Massachusetts Data Privacy Bill Would Restrict Data, Breaking Key Small-Business Digital Tools

Data-powered tools like digital ads, analytics, and abandoned-cart reminders give small businesses an easy, affordable way to reach the right customers, compete with larger companies, and succeed. 

But a proposed Massachusetts data privacy bill, HB 4746, would seriously degrade the data-powered tools small businesses rely on every day to connect with customers and grow. 

The bill is concerning because it combines a broad definition of “personal data” with severe restrictions on that data’s collection and use — effectively cutting off the data that powers critically important small-business digital tools.   

A Broad Definition of “Personal Data”

HB 4746 defines personal data as any information “linked or reasonably linkable” to a person or their device. This definition is so broad that it covers virtually all data collected online, because most data is reasonably linkable to an individual or their device. Even something as basic as running a local ad requires an IP address — and IP addresses are “linkable” to an individual or their device. 

Proponents of HB 4746 like to point out that this definition of personal data comes straight from the California Consumer Privacy Act (CCPA), which is widely regarded as the gold standard in U.S. privacy law. But the CCPA — having broadly defined personal data — then only requires businesses to tell consumers how they’ll use such data, and give them the option to decline data collection.   

Stringent Restrictions on Data-Powered Tools

In sharp contrast to the CCPA, HB 4746 — having broadly defined personal data — then severely restricts how businesses can collect, process, and use it — threatening to break critical data-powered small-business tools like digital ads. Rather than focusing on sensitive data or specific harmful uses, or allowing consumers to opt out of data collection, the bill simply says businesses can only use a customer’s data to provide a product or service the customer has specifically requested. But a customer wouldn’t request that a business send them an ad for a product they might be interested in or email them a coupon for an item they’ve forgotten in their online shopping cart. 

That means HB 4746’s broad definition of personal data, combined with its strictest-in-the-nation limitations, would break many of the data-powered tools small businesses depend on, including:

• Email marketing analytics: When someone signs up for a small business’s email list, they don’t ask for their email open-rate to be tracked. But open rates are how small businesses and their email marketing platforms measure what’s working. Under HB 4746, that basic data could be off limits.
• Digital ads: When a small business runs an ad on Google or Meta, it sets parameters for who it wants to reach, like age-range, general location, and interests. The platforms need to collect and process data to make sure the ad reaches the right people, and to provide analytics that tell the small business which ads are working best. HB 4746 could prevent that, making ads far less effective.
• Abandoned cart reminders: When a customer puts something in their online cart and leaves a small business’s website, platforms like Shopify can automatically send a reminder email or coupon to increase the chance of a sale. Under this bill, that capability could go away, because the customer never explicitly requested a follow-up.

And despite an attempt from lawmakers to carve out small businesses, those businesses will still be affected because the restrictions would dramatically curtail the ability of small businesses’ larger digital partners — like Google, Shopify, and Constant Contact — to collect and process data, preventing them from providing the data-powered services small businesses depend on.

Bill Supporters Confirm: This Is Exactly What the Bill Is Designed to Do

Some supporters of HB 4746 have pushed back on these concerns, insisting the bill doesn’t impact small businesses or restrict data. However, the Electronic Privacy Information Center (EPIC) — the chief proponent and drafter of the language HB 4746 is based upon — has been explicit about its goals.

EPIC has celebrated the bill’s “meaningful limits on the personal data that companies can collect.” In testimony before the Massachusetts legislature, EPIC argued the bill would place “essential limits on data collection and use.” EPIC has also been explicit that HB 4746 contains stronger restrictions than laws in other states, including California, pointing specifically to its limits on collecting and processing personal data.

The bill is designed to break data-powered digital tools — and that means small businesses will no longer be able to use those tools to connect with customers, compete, and succeed. 

The Bottom Line

Protecting consumers’ privacy, giving people more control over their data, and limiting nefarious uses of data are all important goals. But HB 4746 goes far beyond those purposes. Its blanket restrictions on personal data — more severe than those in California, the EU, and most other states — would make it significantly harder for small businesses to use the digital tools they depend on to reach customers and stay competitive. Massachusetts small businesses deserve privacy laws that protect consumers without choking off critically important small-business digital tools.