Right now, the apps on your phone are collecting your geolocation data, bundling it, and selling it, all without your consent. That invasion of privacy will end with the passage of the Massachusetts Consumer Data Privacy Act (H.5479), which will ban the sale of precise location data outright. This matters most for our immigrant neighbors, because ICE has been buying this kind of commercial data to track people down for deportation.

Late last year, some lawmakers on Beacon Hill said there was little they could do about Trump’s immigration policy because the federal government controls that area. That was wrong, and I pushed hard for us to take concrete steps to protect immigrants. The state government is the last line of defense against ICE and we must do everything we can for our communities. The bill has now advanced out of both the House and the Senate.

This bill does three things that matter for everyone in Massachusetts:

1. It bans the sale of your precise location data outright, so data brokers can no longer sell it to ICE,

2. It gives you the right to control, delete, and move your own personal data, and

3. It protects your children’s data, your health data, and your most sensitive information from being harvested and sold without your consent.

ICE buys precise geolocation data and uses it to track down our immigrant neighbors for arrest and deportation. They do this without a warrant, without a subpoena, and with nothing more than a purchase order.

Data brokers like Venntel and Babel Street — companies most people have never heard of — harvest location data from the apps on your phone: your weather app, your shopping apps, your games. Venntel’s own marketing materials, obtained through an ACLU Freedom of Information Act lawsuit, boasted that the company collects over 15 billion location points from more than 250 million devices every single day. ICE and Customs and Border Protection paid millions for access to this data, and a single ICE contract with Babel Street ballooned from $816,700 to over $3.6 million.

In 2023, the DHS Inspector General found that ICE, CBP, and the Secret Service had all violated federal law by purchasing and using this data. The IG also found that in at least one case, a CBP employee used the system to track their own coworkers.

The IG told ICE to stop, but ICE turned around and issued a no-bid contract in 2025 to a new surveillance company, Penlink, for a product that lets agents draw a boundary on a map and track every mobile device inside it.

You should not have to worry that the GPS coordinates from your phone will end up in a database that ICE uses to track you down, and the courts affirmed this. The Supreme Court ruled in Carpenter v. United States that the government needs a warrant to obtain your phone location data. ICE sidesteps this by buying the data commercially. One former DHS official compared the purchase to “buying a widget.” That is how cheaply they treat your constitutional rights.

This is how ICE gets around our sanctuary protections. Massachusetts can pass every sanctuary law we want, and our cities can refuse to share information with ICE, and it means far less if a private company is free to sell the exact same location data on the open market. The Massachusetts Data Privacy Act cuts off that commercial pipeline. The bill bans the sale of precise geolocation data outright, the ban cannot be waived by consent, and the protection covers every single person physically present in Massachusetts regardless of residency.

A domestic violence survivor deserves to know her location is not for sale. A worker deserves to know she will not be profiled out of a job or an apartment by an algorithm fed on data she never agreed to hand over. A parent deserves to know their child’s online activity is not being sold to advertisers.

In 2022, we passed the Shield Act to protect people seeking reproductive and gender-affirming care from out-of-state prosecution, and we expanded it again in 2025 to prevent businesses from sharing health care data with out-of-state investigations. But the Shield Act did not address the commercial sale of location data that could reveal which clinics you visit in the first place. With the Data Privacy Act, we have taken a massive step further by banning the sale of that location data entirely.

Under this law, you will have the right to know what data a company collects about you, to correct it, to delete it, and to take it with you to another service. Companies will only be allowed to collect what is reasonably necessary. Your most sensitive information — your health data, your immigration status, your religion, your sexual orientation, your children’s data, and more — will require your affirmative, informed consent before any company can collect or process it. The bill bars companies from sharing a minor’s LGBTQIA+ status with a parent or guardian, because some young people face real danger at home. And the bill has teeth: violations carry civil penalties of up to $5,000, and against the largest data companies, consumers can bring their own lawsuits. Most states do not give people that power, but Massachusetts will.

The House and Senate have each passed strong versions of this bill, both unanimously, and a conference committee is now working to reconcile the two versions into final legislation. Once the conference committee reaches agreement, the compromise bill goes to both chambers for a final vote and then to Governor Healey. The core protections take effect July 1, 2027.

I am committed to fight for data protections for all of us, especially centering our neighbors who live on the margin. Please forward this to one person who should know about it, and as always, please don’t hesitate to reach out.

Follow on Instagram · Follow on Bluesky

Facebook · Instagram · Bluesky

Paid for by Committee to Elect Erika Uyterhoeven · Somerville, MA
Contributions are not tax-deductible · $1,000 max per individual per calendar year

Unsubscribe | Manage Preferences