Massachusetts is moving toward one of the toughest privacy rules in the country, and the location-data business should treat it as more than a local fight.
The Massachusetts House has sent a clear warning to companies that turn phone movements into revenue. In a unanimous 146-0 vote, lawmakers backed a consumer data privacy bill that includes a ban on selling precise geolocation data, pushing one of the most valuable corners of ad tech closer to a legal wall.
This is not simply another privacy proposal that sounds tough and then gets softened beyond recognition. The House version of the Massachusetts Consumer Data Privacy Act keeps the location-data ban, adds broader rights for consumers to know, delete and opt out of certain data uses, and gives people a private right of action against large data collectors in some cases. As CommonWealth Beacon reported, the House bill now has to be reconciled with a Senate version that passed unanimously in September 2025 before a final measure can reach Gov. Maura Healey.
For consumers, the issue is easy to understand. A phone knows where you sleep, where you worship, where you seek medical care and where you spend money. For startups and investors, the issue is more uncomfortable. A lot of business models were built around the idea that if location signals were collected through apps, cleaned up, aggregated and moved through enough partners, they could be treated as a commercial input rather than a sensitive record of a person’s life.
Massachusetts matters because it is aiming at the sale of the data itself. That goes further than the familiar model of privacy law, where companies can often keep collecting information as long as they disclose enough, offer opt-outs and avoid the worst practices. A ban on selling precise location data changes the economics directly.
That matters to mobile advertising networks, retail foot-traffic analytics firms, app developers, audience measurement companies and data brokers that sit between them. A startup that helps a retailer understand whether a campaign drove people into stores may still have a legitimate product. But if that product depends on buying or selling precise movement data about Massachusetts residents, the compliance question becomes a revenue question.
The likely adjustment is already visible in the market. Companies will lean harder on first-party data, consent-based collection, contextual advertising and aggregated analytics that do not expose a person’s movements. Some will rebrand old practices with cleaner language. That will not be enough if regulators and courts look at the actual data flow rather than the marketing deck.
Kochava is a useful example of why lawmakers are no longer treating this as theoretical. In May 2026, the Federal Trade Commission said it would prohibit Kochava and its subsidiary Collective Data Solutions from selling, sharing or disclosing sensitive location data without affirmative express consent as part of a settlement over allegations involving data from hundreds of millions of mobile devices. The FTC had already moved against Gravy Analytics, Venntel and Mobilewalla over sensitive location data. The message is plain: enforcement is catching up with what the industry long treated as normal.
Investors now have to price privacy risk
For venture capital, the Massachusetts bill adds a sharper diligence question. It is no longer enough to ask whether a company has a privacy policy and a consent screen. Investors need to know whether the product can survive if states keep removing sensitive data categories from the resale market.
That will hit some categories harder than others. A logistics software company using location to route drivers is different from a broker packaging device movements for advertising, government customers or foot-traffic intelligence. The first can often argue that location is necessary to deliver the service requested by the user. The second has a harder time explaining why a consumer should lose control of a sensitive signal so another business can make a better prediction.
The House bill also fits into a larger state-level pattern. California has long been the privacy benchmark. Virginia helped create a more business-friendly model. Maryland, Connecticut and other states have pushed their own approaches. Now Massachusetts is trying to add a tougher version from New England, just as Congress is again debating whether a federal privacy law should preempt state rules. A coalition of attorneys general and state agencies, including Massachusetts, opposed the SECURE Data Act this week because they said it would weaken stronger state protections.
That is the real market signal. In the absence of a settled federal standard, the strictest states increasingly shape national product decisions. A startup does not want one data architecture for Massachusetts, another for California and another for everyone else. So the practical standard becomes the rule that is hardest to ignore.
The bill is not law yet, and the conference process matters. Industry groups will push to narrow private lawsuits, soften restrictions and preserve more room for data transfers with consent. Privacy advocates will try to keep the House’s enforcement teeth and the location-data sale ban intact. Both sides understand that the final language could influence how other states write their own bills.
For founders, the takeaway is not that location data has no future. Maps, delivery, fitness, travel, safety and local commerce all still need location signals. The question is whether the user asked for that service, whether the data is necessary to provide it, and whether the company is quietly turning that signal into a tradable asset.
If Massachusetts follows through, the winners will be companies that can build useful products without treating human movement as inventory. The ones that cannot will discover that privacy compliance is no longer a legal afterthought. It is becoming part of the business model itself.
Also read: Teradata shows how AI spending is colliding with employee pay • GitHub Copilot turns custom model access into a startup opportunity • Utah residents take Kevin O'Leary's data center fight to court
