1. ed.cafe
  2. AI safety guides
  3. Rules, Liability & MA Law
Rules, Liability & MA Law Includes: The ed.cafe No-Regret 40-Person Massachusetts AI & Personal-Data Inventory For Massachusetts small-business owners, nonprofit directors, HR leads & IT/ops managers

Massachusetts Data Privacy Act (S.2619 vs H.5479): What a 40-Person Organization Should Do Now

Compare the Massachusetts Data Privacy Act bills (S.2619 and H.5479) and run a no-regret AI and personal-data inventory for a 40-person team.

Constance Ibe-Whitmore The regulatory translator · ed.cafe editorial persona · Researched & verified by ed.cafe editors
Published · 13 min read (2,881 words)
ed.cafe guide banner: MA Data Privacy Act 40-Person Prep by Constance Ibe-Whitmore
Status as of October 2026: US federal & state rules (Massachusetts highlighted where distinct). Primary sources & sample sizes linked inline.

A composite scenario assembled from documented cases: In June 2026, the operations lead at a 40-person Worcester community services and retail cooperative read that the Massachusetts House had unanimously passed its comprehensive privacy bill (H.5479) on June 4, 2026, following the Senate's unanimous 40 to 0 vote on S.2619 on September 25, 2025 (MA Legislature S.2619; Foley Hoag, Jun 2026). Seeing the 60,000-consumer and 100,000-consumer headlines, she assumed a 40-staff organization serving 4,800 residents a year was exempt. Her team kept pasting client intake sheets, mobile GPS check-in logs, and billing files into freemium AI tools. A board attorney flagged three immediate traps: sensitive-data triggers pull smaller organizations into both bills regardless of general consumer counts, 201 CMR 17.00 already binds every entity holding even one Massachusetts resident's financial or ID record, and the Attorney General had already won a $2.5 million AI settlement under Chapter 93A (Mass.gov, Jul 10, 2025).

The short answer

As of October 29, 2026, the Massachusetts Data Privacy Act sits in a legislative conference committee reconciling Senate S.2619 and House H.5479, both carrying civil penalties up to $5,000 per violation. A 40-person organization can enter scope via sensitive-data triggers well below 60,000 or 100,000 consumers, while 201 CMR 17.00 already governs every workplace today; run the ed.cafe No-Regret Data Inventory below.

Waiting for conference-committee signatures before mapping AI data flows is a risky bet. Both S.2619 and H.5479 adopt Maryland-style strict data minimization rather than notice-and-consent banners, authorize up to $5,000 per violation in AG civil penalties under Chapter 93A, and regulate high-stakes AI profiling (Foley Hoag, Jun 2026). Federal preemption orders have canceled zero Massachusetts laws (see our federal preemption vs state AI law scoreboard). This guide compares the two State House bills and gives 40-person teams a 90-minute prep routine. It offers operational information, not formal legal advice.

Where do Senate S.2619 and House H.5479 agree and collide in conference committee?

Sent to a conference committee on June 17, 2026, Senate S.2619 and House H.5479 share a strict consumer-protection core while splitting on consumer floors, sensitive-data sales, cure periods, and private suits (MA Legislature S.2619; Foley Hoag, Jun 2026).

ProvisionSenate bill (S.2619)House bill (H.5479)40-person MA organization note
Vote & date.40 to 0 (Sep 25, 2025).Unanimous (Jun 4, 2026).Strong bipartisan enactment momentum.
Effective date.Jan 1, 2027 in draft.Jul 1, 2027 in draft.Conference sets final runway.
Consumer floor.60,000+ MA consumers (or 20,000+ with a 20% data-sale revenue threshold for firms).100,000+ MA consumers (or $100,000+ gross data-sale revenue).Web pixels count unique resident browsers, not just buyers.
Sensitive trigger.Specific health/reproductive categories regardless of size.Any covered sensitive data regardless of consumer count.40-person trap: Health, GPS, biometric, or minor data pulls small orgs in.
Minimization.Reasonably necessary and proportionate to requested service.Same strict necessity rule (not waived by fine print).Full-table CRM exports into AI break minimization.
Sensitive sales.Blanket ban on all sensitive data sales.Bans precise GPS sales; opt-in consent for other sensitive sales.Ad pixels on clinic or shelter pages risk sale violations.
Cure period.60-day cure (sunsetting Jun 2027).Zero cure period.Expect no warning window.
Enforcement.AG-only; up to $5,000/violation.AG up to $5,000/violation + private 93A suits vs large holders (2M+ consumers / 200K+ sensitive).Typical 40-person firms face AG scrutiny, not 2M private suits.

Two cross-cutting scoping rules stand out:

  • Employee and B2B records: Both bills target consumer records while leaving W-2 HR files and B2B contacts to existing Massachusetts statutes (201 CMR 17.00, M.G.L. c. 149, s. 52C, s. 19B, and c. 272, s. 99).
  • Nonprofits: Following neighboring Connecticut, New Jersey, and Maryland laws, general 501(c)(3) status grants no blanket pass when handling sensitive donor, patient, or client records (see our small-nonprofit AI policy guide).

How can a 40-person Massachusetts business or nonprofit cross the threshold without 60,000 customers?

Leaders often confuse "paid invoices" with "consumers processed" and miss the sensitive-data applicability prong (Foley Hoag, Jun 2026). Online identifiers, IP addresses, and newsletter leads count toward consumer totals.

Check three 40-person Massachusetts examples:

  1. Lowell B2B machine shop: 90 corporate accounts, static site (~4,000 annual visitors), zero health/GPS data. MDPA: Exempt. Today: Bound by 201 CMR 17.00 on 40 W-2 employee SSN/bank files.
  2. Somerville DTC retailer: 9,500 buyers, 38,000 MA email leads, and 52,000 unique MA ad-pixel visitors plus an AI skin-health quiz (99,500 MA profiles). MDPA: Crosses S.2619 (60,000) and triggers both bills immediately via sensitive health inferences.
  3. Dorchester social-services nonprofit: 3,200 clients with immigration, disability, and mobile GPS intake records. MDPA: Below 60,000 consumers, yet exposed under H.5479's zero-floor sensitive-data prong unless exempted in conference.

Covered sensitive data spans race/ethnicity, religion, physical or mental health diagnoses or inferences, biometrics/voiceprints, precise geolocation (~1,750 feet), citizenship/immigration status, union membership, genetic data, and minor data.

Why does "reasonably necessary and proportionate" data minimization break default AI prompt habits?

Legacy state laws allowed "tell them and take it" privacy policies. Both S.2619 and H.5479 mandate substantive data minimization: controllers may collect and process only personal data reasonably necessary and proportionate to deliver the product or service the consumer requested, with sensitive data restricted to what is strictly necessary (Foley Hoag, Jun 2026). Fine-print "AI improvement" waivers cannot legalize excess fields.

Think of building fire-load codes versus a doorway warning sign. Old notice rules let a shop stack fifty barrels of solvent indoors if a sign said "Solvents Inside." Minimization caps the shop at the single quart needed for today's job regardless of signage. Where that analogy breaks is cloud duplication: one pasted spreadsheet replicates into vendor prompt logs, abuse caches, and training pools unless enterprise processor locks are active.

Stop three workplace AI habits now:

What do profiling opt-outs, universal opt-out signals, and minor rules require when you run AI tools?

Both bills grant Massachusetts residents rights to access, correct, delete, port personal data, and opt out of targeted ads, data sales, and profiling for automated decisions producing legal or similarly significant effects (lending, housing, insurance, education, healthcare, essential services). Covered firms must honor browser Universal Opt-Out Mechanisms (GPC) and write Data Protection Assessments for sensitive data and high-stakes profiling.

Enforcement is already active under existing law: in July 2025, AG Campbell secured a $2.5 million settlement with Earnest Operations over AI loan underwriting under M.G.L. c. 93A (see our post-Earnest AI lending checklist), alongside the $2.275 million SafeRent tenant-screening settlement. If you cannot locate a resident's records inside AI prompts or vector stores, you cannot meet a 45-day deletion or opt-out deadline.

What already binds every 40-person Massachusetts employer today under 201 CMR 17.00 and Chapter 93A?

Even while conference negotiations continue, 201 CMR 17.00 (M.G.L. c. 93H) governs every business and nonprofit with zero headcount floor whenever it holds regulated Personal Information (resident name plus SSN, driver's license/MA ID, or financial/card account number) of even one Massachusetts resident, including your own 40 W-2 workers (Mass.gov 201 CMR 17.00).

Active 201 CMR 17.00 ruleLegal dutyWorkplace AI action for a 40-person team
17.03(1) WISP.Maintain a Written Information Security Program.Add an AI Red-Line Data annex to your WISP.
17.03(2)(a) Coordinator.Name a WISP coordinator.Assign one Ops/IT owner for AI approvals and DPAs.
17.03(2)(b)-(e) Access.Need-to-know access; revoke exited staff (17.03(2)(d)).Enforce SSO, ban shared logins, and rotate keys on exit.
17.03(2)(f) Vendors.Contractually require vendors to protect PI.Ban PI in consumer bots; sign zero-training Enterprise DPAs.
17.04(3),(5) Encryption.Encrypt PI in transit and on laptops/portable media.Enforce TLS, FileVault/BitLocker, and ban local raw CSVs.

IBM's 2026 Cost of a Data Breach study (n = 602 breached organizations, separate from 2025) found unapproved staff AI tools in 43% of security incidents (IBM, Jul 29, 2026). Tightening your 201 CMR 17.00 WISP today resolves active security duties while completing four out of five core steps needed for S.2619/H.5479 prep at a 40-person firm.

How do you run the ed.cafe No-Regret 40-Person Massachusetts AI & Personal-Data Inventory in 90 minutes?

Block 90 minutes with HR, marketing, and IT to complete the ed.cafe No-Regret 40-Person Massachusetts AI & Personal-Data Inventory. The ed.cafe Massachusetts AI & Data Inventory covers both State House drafts (60,000 vs 100,000 consumers and sensitive-data triggers) plus a ready-to-paste 201 CMR 17.00 WISP paragraph.

The ed.cafe No-Regret 40-Person Massachusetts AI & Personal-Data Inventory
THE ED.CAFE NO-REGRET 40-PERSON MASSACHUSETTS AI & PERSONAL-DATA INVENTORY
Verified: Oct 29, 2026 | 201 CMR 17.00 (IN FORCE) + MA S.2619 / H.5479 Prep
Publisher: ed.cafe by No Worker Left Behind (Boston 501(c)(3), EIN 88-3268312)
Operational worksheet for MA businesses & nonprofits; not formal legal advice.

PART 1: 5-MINUTE MASSACHUSETTS SCOPE SELF-CHECK
[ ] 1. Do we hold MA resident Name + (SSN, Driver's License/MA ID, or Bank/Card #)
       for >= 1 worker, donor, or buyer? -> YES = 201 CMR 17.00 WISP APPLIES NOW.
[ ] 2. Annual unique MA consumers across orders, email lists, + web analytics/pixels:
       [_______] (>= 60,000 hits S.2619; >= 100,000 hits H.5479).
[ ] 3. Do we collect/infer ANY sensitive data (health/mental health, precise GPS,
       biometrics/voiceprints, immigration/citizenship, race/ethnicity, minor data)?
       -> YES = Treat as IN-SCOPE under S.2619 / H.5479 sensitive-data triggers.
[ ] 4. Do we fire ad-tech pixels on pages touching health, GPS, or minors, or sell
       leads? -> YES = Pause/audit immediately (sensitive-sale ban + GPC opt-out).
[ ] 5. Do we use AI to score credit, housing, jobs, insurance, health, or school
       access? -> YES = Run Ch. 93A / c. 151B / s. 19B review + human override log.

PART 2: 8-COLUMN AI & SAAS DATA-FLOW INVENTORY (COMPLETE ONE ROW PER TOOL)
Columns: [Tool & Plan Tier | Owner | MA Data Subjects | 201 CMR 17.00 PI? (Must=NO
unless encrypted+DPA) | MDPA Sensitive Data? | Zero-Training Flag ON? | Signed
Vendor DPA on File? | 45-Day Delete & Export Tested?]

Sample 1: ChatGPT Business | Ops Lead | Anonymized drafts only | NO (banned by WISP)
          | NO | YES (Admin console verified) | YES (OpenAI DPA saved) | YES (30d purge)
Sample 2: HubSpot + AI | Marketing | 42,000 MA leads | NO | NO (stripped health tag)
          | YES | YES | YES (One-click contact erase + GPC header wired)
Sample 3: Zoom AI Companion | All Staff | Client calls | NO | Voice audio | YES |
          YES | All-party oral consent script mandatory per M.G.L. c. 272, s. 99

PART 3: DROP-IN 201 CMR 17.00 WISP GENERATIVE-AI ADDENDUM PARAGRAPH
"Generative AI & Minimization Control (201 CMR 17.03 / 17.04): Regulated Personal
Information under M.G.L. c. 93H (resident name paired with SSN, state ID/driver's
license, or financial account/card number) and sensitive health, biometric, or
precise-location records may never be entered into consumer or personal AI accounts.
Staff may process business records only in Company-approved enterprise AI workspaces
bound by a written Data Processing Addendum, TLS/at-rest encryption, SSO access
controls, and disabled vendor model-training settings, inputting only fields
reasonably necessary for the assigned task."

Want practical support training your Massachusetts staff on red-line data boundaries? No Worker Left Behind (Boston 501(c)(3), EIN 88-3268312) is forming Circle #1 at ed.cafe/start/, a free 30-chair cohort completing the Google AI Professional Certificate (free for Massachusetts residents through the Massachusetts AI Hub; Circle #1 closes December 1, 2026 and is pre-launch as of October 2026 with zero completed cohorts yet). Explore more templates in our Staff Room.

Where this stops being true

  • Conference committee amendments or session rollover: Because S.2619 and H.5479 sit in conference committee as of October 29, 2026, final compromise language may adjust consumer thresholds, nonprofit carve-outs, cure windows, or effective dates, or require refiling if unresolved at formal session close. Re-check malegislature.gov/Bills/194/S2619/BillHistory upon enactment.
  • HIPAA, GLBA, and FERPA entity vs data-level exemptions: Covered healthcare providers, financial institutions, and schools enjoy partial statutory carve-outs in both drafts, yet website tracking pixels outside the EHR (HIPAA bulletins) and state Chapter 93A claims still create liability.
  • Out-of-state customers: Even below Massachusetts consumer floors, serving buyers in New Hampshire, Connecticut, Maryland, or California can trigger those states' active privacy laws.
  • Not legal advice: Consult Massachusetts privacy or employment counsel before relying on statutory exemptions, responding to a Chapter 93A demand letter, or handling a M.G.L. c. 93H data breach.

Questions people ask

Has Massachusetts passed the Massachusetts Data Privacy Act as of October 2026?

Both chambers passed competing versions unanimously, sending the bill to a conference committee rather than the Governor's desk as of October 29, 2026. The Senate passed S.2619 (40 to 0) on September 25, 2025, the House passed H.5479 unanimously on June 4, 2026, and conferees were appointed on June 17, 2026 to reconcile differences.

What are the small-business thresholds in Massachusetts S.2619 vs H.5479?

Senate S.2619 covers entities processing data of at least 60,000 Massachusetts consumers (or 20,000 consumers with a 20% data-sale revenue share for firms). House H.5479 sets a 100,000-consumer floor (or $100,000 in gross data-sale revenue), but pulls in entities of any size that collect or process covered sensitive personal data.

Can individuals sue a 40-person company under the Massachusetts Data Privacy Act?

Under Senate S.2619, enforcement belongs exclusively to the Massachusetts Attorney General (up to $5,000 per violation). House H.5479 adds a private Chapter 93A right of action, but restricts private lawsuits to "large data holders" processing data of 2 million+ consumers or sensitive data of 200,000+ consumers, leaving typical 40-person firms under AG oversight.

Does Massachusetts already have a data security law that covers workplace AI?

Yes. Since 2010, 201 CMR 17.00 has required every business or nonprofit holding regulated Personal Information (name plus SSN, driver's license, or financial account number) of even one Massachusetts resident, including its own employees, to maintain a Written Information Security Program (WISP), encrypt data, and vet third-party vendors.

How does strict data minimization affect using ChatGPT or Claude at work?

Both S.2619 and H.5479 limit personal data collection and processing to what is reasonably necessary and proportionate to deliver the product or service the consumer requested. Uploading full customer spreadsheets containing birth dates, addresses, or health notes into an AI tool when anonymized text would work violates minimization regardless of privacy-policy wording.

Are Massachusetts nonprofits exempt from S.2619, H.5479, and 201 CMR 17.00?

Nonprofits are never exempt from 201 CMR 17.00 when holding Massachusetts employee, donor, or client SSNs or bank details, nor from M.G.L. c. 272, s. 99 all-party recording consent. Under S.2619 and H.5479, nonprofits handling sensitive health, location, immigration, or minor data should prepare for coverage unless specific statutory carve-outs apply.

Key terms

  • 201 CMR 17.00 (WISP rule): Active Massachusetts regulation requiring any entity holding a resident's name plus SSN, state ID, or financial account number to maintain a Written Information Security Program with encryption and vendor controls.
  • Conference committee (S.2619 / H.5479): Joint House-Senate negotiating panel appointed June 17, 2026 to merge the two chambers' privacy bills into one final enactment text.
  • Large data holder (H.5479): House bill tier (2 million+ consumers or 200,000+ sensitive-data consumers) exposed to private consumer lawsuits under M.G.L. c. 93A.
  • Strict data minimization: Rule limiting personal-data collection and AI processing to what is reasonably necessary and proportionate to provide the specific service requested by the resident.
  • Universal Opt-Out Mechanism (GPC): Browser or device signal (such as Global Privacy Control) that covered businesses must honor automatically as a valid opt-out of targeted ads and data sales.
  • M.G.L. c. 93A: Massachusetts Consumer Protection Act empowering the Attorney General to seek up to $5,000 per violation plus restitution and fees for unfair or deceptive AI and data practices.

Sources

  1. Massachusetts General Court (194th), "Bill S.2619: An Act Establishing the Massachusetts Data Privacy Act (Bill History & Conference Status)" (2025-2026): MA Legislature
  2. Foley Hoag LLP, "One Step Closer to a Massachusetts Data Privacy Law: Comparing the Current House and Senate Bills" (Jun 2026): Foley Hoag
  3. Office of Consumer Affairs and Business Regulation, "201 CMR 17.00: Standards for the Protection of Personal Information of Residents of the Commonwealth": Mass.gov PDF
  4. Massachusetts Attorney General's Office, "AG Campbell Announces $2.5 Million Settlement With Student Loan Lender Earnest for Unlawful Practices Through AI Use" (Jul 10, 2025): Mass.gov
  5. Massachusetts General Laws, "Chapter 93H (Security Breaches) & Chapter 272, Section 99 (Wiretap Interception)": c. 93H and c. 272, s. 99
  6. Cohen Milstein, "Louis v. SafeRent Solutions ($2.275M AI Tenant-Screening Class Settlement)": Cohen Milstein
  7. IBM Newsroom, "2026 Cost of a Data Breach Report (n = 602 breached organizations)" (Jul 29, 2026): IBM
  8. Massachusetts AI Hub (MassTech Collaborative), "Google AI Professional Certificate Program for Massachusetts Residents" (2026): Mass AI Hub
Rules, Liability & MA Law14 min read

Do You Need to Tell Customers You Use AI? A 2026 Channel Decision Tree

Wondering do you need to tell customers you use AI? Map chatbot, voice, email, state, and EU disclosure rules with copy-ready notices.

On-page decision-tree: The ed.cafe Customer AI Disclosure Decision Tree & Channel Copy Snippets

Constance Ibe-WhitmoreOctober 29, 2026
Free for Massachusetts learners

Finish Google's AI certificate with 30 neighbors in Boston.

Circle #1 is forming now (closes December 1, 2026; zero cohorts have run yet, and every completion count will be published two ways). Educators can run a Finish Line cohort in the Staff Room; L&D leaders can inspect license waste in the Council.