Massachusetts votes 146-0 to ban selling precise location data, but 'sale' is the catch

A 146-0 vote and a quietly broad privacy bill

The Massachusetts House passed the Consumer Data Privacy Act (S.2619) by a unanimous 146-0 on June 8, 2026, TechCrunch reported, and the story drew an unusually data-literate discussion in the thread.

What the bill bans, and how wide it reaches

The bill does two main things. It bans the sale of precise geolocation data outright, and it prohibits selling or sharing sensitive data without explicit consent — biometrics, health and genetic data, fingerprints, plus religion, immigration status, and sexual orientation. It applies to any company handling data on 100,000+ consumers, and crucially it covers both residents and visitors, making it a blanket location-data ban inside state lines. The Senate had already advanced its version 40-0 in September; the two will be reconciled and sent to the governor, who is expected to sign. Supporters framed it as a milestone — Fight for the Future's Evan Greer called it 'a major step toward cracking down on Big Tech's' abuses, and the ACLU said it positions Massachusetts as a privacy 'leader'.

The thread's expert squint: 'sale' is the loophole

The most useful voice in the thread had worked inside the location-data industry and read the bill like an insider:

"California very quietly passed AB-1542 last week which includes precise location data, health data, SSNs, etc. … General Motors got hit with a $12.75M fine for reselling OnStar location data last month." — an ex-Googler, formerly at location-data firm Factual

That GM/OnStar enforcement record is the kind of teeth privacy laws rarely show. But the recurring worry in the thread was the exact verb the law turns on:

"Feels like the word 'sale' may actually turn into a loophole. It should have probably been worded to use 'exchange' or 'transfer' instead." — a software developer in the thread

Another spelled out the structural workaround: nothing obviously stops Google or Facebook from buying the data from brokers outside Massachusetts, or from simply reading and acting on location internally without ever 'selling' it to advertisers.

"the big silicon valley "targets" of this bill don't actually have a huge incentive to give this data away … They just need to be able to read/access it, which I don't think this law stops?" — a commenter mapping the loopholes

The deeper objection: the harm is the collection

A thread of commenters argued that banning the sale treats the symptom. The real harm, they said, is the gathering itself:

"the harm is already done when the data is gathered. Stalking should be illegal even if you don't sell the information you gathered, I don't want Toyota or GM or Google knowing where I've been either, not just their "partners"." — a commenter arguing collection is the harm

That reframes the whole bill. A very-high-karma commenter pushed the same point from the technical side, asking how 'precise location' interacts with inference: combine coarse signals over time — a move from one ZIP code to another — and you can reconstruct precise position the law was meant to protect.

A real step, with the gaps marked

Unanimous bipartisan votes on tech privacy are rare, and a visitor-inclusive location ban with a 100,000-user trigger is genuinely broad. But the thread's verdict is the more interesting story than the press release: a law that bans 'sale' in a world built on 'sharing' and internal use is a meaningful first move that leaves the largest players' core mechanism — collect, retain, infer — almost entirely intact. Watch whether the reconciled bill swaps 'sale' for 'transfer'. That one word is the difference between a headline and a fix.