HOUSE . . . . . . . No. 4844
The Commonwealth of Massachusetts
______________________________________
HOUSE OF REPRESENTATIVES, July 9, 2024.
The committee on Ways and Means, to whom was referred the
message from Her Excellency the Governor recommending legislation
making appropriations for the fiscal year 2024 to provide for
supplementing certain existing appropriations and for certain other
activities and projects (House, No. 4496), reports, in part, recommending
that the accompanying bill (House, No. 4844) ought to pass.
For the committee,
AARON MICHLEWITZ.
1 of 9
FILED ON: 7/9/2024
HOUSE . . . . . . . . . . . . . . . No. 4844
The Commonwealth of Massachusetts
_______________
In the One Hundred and Ninety-Third General Court
(2023-2024)
_______________
An Act providing protections for reproductive or gender-affirming care location information.
Whereas, The deferred operation of this act would tend to defeat its purpose, which is to
forthwith provide protections for reproductive and gender-affirming care location information,
therefore it is hereby declared to be an emergency law, necessary for the immediate preservation
of the public convenience.
Be it enacted by the Senate and House of Representatives in General Court assembled, and by the authority
of the same, as follows:
1 SECTION 1. The General Laws are hereby amended by inserting after chapter 93L the
2following chapter:-
3 CHAPTER 93M.
4 REPRODUCTIVE OR GENDER-AFFIRMING CARE LOCATION INFORMATION
5 PRIVACY PROTECTIONS
6 Section 1. As used in this chapter, the following words shall, unless the context clearly
7requires otherwise, have the following meanings:
8 “Application”, a software program that runs on the operating system of a device. 2 of 9
9 “Collect”, to buy, rent, receive, acquire, derive, obtain, infer, generate, create, receive or
10otherwise access an individual’s reproductive or gender-affirming care location information.
11 “Consent”, a clear affirmative act that signifies an individual’s freely given, specific,
12informed and unambiguous opt-in agreement. Consent shall not include: (i) agreement secured
13without first providing to the individual a clear and conspicuous disclosure of any information
14material to the consent, apart from any privacy policy, terms of service, terms of use, general
15release, user agreement or other similar document; or (ii) agreement obtained through the use of
16a user interface designed or manipulated with the substantial effect of subverting or impairing
17user autonomy, decision making or choice.
18 “Covered entity”, any person, partnership, corporation, limited liability company,
19association or other group, however organized, and all agents of the covered entity, that: (i) does
20business, produces or provides a service in the commonwealth; and (ii) collects, processes or
21discloses or has the ability to collect, process or disclose an individual’s reproductive or gender-
22affirming care location information. A covered entity shall not include: (1) a state or local
23government agency, any court of the commonwealth or a clerk, judge or justice of the court; or
24(2) an individual acting in a non-commercial context.
25 “Device”, a mobile telephone, as defined in section 1 of chapter 90, or any other
26electronic device that is or may be carried by or on an individual and is capable of connecting to
27a cellular, bluetooth or other wireless network; provided, that device shall include any hand-held
28or other portable electronic equipment capable of providing data communication between 2 or
29more persons, including, but not limited to, a mobile telephone, a text messaging device, a
30paging device, a personal digital assistant, a laptop computer, electronic equipment that is 3 of 9
31capable of playing a video game or digital video disk, equipment on which digital photographs
32are taken or transmitted or any combination thereof, or equipment that is capable of visually
33receiving a television broadcast.
34 “Disclose”, to make reproductive or gender-affirming care location information available
35to a third party, including, but not limited to, by selling, renting, sharing, publishing, releasing,
36transferring, disseminating, providing access to or otherwise communicating such reproductive
37or gender-affirming care location information orally, in writing, electronically or by any other
38means.
39 “Individual”, a natural person located in the commonwealth or who was located in the
40commonwealth at the time that their reproductive or gender-affirming care location information
41was collected, processed or disclosed.
42 “Location privacy policy”, policies, practices and procedures controlling a covered
43entity’s collection, processing, management, storage, retention and deletion of reproductive or
44gender-affirming care location information, as set forth in regulations promulgated by the
45attorney general pursuant to section 4.
46 “Permissible purpose”, as described in subsection (a) of section 2 and any regulations
47promulgated by the attorney general pursuant to section 4.
48 “Process”, to perform any action or set of actions on or with reproductive or gender-
49affirming care location information, including, but not limited to, accessing, using, storing,
50retaining, analyzing, creating, generating, aggregating, altering, correlating, operating on,
51recording, modifying, organizing, structuring, disposing of, destroying, de-identifying or 4 of 9
52otherwise manipulating reproductive or gender-affirming care location information. Process shall
53not include disclosing reproductive or gender-affirming care location information.
54 “Public safety release of information”, response to an emergency service agency, an
55emergency alert, a 911 communication or any other communication reporting an imminent threat
56to human life.
57 “Reproductive or gender-affirming care location information”, information concerning
58reproductive or gender-affirming health care services that: (i) is linked or easily linkable to an
59individual; (ii) is derived from a device or from interactions between devices, with or without the
60knowledge of the user and regardless of the technological method used; and (iii) pertains to or
61directly or indirectly reveals the present or past geographical location of an individual or device
62within the commonwealth with sufficient precision to identify street-level location information
63within a range of 1,850 feet or less; provided, that reproductive or gender-affirming care location
64information shall include any location information that could reasonably indicate an individual’s
65attempt to acquire or receive reproductive or gender-affirming health care services or efforts to
66research or obtain reproductive or gender-affirming health care services. Reproductive or gender-
67affirming care location information shall not include: (1) location information identifiable or
68derived solely from the visual content of a legally obtained image, including the location of the
69device that captured such image or publicly posted words; and (2) information that meets the
70definition of protected health information for purposes of the federal Health Insurance Portability
71and Accountability Act of 1996 and any regulations promulgated thereunder.
72 “Reproductive or gender-affirming health care services”, all supplies, care and services of
73a medical, behavioral health, mental health, surgical, psychiatric, therapeutic, diagnostic, 5 of 9
74preventative, rehabilitative or supportive nature relating to: (i) the treatment of gender dysphoria;
75or (ii) pregnancy, contraception, assisted reproduction, miscarriage management or the
76termination of a pregnancy.
77 “Service feature”, a discrete aspect of a service provided by a covered entity or service
78provider, including, but not limited to, real-time directions, real-time weather and identity
79authentication.
80 “Service provider”, an individual, partnership, corporation, limited liability company,
81association or other group, however organized, that collects, processes or transfers reproductive
82or gender-affirming care location information for the sole purpose of, and only to the extent that
83such service provider is, conducting business activities on behalf of, for the benefit of, at the
84direction of or under contractual agreement with a covered entity.
85 “Third party”, any covered entity or person other than: (i) a covered entity or service
86provider that collected or processed reproductive or gender-affirming care location information
87in accordance with this chapter; or (ii) the individual to whom the reproductive or gender-
88affirming care location information pertains; provided, however, that a third party shall not
89include a government entity.
90 Section 2. (a) No covered entity or service provider shall collect or process an
91individual’s reproductive or gender-affirming care location information; provided, however, that
92a covered entity or service provider may collect or process an individual’s reproductive or
93gender-affirming care location information if: (i) a covered entity or service provider provides
94the individual with a copy of their location privacy policy; (ii) obtains consent from the
95individual; provided, however, that clause (i) and (ii) shall not be required when the collection or 6 of 9
96processing is done for the public safety release of information; and (iii) is consistent with 1 or
97more of the following permissible purposes:
98 (A) provision of a product, service or service feature to the individual to whom the
99reproductive or gender-affirming care location information pertains when that individual
100requested the provision of such product, service or service feature by subscribing to, creating an
101account or otherwise contracting with a covered entity;
102 (B) initiation, management, execution or completion of a financial or commercial
103transaction or fulfill an order for a specific product or service requested by an individual to
104whom the reproductive or gender-affirming care location information pertains, including any
105associated routine administrative, operational and account-servicing activity such as billing,
106shipping, delivery, storage and accounting;
107 (C) compliance with an obligation under federal or any state law; or
108 (D) public safety release of information.
109 (b) No covered entity or service provider that collects or processes reproductive or
110gender-affirming care location information for a permissible purpose shall:
111 (i) collect more precise reproductive or gender-affirming care location information than
112necessary to carry out the permissible purpose;
113 (ii) retain reproductive or gender-affirming care location information longer than
114necessary to carry out the permissible purpose;
115 (iii) sell, rent, trade, gift or lease reproductive or gender-affirming care location
116information to third parties; 7 of 9
117 (iv) derive or infer from reproductive or gender-affirming care location information any
118data that is not necessary to carry out a permissible purpose; or
119 (v) disclose, cause to disclose or assist with or facilitate the disclosure of an individual’s
120reproductive or gender-affirming care location information to a third party, unless such
121disclosure is: (A) necessary to carry out the permissible purpose for which the reproductive or
122gender-affirming care location information was collected; or (B) requested by the individual to
123whom the reproductive or gender-affirming care location information pertains.
124 (c) No covered entity or service provider shall disclose an individual’s reproductive or
125gender-affirming care location information to any federal, state or local government agency or
126official unless: (i) the agency or official serves the covered entity or service provider with a valid
127warrant or establishes the existence of exigent circumstances that make it impracticable to obtain
128a warrant; (ii) disclosure is mandated under federal or any state law; or (iii) the individual
129requests such disclosure.
130 Section 3. (a) A violation of this chapter or a regulation promulgated under this chapter
131regarding an individual’s reproductive or gender-affirming care location information shall be
132deemed an unfair or deceptive act or practice in the conduct of trade or commerce under chapter
13393A.
134 (b) The attorney general may bring an action pursuant to section 4 of chapter 93A against
135a covered entity or service provider to remedy violations of this chapter and for other relief that
136may be appropriate.
137 Section 4. The attorney general shall promulgate regulations for the administration of this
138chapter, including, but not limited to: 8 of 9
139 (i) determining minimum requirements for inclusion in a location privacy policy,
140including, but not limited to: (A) reproductive or gender-affirming care location information that
141is collected, processed or disclosed; (B) specific reproductive or gender-affirming care location
142information that is disclosed or shared with a third party; (C) a list of the third parties that the
143reproductive or gender-affirming care location information is disclosed to; (D) any updates to the
144location privacy policy and notice to the individual; (E) if there are multiple permissible
145purposes, a disclosure of each such purpose; and (F) posting on the covered entity or service
146provider’s website and application the location privacy policy;
147 (ii) any limitations or restrictions on the use of targeted advertisements by a covered
148entity or service provider;
149 (iii) requirements for consent by individuals to the collection or processing of their
150reproductive or gender-affirming care location information, including, but not limited, to the
151duration of consent, any situations where consent shall be obtained again if a covered entity or
152service provider amends its location privacy policy and how consent may be revoked;
153 (iv) circumstances when reproductive or gender-affirming care location information shall
154be permanently destroyed;
155 (v) prohibitions on adverse actions by a covered entity or service provider against an
156individual because the individual exercised or refused to waive any rights under this chapter;
157 (vi) notice requirement for any disclosure of reproductive or gender-affirming care
158location information pursuant to subsection (c) of section 2; and
159 (vii) any other regulations necessary for the implementation of this chapter. 9 of 9
160 SECTION 2. The attorney general shall promulgate regulations pursuant to section 4 of
161chapter 93M, inserted by section 1, not later than 120 days after the effective date of this act.
162 SECTION 3. Section 1 shall take effect 1 year after the effective date of this act.