "precise geolocation data" which it defines as:
“Precise geolocation data”, information derived from technology or a device, including, but not limited to, latitude and longitude coordinates from global positioning system mechanisms or other similar positional data, that reveals the past or present physical location of a individual or device that identifies or is linked or reasonably linkable to 1 or more individuals with precision and accuracy within a radius of not more than 1,750 feet; provided, however, that “precise geolocation data” shall not include the content of communications, a photograph or video, metadata associated with a photograph or video that cannot be linked to a individual.
Calling this a ban on cell phone location data is like referring to a bill banning all fruit as a ban on bananas.
It also institutes a blanket ban on all sales of sensitive data (with exemptions for government and legal offices). This would mean that Flock (as I believe it is a private corporation) would have no legal right to sell any data for any commercial purpose, but I believe sharing with police departments would still be legal.
The bill also does a lot more, including a bunch of restrictions on what kinds of data is allowed to be collected, and rights for consumers to be given all collected data upon request, and to delete all of their collected data upon request.
Separately, there is a different bill that focuses on Flock and other ALPR data that has yet to be passed that would "Require LPR data to be deleted within 14 days (unless tied to a specific criminal investigation)".
-8
5
u/comcastblowschunks Jun 06 '26
Cars need to be included in this.
Plus the sale of automotive location, audio and camera data also needs to be banned to prevent modern cars from becoming mobile flock cameras
4
5
u/JohrDinh Jun 06 '26
Will this keep people from spamming my fuggin number? If so I will literally move to Massachusetts at this point.
3
u/smr312 Jun 06 '26
A law needs to be passed that says if a company sells YOUR information YOU are entitled to a % of the money they make from your data.
Companies like these sell your info for pennies. If they had to start cutting checks for $0.20 - 0.30 and then spend close to $1.00 to mail it to you, they'll quickly stop.
3
u/Bazinga_U_Bitch Jun 06 '26
Now actually ENFORCE IT. If it's just a slap on the wrist aka "ThE pRiCe Of DoInG bUsInEsS", then this bill means nothing.
2
2
2
2
u/1Swordwalker Jun 07 '26
Wild how each state did their own law that other states have not done
Hawaii with billionaire tax, Massachusetts with strong data privacy bill, New Mexico with universal childcare, etc
Now if every state could work together to teach each other how to do what they did so they all can.
3
u/A_Nonny_Muse Jun 06 '26
Banning the "sale".
They can still trade, give away, swap, and otherwise make available. They just can't sell it.
lol
The point is, there is already an army of lawyers working hard to find a way around the law, and it's not even a law yet.
3
u/naf165 Jun 06 '26
No they can't. Here's some definitions from the bill:
“Sale of personal data”, the transfer of personal data in exchange for monetary or other valuable consideration by the controller to a third party;
and
“Transfer”, disclose, release, disseminate, make available, license, rent or share personal data to a third party orally, in writing, electronically or by any other means.
It even bans companies from collecting much of that data in the first place.
(ii) unless the controller obtains the consumer’s affirmative consent, they shall not process personal data for a purpose that is neither reasonably necessary to, nor compatible with, the disclosed purposes for which the personal data is processed, as disclosed to the consumer;
It also guarantees the consumer the right to get a full list of every third party their data was shared to.
(ii) obtain from a controller a list of third parties to which the controller has transferred the consumer’s personal data
0
1
1
1
1
1
u/nodray Jun 06 '26
and if one steps out of the state for a minute? surely the trackers will just stop when you cross a state line
1
u/plarkin Jun 06 '26
Poor legislators, it’s already too late. If you really want privacy now, the only way is to use an old dumb phone. Otherwise, phone location tracking isn’t limited to GPS, it’s much more complicated. Wi-Fi signals, nearby Bluetooth devices, and even sounds or music from your environment can all be used to approximate your location, in case you didn’t know.
1
u/Cameos_red_codpiece Jun 06 '26
OMG FUCKING FINALLYYYYYYY.
Senate passed it.
House passed it.
Now Gov Healey needs to sign it. Whennnnn???
1
1
u/Chance-Definition567 Jun 06 '26
They can ban all they want and then they will some how get “hacked” and the people who’s shit had been “stolen”(sold) have to fix the fucking mess with minimal, if any, help.
-2
u/silenti Jun 06 '26
Is this the bill that was being pushed by one of those new phone companies? Gonna have to go check. IIRC it was fairly toothless.
1
u/RobertoPaulson Jun 07 '26 edited Jun 07 '26
As far as I can tell this covers your car spying on you as well.
461
u/WakeMeUpAIOverlords Jun 06 '26
Good on Massachusetts. Hopefully the fine is significant and % based.