TechCrunch frames the Massachusetts law as a structural fix that succeeds where CCPA and VCDPA failed. Years of investigative reporting showed brokers like Veraset, X-Mode, SafeGraph, and Kochava resold geofeeds to bounty hunters, ICE, and even church groups outing priests — and FTC enforcement against Kochava and X-Mode did not stop the market. Cutting off the sale, not the disclosure, is presented as the only structural answer.
The editorial argues that the ad-tech industry's anonymization defense has been empirically dead for nearly a decade, citing the 2018 NYT investigation showing four data points uniquely identify 95% of people in a metro dataset and MIT's 2013 credit card study. Massachusetts is collapsing the legal fiction that geolocation is just another data class — at 1,850-foot resolution it reveals whether you're at a Planned Parenthood, mosque, or competitor's office, which is identity by another name.
The editorial highlights that what distinguishes Massachusetts from prior state privacy laws is the private right of action with $100–$5,000 statutory damages per violation, enabling class-action enforcement rather than relying on overworked AGs or the FTC. That enforcement design — not the substantive ban — is why ad-tech lobbyists fought this bill harder than any state privacy proposal since CCPA.
The submitter surfaced the TechCrunch story to a 312-point, 50-comment thread on Hacker News, signaling strong developer-community interest in the first US state law to treat geolocation as a categorically non-saleable data class. The submission framing emphasizes the 'bans sale' angle rather than disclosure or opt-out as the newsworthy shift.
Massachusetts passed the Location Shield Act on June 8, 2026 — a privacy bill that bans the sale of precise location data outright. This is the first US state law to treat geolocation as a categorically non-saleable data class, rather than something users can opt out of through a buried toggle. The bill defines "precise" as anything that can resolve a device to within 1,850 feet, which is roughly the resolution at which a data broker can tell whether you're at a Planned Parenthood, a mosque, or a competitor's office.
The TechCrunch report frames the law as a response to years of investigative journalism showing that location brokers — Veraset, X-Mode/Outlogic, SafeGraph, Kochava — were quietly reselling SDK-collected geofeeds to anyone with a credit card, including bounty hunters, ICE, and at least one church group that bought data to out gay priests. The FTC sued Kochava in 2022 and reached a settlement with X-Mode in 2024, but neither action stopped the broader market. Massachusetts's response is structural: cut off the sale, not the disclosure.
The enforcement mechanism is what makes this different from California's CCPA or Virginia's VCDPA. The bill grants a private right of action with statutory damages between $100 and $5,000 per violation. That's a class-action lawyer's dream — and the reason ad-tech lobbyists fought this bill harder than any state privacy proposal since CCPA.
The ad-tech industry's standard defense — "we anonymize the data" — has been empirically dead for at least eight years. A 2018 NYT investigation showed that four data points (home, work, and two stops) uniquely identify 95% of people in a metro-scale dataset. Researchers at MIT demonstrated the same thing in 2013 with credit card data. The legal system has just been slow to catch up to what every data scientist already knew: location is identity.
What Massachusetts is doing is collapsing the regulatory fiction that location data is a separable, consent-managed product. The bill treats geolocation more like HIPAA treats medical records — a class of data where the default is no commercial transfer, with narrow exceptions for the user-facing service that collected it (e.g., your mapping app can still route you). The shift is from "users must opt out of surveillance" to "the surveillance product itself is contraband."
The HN comment thread split predictably. One camp argues this kills hyperlocal advertising and the free apps it subsidizes; the other points out that hyperlocal ad targeting has near-zero proven lift over contextual targeting in independent studies, and that Apple's ATT prompt — which killed cross-app tracking on iOS in 2021 — did not measurably collapse the mobile ad economy. Meta lost ~$10B in attributable revenue, then recovered most of it by 2023 through on-device ML modeling. The lesson from ATT: location-data buyers will scream about catastrophe, then quietly migrate to first-party and contextual signals within 18 months.
The more interesting debate is jurisdictional. Massachusetts has 7M residents — about 2% of the US population. A broker can't easily build a Massachusetts-excluded dataset because IP geolocation is imperfect and SDK-level location is precisely what's being banned. Most brokers will end up applying the Massachusetts rule nationally, the same way GDPR became the global default for cookie banners. The companies that try to maintain a two-tier compliance posture will face the private right of action every time a Massachusetts resident's data shows up in a bought dataset — and discovery will be brutal.
If your app SDK collects location and your monetization stack includes any of the following, you have a compliance project on your hands by the bill's January 2027 effective date: Outlogic, Veraset, SafeGraph, Foursquare's Pilgrim SDK, AdSquare, Tamoco, Cuebiq, Near, Reveal Mobile, or any "audience enrichment" partner that quietly geofences. The contract-level question to ask your data team this week: does any downstream partner have the right to resell device-resolved coordinates from our users? If yes, that contract needs a Massachusetts carve-out or a kill clause.
For mobile developers specifically: the cleanest defense is server-side coarsening — never let precision below the 1,850-foot threshold leave the device unless the user is actively using a feature that requires it. This is what Apple's `CLLocationAccuracy` reduced-accuracy mode has offered since iOS 14, and what Android's `ACCESS_COARSE_LOCATION` permission was designed for. Most apps still request full precision out of habit. Audit your `Info.plist` and your manifest; the answer for 90% of consumer apps is that you don't need sub-block resolution.
For backend teams: assume the bill's definition of "sale" will be litigated broadly. The CCPA's narrow "sale" definition let brokers reclassify exchanges as "service provider" relationships and continue operating. Massachusetts's bill explicitly covers "sharing for valuable consideration," which sweeps in barter arrangements, data co-ops, and audience-extension deals. If your analytics vendor has a "data clean room" product that joins your location data with someone else's identity graph, that's almost certainly a sale under this statute.
The next 18 months will determine whether Massachusetts becomes the new California or the new Vermont. California set the national floor for privacy in 2018 because its market size made compliance non-optional. Vermont passed a strong data broker registry law in 2018 that the industry largely ignored because Vermont is small. Massachusetts is in between — big enough to matter, small enough that some brokers will gamble on geofencing compliance. The private right of action is the variable that resolves this: if the first class-action verdict lands at eight figures, expect Connecticut, New York, and New Jersey to copy the statute by mid-2027. If brokers successfully argue the bill is preempted by federal commerce law, the whole thing stalls until Congress acts — which means it stalls indefinitely.
What prevents law enforcement from collecting this data/other signals and anonymizing it and then running models against it? Are there any laws against this?
Feels like the word 'sale' may actually turn into a loophole. It should have probably been worded to use 'exchange' or 'transfer' instead. But this is progress.
Does this include vehicle data? That's a big one. Your new car selling you out constantly.
later in the article it said not only selling, but sharing.important because "sharing" is much more prevalent than "selling" data.that said, I wonder how "precise location", and statistics/algorithms will combine?for example, what if someone moves from zipcode 1 to
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
California very quietly passed AB-1542 last week which includes precise location data, health data, SSNs, etc. I expect many states to follow suit.Related, General Motors got hit with a $12.75M fine for reselling OnStar location data last month: https://ccpa.world/enforcement/gm-