(Illustration by Canva AI)

RIGHT NOW, lawmakers in Massachusetts are hashing out the differences between House and Senate data privacy bills. Both bills completely ban the sale of our precise geolocation data, a huge win for residents and visitors.

Elsewhere, there are some important differences to be resolved. The Senate bill would ban the sale of other sensitive data, such as biometrics and information about health, sexual orientation, gender identity, and minors’ activities online. These are critical provisions that should be included in the final law.

Another key point revolves around enforcement.

Today, Massachusetts consumer protection law enables individuals to seek redress in court when companies violate their rights. Such accountability gives state law teeth and encourages compliance.

The House bill maintains this enforcement standard in the data privacy bill, giving individuals — as well as the attorney general — the right to take Big Tech companies to court over privacy violations.

If we want strong privacy protections in fact, and not just on paper, the conference committee should include the House’s enforcement language in the final bill.

Big Tech is lobbying fiercely to strip individuals of this “private right of action.” That’s no surprise: Their entire (very lucrative) business model is built around collecting, manipulating, trading, and selling extremely sensitive information about you, your family, and your neighbors.

This surveillance economy puts everyday people at risk. Anyone with a credit card can buy location data showing the travel patterns of health care providers and patients who seek abortion or gender-affirming care. In today’s political environment, that’s terrifying.

A strong data privacy bill would block these and other dangerous practices in Massachusetts.

The key word is “strong.” A law without a strong enforcement mechanism is more like a suggestion.

If the private right of action is stripped from the bill and enforcement is left to the attorney general alone, companies like Meta and Google won’t face meaningful accountability. Our AG is fantastic — but given her limited staff and the broad range of issues her office is responsible for, she simply does not have the resources to police every major privacy violation impacting Massachusetts residents.

Time and again, Meta has been caught egregiously violating consumer privacy. It has been slapped with significant fines and judgments. None of that has changed the company’s behavior. The threat of an occasional lawsuit from the Massachusetts AG likely won’t, either.

On the other hand, if the data privacy law empowers individuals to hold them accountable in court, tech billionaires like Mark Zuckerberg, Jeff Bezos, and Elon Musk will be forced to take the law seriously.

Consumers will hold them accountable in court. By making repeat violations of the law highly visible, those suits would also give courts incentive to go beyond imposing monetary judgments and start ordering Big Tech companies to change their behavior and abide by the law protecting Massachusetts residents.

Importantly, the House language permits consumer lawsuits against only the biggest data holders, companies that collect personal information on millions of Massachusetts residents. That provision ensures that we can hold the worst abusers responsible for violations, while shielding small- and medium-sized businesses from lawsuits if they make mistakes while handling consumer data.

There are a lot of important nuances for lawmakers to consider as they draft the final bill.

But the bottom line is that lawmakers have the power to stop Big Tech abuses — and they must seize the moment.

As things now stand, each of us is treated more like a product than a consumer. Meta, Google, and scores of data brokers you’ve never heard of stalk us across the digital and physical worlds, scraping tens of thousands of data points about every intimate facet of our lives. They then sell that data to advertisers, political campaigns, government agencies, scammers, stalkers — anyone with a credit card.

The harms from this surveillance economy are staggering: political manipulation, domestic abuse and stalking, the targeting of protesters and legal immigrants, the harassment of political foes, health care providers, and patients. When companies can gobble up data showing every place we go, 24/7, and sell it on the open market, it enables extremists to interfere with our basic rights and makes us all unsafe.

The Massachusetts consumer data privacy bill aims to put an end to Big Tech’s arrogance and abuse by returning power to the individual. It insists that companies respect our fundamental privacy rights, which are essential for our autonomy and even our democracy.

Voters have flooded the State House all year with calls, letters, and emails demanding a privacy law with real teeth. The only way to achieve that is to empower ordinary people to hold companies like Meta accountable if and when they violate our rights.

 We can end Big Tech’s abuses — but only if we have the courage to stand up to the tech oligarchs and maintain the strong standards of our consumer protection law when it comes to enforcing our data privacy law.

Kade Crockford is the director of technology and justice programs at the ACLU of Massachusetts.