00:00:00
Speaker 1: It's Nightside with Dan Ray on WBZ, Boston's news radio.
00:00:06
Speaker 2: Thank you very much, Madison.
00:00:07
Speaker 3: I hope you have a great weekend as well. I hope all of you out there who are fortunate enough to be off on the weekends have a great weekend and let's hope the Patriots somehow can pull a win out in Buffalo and of course the Red Sox are done until I don't know when depending upon the MLB potential lockout. We have Lots non-sports topics tonight. We are now well into year 20 here on Nightside. This is our second broadcast of our 20th year. We hit that milestone last night, and you will hear less and less about the milestone as we proceed, but I did want to mention it at least one more time. My name's Dan Ray. I'm the host of Nightside, as I say, the aptly named Nightside with Dan Ray. First one on the air on October 1st, 2007, and here we are, 19 years and two days later, it's October 2nd, 2026. For those of you who are keeping score or records of this at home, Rob Brooks is back in the control room along, assisted tonight by Ably, by associate producer Sam. So we have a full team here working ready for you. We're going to get you all the way until midnight. Before we get to our first guest, who's a friend of this program for many years, Cade Crockford. the Director of Technology and Justice Programs at the ACLU of Massachusetts. Interesting story at 9 o'clock. We are going to talk with Dr. Judy Hinchey. She is the Newton woman fighting to keep her 28.5-inch tall miniature horse at her home, in her yard, not inside her home. The city first gave her a permit. Apparently now it has revoked that permit. after Dr. Hinchey spent about $ 100, 000 building a shelter and fencing for Clover, a very cute miniature horse. And we will talk with Dr. Hinchey, and you'll have an opportunity to talk to her as well tonight. And then a very interesting guest at 10 o'clock, Mary Tamer. She is with a new group called Next Chapter Boston. They are very concerned about the adequacy of the scores, the test scores, that are being produced by students in the Boston Public Schools, and they feel that the test scores are so low that students are being cheated of an education, an adequate education in the Boston Public Schools, and Mary Tamer will make that case. The group Next Chapter Boston has just spent a lot of money with some MBTA ads, which were put up on some MBTA vehicles and then abruptly taken down. I know Channel 5 did the story tonight, and it's also We'll be in your Boston Globe tomorrow, and we have Mary Tamer, who is a former Boston School Committee member, and with Next Chapter Boston to talk about this. And there's a great deal of concern here. There's sort of a First Amendment question, which I'm not going to ask Cade Crockford about tonight, but I'm.
00:03:12
Speaker 2: Very tempted to, that this group, negotiated a.
00:03:18
Speaker 3: Contract with the MBTA, and now the MBTA has done a 180-degree turnaround.
00:03:23
Speaker 2: Not fair. We'll get into it.
00:03:24
Speaker 3: There's a lot more to it than I could do in that one- or two-minute synopsis. And then we will wrap it up in the final hour at 11 o'clock, as we do every week with the 20th hour, and we'll have a question for you, open-ended question, which hopefully will bring a smile to your face and a little bit of a jump in your step as we move across from Friday to Saturday morning. So without any further ado, let me welcome back Cade Crockford, the Director of Technology and Justice Programs at the ACLU in Massachusetts.
00:03:54
Speaker 2: Cade, welcome back. Nice to have you with us.
00:03:57
Speaker 4: Good evening, Dan. It's great to be here. Thanks for having me.
00:04:01
Speaker 2: Our pleasure.
00:04:01
Speaker 3: Now, there is a piece of legislation that the ACLU is very interested in up at Beacon Hill, It is called the Massachusetts Consumer Data Privacy Act. I am not anywhere near up to speed on this piece of legislation as you are, and I want you to be able to explain its purpose to our audience. And also, let's start with the progress of this legislation. This legislation has just passed the House, as I understand it, by a unanimous vote, which is very rare. And it has already passed the Senate last year. So, This legislation is on track to become law in Massachusetts. Is that an overstatement? Let's just deal with the progress portion of this question for starters. This is pretty close to becoming law.
00:05:00
Speaker 4: Yeah, that's right. So in September of last year, September of 2025, the Massachusetts State Senate passed comprehensive data privacy legislation. And then in June, close to the end of this legislative session, the House passed their own version of privacy. you know, similar legislation. And so in Massachusetts, your listeners are probably familiar with the reconciliation process. We call it a conference committee process in Massachusetts. So that's when the Senate president appoints three leaders to And the House speaker appoints three leaders. And those six people sit down and hash out the differences between the two bills and come up with what's called a conference report. In Congress, it's called a reconciliation bill. And then that legislation goes back to each chamber. We hope will be passed and then goes to the governor's desk for a signature. So yes, right now the legislation is in the conference process and lawmakers changed their rules this session to give themselves a little bit more time in previous legislative sessions. Conference committees had to wrap by July 31st of the second year of the session. Now, we've obviously passed that. We're into October.
00:06:17
Speaker 5: But this legislative session, lawmakers changed the rules and said, you know what.
00:06:23
Speaker 4: We're going to let conference committees hash it out through the end of the calendar year. So they have until December 31st. to, you know, come up with an agreement, ratify it in both chambers, and then send it to the governor's desk. And we are confident that they're going to do that. Yeah, we're very hopeful.
00:06:40
Speaker 3: It's great to know that they're going to work a full year, too. I assume they do get a full year salary. So this is important. And what people need to understand, as you said, that this reconciliation bill or this conference committee report, it's one piece of language. And any inconsistency can derail it, and hopefully they can come on this matter.
00:07:04
Speaker 2: So we've talked about the process. Let's talk about the substance.
00:07:08
Speaker 3: When we talk about this bill, it says if it passes, and hopefully it will, it would allow consumers, which means people like all of us, to access, correct, and delete certain personal information, limit targeted advertising to minors, and ban the sale of precise location data.
00:07:29
Speaker 2: So let's start off.
00:07:30
Speaker 3: Let's break that big chocolate chip cookie apart here. Let's talk about allow consumers to access, correct, and delete certain personal information.
00:07:42
Speaker 2: What are we talking about there, Kate?
00:07:46
Speaker 4: So let me actually, if it's all right with you, Dan, just back way up and start at the beginning of our process. So in Massachusetts, we are one of a number of states that have not passed any comprehensive data privacy legislation. Now, some states have. California has. Connecticut has. Virginia, Maryland. There are a number of states that have passed comprehensive data privacy laws. We do not have a federal law. state of privacy law. Congress has not gotten their act together to pass a modern 21st century consumer privacy law, but a number of states have. So in Massachusetts at the beginning.
00:08:28
Speaker 5: Of the legislative session a couple of years ago, two sessions.
00:08:31
Speaker 4: Ago, we were thinking at the ACLU, What is the most important consumer privacy issue that we could focus lawmakers' attention on and focus the public's attention on? And we zeroed in on the question of cell phone location data. Because unbeknownst to many people, there is a multi-billion dollar market for our precise cell phone location data. data. So in other words, anybody with a credit card can go to a data broker's website and buy information showing where you, your children, your parents, your neighbors, the governor, the state police, the colonel of the state police, and everyone else in the state of Massachusetts has been in the past and is currently right now. This is a huge threat It's a huge threat to each of our safety. Obviously, if somebody can track you everywhere you go, it could expose things about you to other people that you don't want them to know. Maybe you're getting cancer treatment at Dana-Farber and you don't want everyone to know that. Maybe you're going to Alcoholics Anonymous meetings in the basement of a church. And you don't want people to know that. Maybe you're skipping out of work and going to the beach and you don't want your boss to know that because you called in sick. There are a number of reasons why cell phone location data can be extremely damaging if it is revealed to people.
00:10:03
Speaker 5: Who shouldn't have any access to that information.
00:10:06
Speaker 2: So that information is gathered by your cell phone provider, I assume.
00:10:16
Speaker 5: Well, so there are a lot of different ways that this information leaks.
00:10:19
Speaker 4: Out to data brokers. One of the top means is actually through apps on our phones. Another one is through the online advertising industry. So basically, when you go to a website, if you go to BostonHerald.com on the browser on your phone, you're going to encounter a number of advertisements on that website. And because of the way that the online advertising system works, your.
00:10:46
Speaker 5: Location data is being harvested, not.
00:10:49
Speaker 4: Necessarily by Boston Herald, but by the ad company that is serving those ads on that website. And oftentimes it's Google. And so they're pulling your location data. And then companies are basically able to scrape that information from ad markets That's one way that this information leaks out. Another way is by people have downloaded apps on their phones, whether it's an app like Uber or Lyft or the McDonald's app. Obviously, people have tons of apps on their phones. Many of these apps have a side business of selling.
00:11:29
Speaker 5: Your location data.
00:11:30
Speaker 4: So there are a number of different ways that data brokers access this information. You raised the question, Dan, is it coming from our telecoms? And unfortunately, in the past, it has. eMobile got in trouble a number of years ago for selling its consumers telecoms. cell phone location data to data brokers. And so, yes, there are a number of different ways that information reaches these brokers. But the point is that the brokers basically clean the data, they analyze it, they sort of compile it, and then they resell it to really anyone. And so we were concerned about this, our allies in the domestic violence space, Jane Doe, which is the state's leading anti-domestic violence organization, was concerned about this for obvious reasons. We even had members of our coalition who were national security types who were concerned about this.
00:12:24
Speaker 5: There's a lot of sensitive research.
00:12:25
Speaker 4: That happens in Massachusetts. Probably not a good idea for foreign governments to be able to track remotely the, you know, the activities of all of the people who work at MIT Lincoln lab.
00:12:36
Speaker 5: Right.
00:12:36
Speaker 2: Okay. Let me, let me, let me just pause you.
00:12:38
Speaker 4: Yeah.
00:12:39
Speaker 2: Let me, if I can pause you guys, I got to take a quick break. Sure.
00:12:42
Speaker 3: What's great about you is that you speak in language that people are going to understand. And I'm learning, listening to you, which is very important for me to understand. And I'm just beginning to absorb this. Let's take a break. When we come back, I again want to make sure people understand that as great as cell phones and smart phones are, there needs to be a piece of legislation that you folks have spearheaded and that I support, and I would hope everybody in this audience would support, witness the unanimous vote by the House of Representatives. They are never, hardly ever, unanimous. My guest is Cade Crockford. Cade is the Director of Technology and Justice Programs at the American Civil Liberties Union of Massachusetts. We'll be back with Cade. I hope you continue to listen and understand what Cade is saying because it's information that all of us should understand. If you have any questions, if you want to make a comment, 617-254-1030. We will get to phone calls. I promise, not right away. I want to allow Cade to finish with her explanation, which is an excellent, excellent Really, it's almost like a seminar for us about something that we probably haven't thought much of. I've learned a lot in the last seven or eight minutes, and I hope you have too. Back with Cade Crawford on Nightside, 617-254-1030 or 617-931-1030. Coming back on Nightside. Nightside with Dan Ray on WBZ, Boston's news radio. My guest is Kate Crawford. Kate, I apologize for interrupting there, but we have to do these commercials.
00:14:28
Speaker 4: Not at all.
00:14:29
Speaker 3: But let me just sort of recap what you've told us. That somehow, because of the cell phones that we carry with us portably in our cars, on our persons, our comings and goings are recorded. Correct?
00:14:48
Speaker 5: Mm-hmm.
00:14:49
Speaker 2: Okay. Is it the phone company that... has that information initially? Who records that information? Who compiles that information?
00:14:59
Speaker 3: Is it these data companies that buy the information from the phone company? I'm just trying to understand first base, second base, third base, home plate, how they get from the batter's.
00:15:10
Speaker 1: Box to home plate.
00:15:12
Speaker 4: For the most part, it's app companies and information that is leaking out of the online advertising industry.
00:15:21
Speaker 3: So, so it's not as if the phone, it's not as if Verizon or, or, or Comcast, the phone companies give the information, but the apps that we voluntarily put on our phones, you know, I, I have, you know, an app on my phone for my gym. I have an app on my phone for my grocery store. I have an app in my phone, maybe for ways for, as you said, Those are the sources that the data companies work with to harvest the data?
00:15:52
Speaker 4: Yes, a number of app developers. put special software in their apps that sends the location data of the person's phone to data brokers automatically. It also leaks out through online ads. So it's not necessarily only happening through apps. It can also happen through your web browser. And in the past, cell phone companies have actually sold their customers' location data to data brokers. So I wouldn't want to say necessarily that that is not happening now. I don't have any evidence that it's happening now, but it has happened in the past.
00:16:29
Speaker 2: So that is a major problem.
00:16:31
Speaker 3: One other side question here, okay? And again, I want you to get back to this seminar because it's fabulous. One other side question. I assume that law enforcement uses this information, whether, you know, I agree with it, you agree with it, that if, let us say, someone has robbed a bank and they have a cell phone on them, I assume that.
00:16:57
Speaker 5: So that's a great question.
00:16:59
Speaker 2: Okay.
00:16:59
Speaker 4: That's a separate process. In Massachusetts, we have a law that was established by, yes, the Supreme Judicial Court in a number of cases. We also have... law that was established by the Supreme Court of the United States in a seminal case called Carpenter versus United States that says the police have to get a warrant to go to your cell phone company and demand information about where you were last week, last month, last year, or to track you in real time. That is a separate matter from the question of whether government agencies are going around the Fourth Amendment requirement and directly buying this information from data brokers. We have no evidence that that is happening among state and local law enforcement in Massachusetts. And frankly, they better not be doing it because that is flatly unconstitutional. There is some evidence that the federal government is currently doing that.
00:18:00
Speaker 5: So yes, that's a huge problem.
00:18:02
Speaker 4: It is a huge problem.
00:18:03
Speaker 5: And- And it's one of the reasons, frankly, why we need to regulate this industry.
00:18:09
Speaker 4: So what are we trying to accomplish? We are saying at the ACLU and our big coalition, which includes groups like Jane Doe, our statewide anti-domestic violence organization, and many other groups. We have been asking the legislature, you have to stop this. You have to stop companies from selling our precise geolocation data. Now, we're not saying that companies can't offer you services that provide you with important data. location technologies like mapping, right? We all use mapping technologies on our phones. We all use location services on our phones. What we are saying and what the legislature is now saying in bills passed by both the House and the Senate is that it's okay for a company to collect your precise geolocation data if they need it to provide you with a service that you've requested. So let's take Google Maps as an example. If you download Google Maps on your phone and you give them permission to track your location, you are saying, I want to know how much traffic there is on the way to my destination.
00:19:17
Speaker 2: How long it's going to take me to get from where I am now to.
00:19:23
Speaker 3: The question then becomes, okay, along that trip, you stop here, you stop there, maybe you go into a liquor store, I don't know, whatever. You've given them permission to route you, to help you get from point A to point B, but you haven't given them permission to sell the information about which way you.
00:19:45
Speaker 2: Might have gone.
00:19:45
Speaker 5: That's exactly right.
00:19:47
Speaker 2: Okay, or where you have stopped along the way. Okay, good. Okay.
00:19:51
Speaker 4: That's right. So that's what we're saying is, look, we all want to be able to use... effective modern technology that helps us, right? So we're not trying to stop Lyft and Uber from collecting our location data to provide us with a service, right? We're not trying to stop Google Maps or Apple Maps from collecting our location data if we want them to tell us the best route to get somewhere and how much traffic there is. That's fine. What we're saying is it ought to be illegal... for them to turn around and sell that data to a third party that you've never heard of, some data broker who can then turn around and sell it to anybody with a credit card, right? So we are essentially saying we have to stop this abusive practice that has been operating in the shadows for many years and endangers people every day. And thank God, the vast majority of the public and all legislators in Massachusetts agree with us. And so that is one of the central pieces of this legislation. It says you can collect the data to provide someone with a service. You cannot then turn around and sell it.
00:20:57
Speaker 5: So that's about precise geolocation data.
00:20:59
Speaker 4: There's a lot of other information.
00:21:02
Speaker 2: We're going to get to that.
00:21:03
Speaker 3: I have to stop because we have a newscast at the bottom of the hour and a couple of commercials. I promise I'm following. You've been really clear. And I think this is a tremendous service that you have provided to make people understand exactly the implications of this legislation. I think this has been extraordinary, and I know I've learned a lot in the last 25 minutes, and I'll learn more in the balance of the hour.
00:21:26
Speaker 2: Katie, you can stay there. We've got about a.
00:21:28
Speaker 3: Four-minute break for news and a couple of commercials, and we'll be back and we'll continue the conversation and continue the seminar right now, which I hope people are listening to because there are some incredible dangers inherent in this, and there's no benefit to the citizens other than aggravation.
00:21:46
Speaker 2: We'll be back with Kate Crockford.
00:21:49
Speaker 3: She is the technical director, I should say, the director of technology and justice programs at the ACLU of Massachusetts. If you have a question, as I learned in law school many years ago, no question is too dumb to ask. The only questions you don't ask are the questions that you don't have the courage to ask because those are the ones that on the bar exam and on law school exams always will come back to haunt you. We're back on Nightside, 617-254-1030, 617-931-1030. Back with Cade Crockford, a very smart lawyer who knows a lot about these issues, and she is explaining it extraordinarily well tonight.
00:22:30
Speaker 2: Back on Nightside.
00:22:34
Speaker 1: Nightside with Dan Ray on WBZ, Boston's news radio.
00:22:40
Speaker 2: We're back with Cade. Crockford.
00:22:42
Speaker 3: Cade is the Director of Technology and Justice Programs at the ACLU of Massachusetts, and we are talking about a bill that will allow consumers to access, correct, and delete certain personal information, limit targeted advertising to minors, and ban the sale of precise location data. So if this legislation passes, is there anything that now there will be an affirmative obligation on consumers to do to have their data that maybe has been collected and then disseminated by data brokers, is there an affirmative obligation on us as individual consumers to make sure that those materials are deleted, or will it be done automatically if this legislation passes, Cade?
00:23:31
Speaker 5: That's a great question, Dan.
00:23:32
Speaker 4: And it actually speaks to one of the core elements of the legislation that we're hoping lawmakers will agree to. And that is this concept called data minimization. Now, with respect to the sale of our location data, consumers won't have to do anything. There will simply be a law that says companies cannot sell this data, period. You will have those legal protections no matter what. And we think that similar legal protections ought to apply more broadly to other types of data. So let's talk about what those types of data are. We call them in the legislation sensitive data. Now, this is things like information about children, information about someone's veteran status, information about your health, because something that a lot of people don't realize is that health information that is collected by Fitbit, your heart rate, exercise data, women who use Apple Health to track their menstrual cycles, none of that is protected by our federal health privacy law because that law, HIPAA, only applies to healthcare providers. It does not apply to technology companies. So there's a larger.
00:24:51
Speaker 5: Category of sensitive information. And the Senate, in their version of the legislation.
00:24:57
Speaker 4: That the Senate passed, actually bans the sale of all of those types of sensitive data. So we're hoping that in the conference report, the House will agree to that Senate provision to say, you know what, we should go beyond precise geolocation data and prohibit the sale of these other types of sensitive information as well. There's one other piece.
00:25:18
Speaker 5: That I want to make sure your listeners hear, which is this concept of data minimization.
00:25:22
Speaker 4: And basically, because you asked about what action do consumers have to take You know, if you've ever visited a website and seen a pop-up that says, select your privacy choices, and there's another pop-up that you can choose, and then there are five or six different choices that you can make, it's a really confusing situation for a lot of people. And most of us just click the.
00:25:46
Speaker 5: First thing to make it go away so that we can access the content or the website or the app that we're.
00:25:52
Speaker 4: Trying to access. That system doesn't really work. And So we're not trying to adopt here in.
00:25:59
Speaker 5: Massachusetts a consent-based.
00:26:02
Speaker 4: Click-as-you-go model, because just as you asked, Dan, that really does put the burden on individuals. And we think that consumer data privacy is such an important issue that actually the burden should be on the companies, not on individuals, and that there ought to be baseline protections in the law limiting how much and what type of information companies can collect about us, and then limiting what they can do with that information. So that framework is known as data minimization. And the analogy that I like to use is like this. When you go to the store and you buy milk for your family, You do not then take home.
00:26:43
Speaker 5: The milk and break out your.
00:26:45
Speaker 4: Chemistry set to test it to see if there's fecal matter in it. You just drink it and you just give it to your kids, right? And you do that because there are laws that say that companies have to sell safe milk. And we have government officials who test the milk to make sure that it's safe to drink, right? And so we think a similar dynamic ought to apply in the privacy context, where you can just use.
00:27:10
Speaker 3: Technology- You're going too fast for some people, and what you were talking about there is the Food and Drug Administration, which is a federal administration.
00:27:19
Speaker 5: That's right, but we also actually have state-level agencies that are.
00:27:22
Speaker 4: Involved in milk testing. So anyway, the point is that the burden should not be on the individual technology user, just like the burden is not on the individual consumer of groceries. to ensure that we are not being abused, that our information is not being repackaged and sold and used in all these ways to manipulate us on the Internet. There ought to be baseline protections in statute, in the law, that apply to all of us. So that your elderly grandmother, your 10-year-old kid who just got a smartphone, people who don't speak English as a first language, and frankly, even those of us middle-aged people who speak English very well but don't have the time to read every privacy policy on every website or for every app that we want to use, can also have digital privacy in the year 2026 and beyond. So that's one of the core pieces of.
00:28:16
Speaker 5: The legislation that we're hoping lawmakers will agree to in conference.
00:28:21
Speaker 3: I have noticed recently many more prompts where they will say, in order to use this app, we need your location. And you have to give them permission in order to use the app. I'm sure you know of what I'm speaking. Clearly, if you're downloading Google Maps or you're using Google Maps or Waze... they need to know your location in order to start you from.
00:28:54
Speaker 2: Point A to point B.
00:28:55
Speaker 3: In many cases, you'll put in your location, but then this other, um, uh, I, I know websites that you go to or whatever are apps.
00:29:04
Speaker 2: And, you know, it would be, if you're looking.
00:29:07
Speaker 3: For, uh, on, on a shopping website, if, if you're looking at Brooks brothers or something like that there, and I'm not saying Brooks brothers does this, but, uh, what would seem to be a, an app or a website that would have.
00:29:20
Speaker 2: No need for your location.
00:29:22
Speaker 3: They, they prompt you, you know, in order to use this, is that something that is becoming more common, Cade? And is that part of what is going on that we sort of are, we meaning the public have been asleep at the switch on?
00:29:39
Speaker 4: Well, look i don't want to blame the public i mean there's a lot to be concerned about right gas prices are out of control everything's expensive people are trying to survive in an economy that's really stressful right so like no no but what.
00:29:52
Speaker 3: I'm saying is if we if we all Yeah, if we all were so smart that we could never be tricked, okay, which we aren't.
00:29:59
Speaker 2: I mean, I'm not.
00:30:00
Speaker 5: You probably are, but I'm not.
00:30:02
Speaker 3: So what I'm saying is I've noticed more of this stuff coming up, what I would call geolocation.
00:30:07
Speaker 2: Am I off base when I say that?
00:30:11
Speaker 4: No, you're right. And look, something that people really ought to know is that increasingly companies are charging people consumers different prices for the same goods based on data that they collect about us.
00:30:25
Speaker 5: So one of the reasons that a shopping website might say, hey, can we track the location is because.
00:30:31
Speaker 4: They want to know your income and they can guess how much money you have.
00:30:37
Speaker 5: By where you are physically located in space, right?
00:30:41
Speaker 4: If you are physically located in Wellesley or Dover, maybe they're going to charge you more because they know that you can pay more, right? And, you know, if you're physically located in Chelsea, they don't charge you sort of.
00:30:54
Speaker 2: And you're voluntarily giving up that information.
00:30:58
Speaker 4: Well, yes and no.
00:31:00
Speaker 5: I mean, the problem is that.
00:31:02
Speaker 4: In many of these situations, we actually don't have a choice. We don't have any consumer privacy rights right now in Massachusetts. So if you go to a website, you don't have a choice about whether or not.
00:31:15
Speaker 5: They're collecting certain data about you.
00:31:18
Speaker 4: And even if you do on that particular website... You don't have any way to opt out of the data broker industry of these companies that are buying and selling and trading your information, which is why we need the state to step in. So I just want to say one more thing, which is that the other key issue here that lawmakers have to work out is how this bill is going to be enforced, how this legislation is going to be enforced. And this is a.
00:31:43
Speaker 5: Massively important issue.
00:31:45
Speaker 4: Because we on the consumer protection side are are arguing that the enforcement language in this privacy bill ought to look just like or similar to the enforcement language in our state consumer protection law. So that's Chapter 93A. This is the law that basically makes it illegal for a company to lie to you about the product that it's selling you. That's the unfair and deceptive practices law.
00:32:15
Speaker 5: So this is the law that protects you when you go to a car.
00:32:18
Speaker 4: Dealership and the dealer tells you this is a brand new car. It has no miles on it. It's great. It gets 40 miles to the gallon. If you then buy that car and take it home and you take it to your mechanic and your mechanic tells you, I hate to break it to you, buddy, but you got sold a lemon.
00:32:34
Speaker 5: This car actually.
00:32:35
Speaker 4: Has 50,000 miles on it. It's a piece of crap. You can sue that dealer. You do not have to wait or go to the attorney general and say, hey, A.G. Campbell, this dealership stole my money. They lied to me. You can go and get a lawyer and sue them yourself, and you can not only get your money.
00:32:53
Speaker 5: Back, but you can get triple damages, right?
00:32:57
Speaker 4: I'm very much aware of that. Exactly. So we think similar protections ought to apply in the consumer privacy context.
00:33:05
Speaker 1: And why?
00:33:05
Speaker 4: It's very important because the biggest technology companies in the world, Meta, Amazon, Google, these are the companies that are most incentivized to violate the privacy law because their business is about collecting information and manipulating information, right? And so if the only entity In the state, who can enforce this law is the Attorney General, which is what the industry wants. This is what big business wants. They want the AG to.
00:33:35
Speaker 5: Be the only one who can enforce the law.
00:33:37
Speaker 4: If that's the case, those big companies are gonna make a dollars and cents calculation. And they're gonna say, look, we might get sued by the AG every 10 or 20 years. We can dry it out. We might pay even a $ 5 billion settlement. is worth it to us because we will make more than $ 5 billion by violating the law.
00:34:01
Speaker 2: They would call it the cost of doing business.
00:34:04
Speaker 4: That's right. The cost of doing business. So it is essential that this law have what is called a private right of action that allows you as the consumer to hire your own lawyer and sue one of these companies if they violate your rights. And the House... in their version of the legislation included a limited private right of action that would not impact small businesses. They were concerned about, you know, small businesses making mistakes with computers and stuff like that. And they were like, look, we don't want to penalize small business too harshly. But it is important, the House thought, that we ensure these big companies, OpenAI, Anthropic, Microsoft, Google, Amazon, Meta, these huge technology companies that earn, for Meta, hundreds of billions of dollars a year. It is essential that we allow consumers to sue those actors if they violate the statute. We're hoping that at the end of this conference process, we'll see really strong legislation with strong protections. We like a lot of what the Senate did on that side with strong enforcement language that comes from the House.
00:35:12
Speaker 2: My guest is Cade Crockford.
00:35:14
Speaker 3: Cade is the Director for Technology and Justice Programs at the ACLU of Massachusetts.
00:35:20
Speaker 2: We have been.
00:35:21
Speaker 3: Discussing for 40, 45 minutes here. all sorts of legislation, one major piece of legislation that has passed both the House and Senate and is heading to conference committee that would give all of us, Massachusetts residents, greater control over our personal information and strengthen protections against the misuse of our sensitive data. When I come back, I'm going to ask you a very quick question, and I know you'll know the answer, so save it until we have to take a couple of more commercials and then we can wrap it. If anyone has a question, The phones have been quiet, which always means to me, Kate, people are listening attentively. And I do appreciate that. But if you have a question, now's the time to call 617-254-1030. My question is, if this legislation passes, it will protect people in Massachusetts. Will it also protect Massachusetts residents when we leave Massachusetts and go visit relatives in New York or Connecticut or places where There is not similar legislation. We'll talk about that. That will be my question coming back. Back with Kate Crawford of the Massachusetts Civil Liberties Union, or the American Civil Liberties Union of Massachusetts, right after a couple of quick messages, and then we'll wrap up. We do have a guest coming up at 10 o'clock. We will be changing topics, so if you want to get in, dial now or forever hold your peace.
00:36:42
Speaker 2: Coming back on Nightside.
00:36:44
Speaker 1: It's Nightside with Dan Ray on WBZ, Boston's news radio.
00:36:49
Speaker 3: My guest is Cade Crockford of the American Civil Liberties Union of Massachusetts. All of a sudden, Cade, the phones have exploded. And so I'll ask the question of you quickly. Will these protections of Massachusetts residents extend to Massachusetts residents when they are outside the Massachusetts?
00:37:10
Speaker 5: Yes.
00:37:11
Speaker 2: Okay, that's great. That is very good.
00:37:13
Speaker 1: Okay.
00:37:13
Speaker 2: Okay.
00:37:14
Speaker 3: We're going to go to the calls. We have three calls. I hope to get them all in. Steve, a veteran caller is going to set the pace. Steve, we're tight on time. Everyone has called in late.
00:37:25
Speaker 2: Go ahead, Steve.
00:37:26
Speaker 6: Everyone I know uses Amazon. They get extraordinarily inexpensive prices. They get unbelievably fast delivery. And anything they can possibly imagine they want, they get. Yet everybody hates Amazon. What does, I mean, does the American public think that it's all a one-way street that they just take, take, take? Don't they understand that these companies are not charitable organizations and they use them all the time, all day long?
00:38:02
Speaker 3: Okay, all right, all right, Steve. Steve, I understand the question. Kate, can you give a quick answer?
00:38:08
Speaker 2: Go ahead.
00:38:10
Speaker 5: Yeah, Steve, Amazon does a ton of different business, as I'm sure you know.
00:38:13
Speaker 4: What we're talking about in this consumer privacy legislation would not impact your ability to buy goods from Amazon or impact Amazon's ability to deliver those goods to you. This is about the data side of the operations that companies like Amazon and Google and Meta are using. And I think the larger kind of subtext to.
00:38:38
Speaker 5: Your question is, Isn't this the business.
00:38:40
Speaker 4: Model of the modern Internet? And the answer is yes, but it doesn't have to be. It's only the business model of the modern Internet because companies like Google and Meta made it that way. And our democracy hasn't responded effectively.
00:38:55
Speaker 2: There are many other.
00:38:56
Speaker 4: Ways that the Internet could work.
00:38:58
Speaker 2: Let me pause it there, Steve. You made your point. I understand it. I think Cade responded. We'll save a longer conversation for next time, OK? Thank you, Dan. Thank you. Thank you very much. Ann and Milton. Ann, you've got to be quick for us. I have one more behind you. Go ahead, Ann.
00:39:14
Speaker 1: I will be.
00:39:15
Speaker 6: Is this information collected when the phone is turned off?
00:39:19
Speaker 4: No.
00:39:21
Speaker 3: No.
00:39:22
Speaker 2: Good question.
00:39:22
Speaker 4: The only people who can track your phone when it's off is the National Security Agency.
00:39:28
Speaker 2: All right. Great question.
00:39:30
Speaker 1: Ann.
00:39:30
Speaker 2: And you were quick. Thank you.
00:39:33
Speaker 3: That will allow us to get to Brian in Michigan. Brian, you have 40 seconds.
00:39:38
Speaker 2: Go ahead. You got to be quick.
00:39:40
Speaker 7: I'll make it very quick. Two quick questions. Is there any federal law in place or proposed to do this in Massachusetts?
00:39:47
Speaker 3: No.
00:39:49
Speaker 2: States have done it earlier. You can re-listen.
00:39:51
Speaker 3: Anyone can re-listen to this hour, and you should, at Nightside on Demand over the weekend.
00:39:56
Speaker 2: But Cade answered that. What's the second question, Brian?
00:40:00
Speaker 7: The second question is about every month we are prompted to update our apps. And I never know why I'm updating it. Are they sliding things in those updates that would be part of this whole discussion?
00:40:12
Speaker 2: Great question.
00:40:12
Speaker 4: You know, you ought to update your apps because oftentimes app updates include important security fixes. So I would encourage you.
00:40:21
Speaker 5: To download updates to apps.
00:40:24
Speaker 4: This, again, is why we need a law to protect consumers because we shouldn't have to mistrust our technology. And right now.
00:40:32
Speaker 5: We have a lot of good reason.
00:40:33
Speaker 4: To do it.
00:40:34
Speaker 2: The news is here. Brian, thank you, sir.
00:40:37
Speaker 3: Call again. Listen over the weekend. Nightside and Demand. This was a brilliant hour, Kate. I can't thank you enough. How can folks get in touch with you? Give us the website real quickly, and then we've got to run.
00:40:47
Speaker 4: ACLUM.org.
00:40:51
Speaker 2: Thank you so much, Kate. We'll have you back. This was really a great hour. Thank you. I hope people listen to it over the weekend. You're more than welcome.
00:40:58
Speaker 3: Kate Crockford of the American Civil Liberties Union of Massachusetts. I know we've slipped into the news. are almost into the news. To the three callers, Steve, Ann, and Brian, thank you for being cooperative.
00:41:08
Speaker 2: Call earlier. We'll be back.
00:41:10
Speaker 3: We're going to talk about a little horse, a mini horse, and its future in Newton, Massachusetts.
00:41:17
Speaker 2: Coming back.
Speaker 1: It's Nightside with Dan Ray on WBZ, Boston's news radio.
00:00:06
Speaker 2: Thank you very much, Madison.
00:00:07
Speaker 3: I hope you have a great weekend as well. I hope all of you out there who are fortunate enough to be off on the weekends have a great weekend and let's hope the Patriots somehow can pull a win out in Buffalo and of course the Red Sox are done until I don't know when depending upon the MLB potential lockout. We have Lots non-sports topics tonight. We are now well into year 20 here on Nightside. This is our second broadcast of our 20th year. We hit that milestone last night, and you will hear less and less about the milestone as we proceed, but I did want to mention it at least one more time. My name's Dan Ray. I'm the host of Nightside, as I say, the aptly named Nightside with Dan Ray. First one on the air on October 1st, 2007, and here we are, 19 years and two days later, it's October 2nd, 2026. For those of you who are keeping score or records of this at home, Rob Brooks is back in the control room along, assisted tonight by Ably, by associate producer Sam. So we have a full team here working ready for you. We're going to get you all the way until midnight. Before we get to our first guest, who's a friend of this program for many years, Cade Crockford. the Director of Technology and Justice Programs at the ACLU of Massachusetts. Interesting story at 9 o'clock. We are going to talk with Dr. Judy Hinchey. She is the Newton woman fighting to keep her 28.5-inch tall miniature horse at her home, in her yard, not inside her home. The city first gave her a permit. Apparently now it has revoked that permit. after Dr. Hinchey spent about $ 100, 000 building a shelter and fencing for Clover, a very cute miniature horse. And we will talk with Dr. Hinchey, and you'll have an opportunity to talk to her as well tonight. And then a very interesting guest at 10 o'clock, Mary Tamer. She is with a new group called Next Chapter Boston. They are very concerned about the adequacy of the scores, the test scores, that are being produced by students in the Boston Public Schools, and they feel that the test scores are so low that students are being cheated of an education, an adequate education in the Boston Public Schools, and Mary Tamer will make that case. The group Next Chapter Boston has just spent a lot of money with some MBTA ads, which were put up on some MBTA vehicles and then abruptly taken down. I know Channel 5 did the story tonight, and it's also We'll be in your Boston Globe tomorrow, and we have Mary Tamer, who is a former Boston School Committee member, and with Next Chapter Boston to talk about this. And there's a great deal of concern here. There's sort of a First Amendment question, which I'm not going to ask Cade Crockford about tonight, but I'm.
00:03:12
Speaker 2: Very tempted to, that this group, negotiated a.
00:03:18
Speaker 3: Contract with the MBTA, and now the MBTA has done a 180-degree turnaround.
00:03:23
Speaker 2: Not fair. We'll get into it.
00:03:24
Speaker 3: There's a lot more to it than I could do in that one- or two-minute synopsis. And then we will wrap it up in the final hour at 11 o'clock, as we do every week with the 20th hour, and we'll have a question for you, open-ended question, which hopefully will bring a smile to your face and a little bit of a jump in your step as we move across from Friday to Saturday morning. So without any further ado, let me welcome back Cade Crockford, the Director of Technology and Justice Programs at the ACLU in Massachusetts.
00:03:54
Speaker 2: Cade, welcome back. Nice to have you with us.
00:03:57
Speaker 4: Good evening, Dan. It's great to be here. Thanks for having me.
00:04:01
Speaker 2: Our pleasure.
00:04:01
Speaker 3: Now, there is a piece of legislation that the ACLU is very interested in up at Beacon Hill, It is called the Massachusetts Consumer Data Privacy Act. I am not anywhere near up to speed on this piece of legislation as you are, and I want you to be able to explain its purpose to our audience. And also, let's start with the progress of this legislation. This legislation has just passed the House, as I understand it, by a unanimous vote, which is very rare. And it has already passed the Senate last year. So, This legislation is on track to become law in Massachusetts. Is that an overstatement? Let's just deal with the progress portion of this question for starters. This is pretty close to becoming law.
00:05:00
Speaker 4: Yeah, that's right. So in September of last year, September of 2025, the Massachusetts State Senate passed comprehensive data privacy legislation. And then in June, close to the end of this legislative session, the House passed their own version of privacy. you know, similar legislation. And so in Massachusetts, your listeners are probably familiar with the reconciliation process. We call it a conference committee process in Massachusetts. So that's when the Senate president appoints three leaders to And the House speaker appoints three leaders. And those six people sit down and hash out the differences between the two bills and come up with what's called a conference report. In Congress, it's called a reconciliation bill. And then that legislation goes back to each chamber. We hope will be passed and then goes to the governor's desk for a signature. So yes, right now the legislation is in the conference process and lawmakers changed their rules this session to give themselves a little bit more time in previous legislative sessions. Conference committees had to wrap by July 31st of the second year of the session. Now, we've obviously passed that. We're into October.
00:06:17
Speaker 5: But this legislative session, lawmakers changed the rules and said, you know what.
00:06:23
Speaker 4: We're going to let conference committees hash it out through the end of the calendar year. So they have until December 31st. to, you know, come up with an agreement, ratify it in both chambers, and then send it to the governor's desk. And we are confident that they're going to do that. Yeah, we're very hopeful.
00:06:40
Speaker 3: It's great to know that they're going to work a full year, too. I assume they do get a full year salary. So this is important. And what people need to understand, as you said, that this reconciliation bill or this conference committee report, it's one piece of language. And any inconsistency can derail it, and hopefully they can come on this matter.
00:07:04
Speaker 2: So we've talked about the process. Let's talk about the substance.
00:07:08
Speaker 3: When we talk about this bill, it says if it passes, and hopefully it will, it would allow consumers, which means people like all of us, to access, correct, and delete certain personal information, limit targeted advertising to minors, and ban the sale of precise location data.
00:07:29
Speaker 2: So let's start off.
00:07:30
Speaker 3: Let's break that big chocolate chip cookie apart here. Let's talk about allow consumers to access, correct, and delete certain personal information.
00:07:42
Speaker 2: What are we talking about there, Kate?
00:07:46
Speaker 4: So let me actually, if it's all right with you, Dan, just back way up and start at the beginning of our process. So in Massachusetts, we are one of a number of states that have not passed any comprehensive data privacy legislation. Now, some states have. California has. Connecticut has. Virginia, Maryland. There are a number of states that have passed comprehensive data privacy laws. We do not have a federal law. state of privacy law. Congress has not gotten their act together to pass a modern 21st century consumer privacy law, but a number of states have. So in Massachusetts at the beginning.
00:08:28
Speaker 5: Of the legislative session a couple of years ago, two sessions.
00:08:31
Speaker 4: Ago, we were thinking at the ACLU, What is the most important consumer privacy issue that we could focus lawmakers' attention on and focus the public's attention on? And we zeroed in on the question of cell phone location data. Because unbeknownst to many people, there is a multi-billion dollar market for our precise cell phone location data. data. So in other words, anybody with a credit card can go to a data broker's website and buy information showing where you, your children, your parents, your neighbors, the governor, the state police, the colonel of the state police, and everyone else in the state of Massachusetts has been in the past and is currently right now. This is a huge threat It's a huge threat to each of our safety. Obviously, if somebody can track you everywhere you go, it could expose things about you to other people that you don't want them to know. Maybe you're getting cancer treatment at Dana-Farber and you don't want everyone to know that. Maybe you're going to Alcoholics Anonymous meetings in the basement of a church. And you don't want people to know that. Maybe you're skipping out of work and going to the beach and you don't want your boss to know that because you called in sick. There are a number of reasons why cell phone location data can be extremely damaging if it is revealed to people.
00:10:03
Speaker 5: Who shouldn't have any access to that information.
00:10:06
Speaker 2: So that information is gathered by your cell phone provider, I assume.
00:10:16
Speaker 5: Well, so there are a lot of different ways that this information leaks.
00:10:19
Speaker 4: Out to data brokers. One of the top means is actually through apps on our phones. Another one is through the online advertising industry. So basically, when you go to a website, if you go to BostonHerald.com on the browser on your phone, you're going to encounter a number of advertisements on that website. And because of the way that the online advertising system works, your.
00:10:46
Speaker 5: Location data is being harvested, not.
00:10:49
Speaker 4: Necessarily by Boston Herald, but by the ad company that is serving those ads on that website. And oftentimes it's Google. And so they're pulling your location data. And then companies are basically able to scrape that information from ad markets That's one way that this information leaks out. Another way is by people have downloaded apps on their phones, whether it's an app like Uber or Lyft or the McDonald's app. Obviously, people have tons of apps on their phones. Many of these apps have a side business of selling.
00:11:29
Speaker 5: Your location data.
00:11:30
Speaker 4: So there are a number of different ways that data brokers access this information. You raised the question, Dan, is it coming from our telecoms? And unfortunately, in the past, it has. eMobile got in trouble a number of years ago for selling its consumers telecoms. cell phone location data to data brokers. And so, yes, there are a number of different ways that information reaches these brokers. But the point is that the brokers basically clean the data, they analyze it, they sort of compile it, and then they resell it to really anyone. And so we were concerned about this, our allies in the domestic violence space, Jane Doe, which is the state's leading anti-domestic violence organization, was concerned about this for obvious reasons. We even had members of our coalition who were national security types who were concerned about this.
00:12:24
Speaker 5: There's a lot of sensitive research.
00:12:25
Speaker 4: That happens in Massachusetts. Probably not a good idea for foreign governments to be able to track remotely the, you know, the activities of all of the people who work at MIT Lincoln lab.
00:12:36
Speaker 5: Right.
00:12:36
Speaker 2: Okay. Let me, let me, let me just pause you.
00:12:38
Speaker 4: Yeah.
00:12:39
Speaker 2: Let me, if I can pause you guys, I got to take a quick break. Sure.
00:12:42
Speaker 3: What's great about you is that you speak in language that people are going to understand. And I'm learning, listening to you, which is very important for me to understand. And I'm just beginning to absorb this. Let's take a break. When we come back, I again want to make sure people understand that as great as cell phones and smart phones are, there needs to be a piece of legislation that you folks have spearheaded and that I support, and I would hope everybody in this audience would support, witness the unanimous vote by the House of Representatives. They are never, hardly ever, unanimous. My guest is Cade Crockford. Cade is the Director of Technology and Justice Programs at the American Civil Liberties Union of Massachusetts. We'll be back with Cade. I hope you continue to listen and understand what Cade is saying because it's information that all of us should understand. If you have any questions, if you want to make a comment, 617-254-1030. We will get to phone calls. I promise, not right away. I want to allow Cade to finish with her explanation, which is an excellent, excellent Really, it's almost like a seminar for us about something that we probably haven't thought much of. I've learned a lot in the last seven or eight minutes, and I hope you have too. Back with Cade Crawford on Nightside, 617-254-1030 or 617-931-1030. Coming back on Nightside. Nightside with Dan Ray on WBZ, Boston's news radio. My guest is Kate Crawford. Kate, I apologize for interrupting there, but we have to do these commercials.
00:14:28
Speaker 4: Not at all.
00:14:29
Speaker 3: But let me just sort of recap what you've told us. That somehow, because of the cell phones that we carry with us portably in our cars, on our persons, our comings and goings are recorded. Correct?
00:14:48
Speaker 5: Mm-hmm.
00:14:49
Speaker 2: Okay. Is it the phone company that... has that information initially? Who records that information? Who compiles that information?
00:14:59
Speaker 3: Is it these data companies that buy the information from the phone company? I'm just trying to understand first base, second base, third base, home plate, how they get from the batter's.
00:15:10
Speaker 1: Box to home plate.
00:15:12
Speaker 4: For the most part, it's app companies and information that is leaking out of the online advertising industry.
00:15:21
Speaker 3: So, so it's not as if the phone, it's not as if Verizon or, or, or Comcast, the phone companies give the information, but the apps that we voluntarily put on our phones, you know, I, I have, you know, an app on my phone for my gym. I have an app on my phone for my grocery store. I have an app in my phone, maybe for ways for, as you said, Those are the sources that the data companies work with to harvest the data?
00:15:52
Speaker 4: Yes, a number of app developers. put special software in their apps that sends the location data of the person's phone to data brokers automatically. It also leaks out through online ads. So it's not necessarily only happening through apps. It can also happen through your web browser. And in the past, cell phone companies have actually sold their customers' location data to data brokers. So I wouldn't want to say necessarily that that is not happening now. I don't have any evidence that it's happening now, but it has happened in the past.
00:16:29
Speaker 2: So that is a major problem.
00:16:31
Speaker 3: One other side question here, okay? And again, I want you to get back to this seminar because it's fabulous. One other side question. I assume that law enforcement uses this information, whether, you know, I agree with it, you agree with it, that if, let us say, someone has robbed a bank and they have a cell phone on them, I assume that.
00:16:57
Speaker 5: So that's a great question.
00:16:59
Speaker 2: Okay.
00:16:59
Speaker 4: That's a separate process. In Massachusetts, we have a law that was established by, yes, the Supreme Judicial Court in a number of cases. We also have... law that was established by the Supreme Court of the United States in a seminal case called Carpenter versus United States that says the police have to get a warrant to go to your cell phone company and demand information about where you were last week, last month, last year, or to track you in real time. That is a separate matter from the question of whether government agencies are going around the Fourth Amendment requirement and directly buying this information from data brokers. We have no evidence that that is happening among state and local law enforcement in Massachusetts. And frankly, they better not be doing it because that is flatly unconstitutional. There is some evidence that the federal government is currently doing that.
00:18:00
Speaker 5: So yes, that's a huge problem.
00:18:02
Speaker 4: It is a huge problem.
00:18:03
Speaker 5: And- And it's one of the reasons, frankly, why we need to regulate this industry.
00:18:09
Speaker 4: So what are we trying to accomplish? We are saying at the ACLU and our big coalition, which includes groups like Jane Doe, our statewide anti-domestic violence organization, and many other groups. We have been asking the legislature, you have to stop this. You have to stop companies from selling our precise geolocation data. Now, we're not saying that companies can't offer you services that provide you with important data. location technologies like mapping, right? We all use mapping technologies on our phones. We all use location services on our phones. What we are saying and what the legislature is now saying in bills passed by both the House and the Senate is that it's okay for a company to collect your precise geolocation data if they need it to provide you with a service that you've requested. So let's take Google Maps as an example. If you download Google Maps on your phone and you give them permission to track your location, you are saying, I want to know how much traffic there is on the way to my destination.
00:19:17
Speaker 2: How long it's going to take me to get from where I am now to.
00:19:23
Speaker 3: The question then becomes, okay, along that trip, you stop here, you stop there, maybe you go into a liquor store, I don't know, whatever. You've given them permission to route you, to help you get from point A to point B, but you haven't given them permission to sell the information about which way you.
00:19:45
Speaker 2: Might have gone.
00:19:45
Speaker 5: That's exactly right.
00:19:47
Speaker 2: Okay, or where you have stopped along the way. Okay, good. Okay.
00:19:51
Speaker 4: That's right. So that's what we're saying is, look, we all want to be able to use... effective modern technology that helps us, right? So we're not trying to stop Lyft and Uber from collecting our location data to provide us with a service, right? We're not trying to stop Google Maps or Apple Maps from collecting our location data if we want them to tell us the best route to get somewhere and how much traffic there is. That's fine. What we're saying is it ought to be illegal... for them to turn around and sell that data to a third party that you've never heard of, some data broker who can then turn around and sell it to anybody with a credit card, right? So we are essentially saying we have to stop this abusive practice that has been operating in the shadows for many years and endangers people every day. And thank God, the vast majority of the public and all legislators in Massachusetts agree with us. And so that is one of the central pieces of this legislation. It says you can collect the data to provide someone with a service. You cannot then turn around and sell it.
00:20:57
Speaker 5: So that's about precise geolocation data.
00:20:59
Speaker 4: There's a lot of other information.
00:21:02
Speaker 2: We're going to get to that.
00:21:03
Speaker 3: I have to stop because we have a newscast at the bottom of the hour and a couple of commercials. I promise I'm following. You've been really clear. And I think this is a tremendous service that you have provided to make people understand exactly the implications of this legislation. I think this has been extraordinary, and I know I've learned a lot in the last 25 minutes, and I'll learn more in the balance of the hour.
00:21:26
Speaker 2: Katie, you can stay there. We've got about a.
00:21:28
Speaker 3: Four-minute break for news and a couple of commercials, and we'll be back and we'll continue the conversation and continue the seminar right now, which I hope people are listening to because there are some incredible dangers inherent in this, and there's no benefit to the citizens other than aggravation.
00:21:46
Speaker 2: We'll be back with Kate Crockford.
00:21:49
Speaker 3: She is the technical director, I should say, the director of technology and justice programs at the ACLU of Massachusetts. If you have a question, as I learned in law school many years ago, no question is too dumb to ask. The only questions you don't ask are the questions that you don't have the courage to ask because those are the ones that on the bar exam and on law school exams always will come back to haunt you. We're back on Nightside, 617-254-1030, 617-931-1030. Back with Cade Crockford, a very smart lawyer who knows a lot about these issues, and she is explaining it extraordinarily well tonight.
00:22:30
Speaker 2: Back on Nightside.
00:22:34
Speaker 1: Nightside with Dan Ray on WBZ, Boston's news radio.
00:22:40
Speaker 2: We're back with Cade. Crockford.
00:22:42
Speaker 3: Cade is the Director of Technology and Justice Programs at the ACLU of Massachusetts, and we are talking about a bill that will allow consumers to access, correct, and delete certain personal information, limit targeted advertising to minors, and ban the sale of precise location data. So if this legislation passes, is there anything that now there will be an affirmative obligation on consumers to do to have their data that maybe has been collected and then disseminated by data brokers, is there an affirmative obligation on us as individual consumers to make sure that those materials are deleted, or will it be done automatically if this legislation passes, Cade?
00:23:31
Speaker 5: That's a great question, Dan.
00:23:32
Speaker 4: And it actually speaks to one of the core elements of the legislation that we're hoping lawmakers will agree to. And that is this concept called data minimization. Now, with respect to the sale of our location data, consumers won't have to do anything. There will simply be a law that says companies cannot sell this data, period. You will have those legal protections no matter what. And we think that similar legal protections ought to apply more broadly to other types of data. So let's talk about what those types of data are. We call them in the legislation sensitive data. Now, this is things like information about children, information about someone's veteran status, information about your health, because something that a lot of people don't realize is that health information that is collected by Fitbit, your heart rate, exercise data, women who use Apple Health to track their menstrual cycles, none of that is protected by our federal health privacy law because that law, HIPAA, only applies to healthcare providers. It does not apply to technology companies. So there's a larger.
00:24:51
Speaker 5: Category of sensitive information. And the Senate, in their version of the legislation.
00:24:57
Speaker 4: That the Senate passed, actually bans the sale of all of those types of sensitive data. So we're hoping that in the conference report, the House will agree to that Senate provision to say, you know what, we should go beyond precise geolocation data and prohibit the sale of these other types of sensitive information as well. There's one other piece.
00:25:18
Speaker 5: That I want to make sure your listeners hear, which is this concept of data minimization.
00:25:22
Speaker 4: And basically, because you asked about what action do consumers have to take You know, if you've ever visited a website and seen a pop-up that says, select your privacy choices, and there's another pop-up that you can choose, and then there are five or six different choices that you can make, it's a really confusing situation for a lot of people. And most of us just click the.
00:25:46
Speaker 5: First thing to make it go away so that we can access the content or the website or the app that we're.
00:25:52
Speaker 4: Trying to access. That system doesn't really work. And So we're not trying to adopt here in.
00:25:59
Speaker 5: Massachusetts a consent-based.
00:26:02
Speaker 4: Click-as-you-go model, because just as you asked, Dan, that really does put the burden on individuals. And we think that consumer data privacy is such an important issue that actually the burden should be on the companies, not on individuals, and that there ought to be baseline protections in the law limiting how much and what type of information companies can collect about us, and then limiting what they can do with that information. So that framework is known as data minimization. And the analogy that I like to use is like this. When you go to the store and you buy milk for your family, You do not then take home.
00:26:43
Speaker 5: The milk and break out your.
00:26:45
Speaker 4: Chemistry set to test it to see if there's fecal matter in it. You just drink it and you just give it to your kids, right? And you do that because there are laws that say that companies have to sell safe milk. And we have government officials who test the milk to make sure that it's safe to drink, right? And so we think a similar dynamic ought to apply in the privacy context, where you can just use.
00:27:10
Speaker 3: Technology- You're going too fast for some people, and what you were talking about there is the Food and Drug Administration, which is a federal administration.
00:27:19
Speaker 5: That's right, but we also actually have state-level agencies that are.
00:27:22
Speaker 4: Involved in milk testing. So anyway, the point is that the burden should not be on the individual technology user, just like the burden is not on the individual consumer of groceries. to ensure that we are not being abused, that our information is not being repackaged and sold and used in all these ways to manipulate us on the Internet. There ought to be baseline protections in statute, in the law, that apply to all of us. So that your elderly grandmother, your 10-year-old kid who just got a smartphone, people who don't speak English as a first language, and frankly, even those of us middle-aged people who speak English very well but don't have the time to read every privacy policy on every website or for every app that we want to use, can also have digital privacy in the year 2026 and beyond. So that's one of the core pieces of.
00:28:16
Speaker 5: The legislation that we're hoping lawmakers will agree to in conference.
00:28:21
Speaker 3: I have noticed recently many more prompts where they will say, in order to use this app, we need your location. And you have to give them permission in order to use the app. I'm sure you know of what I'm speaking. Clearly, if you're downloading Google Maps or you're using Google Maps or Waze... they need to know your location in order to start you from.
00:28:54
Speaker 2: Point A to point B.
00:28:55
Speaker 3: In many cases, you'll put in your location, but then this other, um, uh, I, I know websites that you go to or whatever are apps.
00:29:04
Speaker 2: And, you know, it would be, if you're looking.
00:29:07
Speaker 3: For, uh, on, on a shopping website, if, if you're looking at Brooks brothers or something like that there, and I'm not saying Brooks brothers does this, but, uh, what would seem to be a, an app or a website that would have.
00:29:20
Speaker 2: No need for your location.
00:29:22
Speaker 3: They, they prompt you, you know, in order to use this, is that something that is becoming more common, Cade? And is that part of what is going on that we sort of are, we meaning the public have been asleep at the switch on?
00:29:39
Speaker 4: Well, look i don't want to blame the public i mean there's a lot to be concerned about right gas prices are out of control everything's expensive people are trying to survive in an economy that's really stressful right so like no no but what.
00:29:52
Speaker 3: I'm saying is if we if we all Yeah, if we all were so smart that we could never be tricked, okay, which we aren't.
00:29:59
Speaker 2: I mean, I'm not.
00:30:00
Speaker 5: You probably are, but I'm not.
00:30:02
Speaker 3: So what I'm saying is I've noticed more of this stuff coming up, what I would call geolocation.
00:30:07
Speaker 2: Am I off base when I say that?
00:30:11
Speaker 4: No, you're right. And look, something that people really ought to know is that increasingly companies are charging people consumers different prices for the same goods based on data that they collect about us.
00:30:25
Speaker 5: So one of the reasons that a shopping website might say, hey, can we track the location is because.
00:30:31
Speaker 4: They want to know your income and they can guess how much money you have.
00:30:37
Speaker 5: By where you are physically located in space, right?
00:30:41
Speaker 4: If you are physically located in Wellesley or Dover, maybe they're going to charge you more because they know that you can pay more, right? And, you know, if you're physically located in Chelsea, they don't charge you sort of.
00:30:54
Speaker 2: And you're voluntarily giving up that information.
00:30:58
Speaker 4: Well, yes and no.
00:31:00
Speaker 5: I mean, the problem is that.
00:31:02
Speaker 4: In many of these situations, we actually don't have a choice. We don't have any consumer privacy rights right now in Massachusetts. So if you go to a website, you don't have a choice about whether or not.
00:31:15
Speaker 5: They're collecting certain data about you.
00:31:18
Speaker 4: And even if you do on that particular website... You don't have any way to opt out of the data broker industry of these companies that are buying and selling and trading your information, which is why we need the state to step in. So I just want to say one more thing, which is that the other key issue here that lawmakers have to work out is how this bill is going to be enforced, how this legislation is going to be enforced. And this is a.
00:31:43
Speaker 5: Massively important issue.
00:31:45
Speaker 4: Because we on the consumer protection side are are arguing that the enforcement language in this privacy bill ought to look just like or similar to the enforcement language in our state consumer protection law. So that's Chapter 93A. This is the law that basically makes it illegal for a company to lie to you about the product that it's selling you. That's the unfair and deceptive practices law.
00:32:15
Speaker 5: So this is the law that protects you when you go to a car.
00:32:18
Speaker 4: Dealership and the dealer tells you this is a brand new car. It has no miles on it. It's great. It gets 40 miles to the gallon. If you then buy that car and take it home and you take it to your mechanic and your mechanic tells you, I hate to break it to you, buddy, but you got sold a lemon.
00:32:34
Speaker 5: This car actually.
00:32:35
Speaker 4: Has 50,000 miles on it. It's a piece of crap. You can sue that dealer. You do not have to wait or go to the attorney general and say, hey, A.G. Campbell, this dealership stole my money. They lied to me. You can go and get a lawyer and sue them yourself, and you can not only get your money.
00:32:53
Speaker 5: Back, but you can get triple damages, right?
00:32:57
Speaker 4: I'm very much aware of that. Exactly. So we think similar protections ought to apply in the consumer privacy context.
00:33:05
Speaker 1: And why?
00:33:05
Speaker 4: It's very important because the biggest technology companies in the world, Meta, Amazon, Google, these are the companies that are most incentivized to violate the privacy law because their business is about collecting information and manipulating information, right? And so if the only entity In the state, who can enforce this law is the Attorney General, which is what the industry wants. This is what big business wants. They want the AG to.
00:33:35
Speaker 5: Be the only one who can enforce the law.
00:33:37
Speaker 4: If that's the case, those big companies are gonna make a dollars and cents calculation. And they're gonna say, look, we might get sued by the AG every 10 or 20 years. We can dry it out. We might pay even a $ 5 billion settlement. is worth it to us because we will make more than $ 5 billion by violating the law.
00:34:01
Speaker 2: They would call it the cost of doing business.
00:34:04
Speaker 4: That's right. The cost of doing business. So it is essential that this law have what is called a private right of action that allows you as the consumer to hire your own lawyer and sue one of these companies if they violate your rights. And the House... in their version of the legislation included a limited private right of action that would not impact small businesses. They were concerned about, you know, small businesses making mistakes with computers and stuff like that. And they were like, look, we don't want to penalize small business too harshly. But it is important, the House thought, that we ensure these big companies, OpenAI, Anthropic, Microsoft, Google, Amazon, Meta, these huge technology companies that earn, for Meta, hundreds of billions of dollars a year. It is essential that we allow consumers to sue those actors if they violate the statute. We're hoping that at the end of this conference process, we'll see really strong legislation with strong protections. We like a lot of what the Senate did on that side with strong enforcement language that comes from the House.
00:35:12
Speaker 2: My guest is Cade Crockford.
00:35:14
Speaker 3: Cade is the Director for Technology and Justice Programs at the ACLU of Massachusetts.
00:35:20
Speaker 2: We have been.
00:35:21
Speaker 3: Discussing for 40, 45 minutes here. all sorts of legislation, one major piece of legislation that has passed both the House and Senate and is heading to conference committee that would give all of us, Massachusetts residents, greater control over our personal information and strengthen protections against the misuse of our sensitive data. When I come back, I'm going to ask you a very quick question, and I know you'll know the answer, so save it until we have to take a couple of more commercials and then we can wrap it. If anyone has a question, The phones have been quiet, which always means to me, Kate, people are listening attentively. And I do appreciate that. But if you have a question, now's the time to call 617-254-1030. My question is, if this legislation passes, it will protect people in Massachusetts. Will it also protect Massachusetts residents when we leave Massachusetts and go visit relatives in New York or Connecticut or places where There is not similar legislation. We'll talk about that. That will be my question coming back. Back with Kate Crawford of the Massachusetts Civil Liberties Union, or the American Civil Liberties Union of Massachusetts, right after a couple of quick messages, and then we'll wrap up. We do have a guest coming up at 10 o'clock. We will be changing topics, so if you want to get in, dial now or forever hold your peace.
00:36:42
Speaker 2: Coming back on Nightside.
00:36:44
Speaker 1: It's Nightside with Dan Ray on WBZ, Boston's news radio.
00:36:49
Speaker 3: My guest is Cade Crockford of the American Civil Liberties Union of Massachusetts. All of a sudden, Cade, the phones have exploded. And so I'll ask the question of you quickly. Will these protections of Massachusetts residents extend to Massachusetts residents when they are outside the Massachusetts?
00:37:10
Speaker 5: Yes.
00:37:11
Speaker 2: Okay, that's great. That is very good.
00:37:13
Speaker 1: Okay.
00:37:13
Speaker 2: Okay.
00:37:14
Speaker 3: We're going to go to the calls. We have three calls. I hope to get them all in. Steve, a veteran caller is going to set the pace. Steve, we're tight on time. Everyone has called in late.
00:37:25
Speaker 2: Go ahead, Steve.
00:37:26
Speaker 6: Everyone I know uses Amazon. They get extraordinarily inexpensive prices. They get unbelievably fast delivery. And anything they can possibly imagine they want, they get. Yet everybody hates Amazon. What does, I mean, does the American public think that it's all a one-way street that they just take, take, take? Don't they understand that these companies are not charitable organizations and they use them all the time, all day long?
00:38:02
Speaker 3: Okay, all right, all right, Steve. Steve, I understand the question. Kate, can you give a quick answer?
00:38:08
Speaker 2: Go ahead.
00:38:10
Speaker 5: Yeah, Steve, Amazon does a ton of different business, as I'm sure you know.
00:38:13
Speaker 4: What we're talking about in this consumer privacy legislation would not impact your ability to buy goods from Amazon or impact Amazon's ability to deliver those goods to you. This is about the data side of the operations that companies like Amazon and Google and Meta are using. And I think the larger kind of subtext to.
00:38:38
Speaker 5: Your question is, Isn't this the business.
00:38:40
Speaker 4: Model of the modern Internet? And the answer is yes, but it doesn't have to be. It's only the business model of the modern Internet because companies like Google and Meta made it that way. And our democracy hasn't responded effectively.
00:38:55
Speaker 2: There are many other.
00:38:56
Speaker 4: Ways that the Internet could work.
00:38:58
Speaker 2: Let me pause it there, Steve. You made your point. I understand it. I think Cade responded. We'll save a longer conversation for next time, OK? Thank you, Dan. Thank you. Thank you very much. Ann and Milton. Ann, you've got to be quick for us. I have one more behind you. Go ahead, Ann.
00:39:14
Speaker 1: I will be.
00:39:15
Speaker 6: Is this information collected when the phone is turned off?
00:39:19
Speaker 4: No.
00:39:21
Speaker 3: No.
00:39:22
Speaker 2: Good question.
00:39:22
Speaker 4: The only people who can track your phone when it's off is the National Security Agency.
00:39:28
Speaker 2: All right. Great question.
00:39:30
Speaker 1: Ann.
00:39:30
Speaker 2: And you were quick. Thank you.
00:39:33
Speaker 3: That will allow us to get to Brian in Michigan. Brian, you have 40 seconds.
00:39:38
Speaker 2: Go ahead. You got to be quick.
00:39:40
Speaker 7: I'll make it very quick. Two quick questions. Is there any federal law in place or proposed to do this in Massachusetts?
00:39:47
Speaker 3: No.
00:39:49
Speaker 2: States have done it earlier. You can re-listen.
00:39:51
Speaker 3: Anyone can re-listen to this hour, and you should, at Nightside on Demand over the weekend.
00:39:56
Speaker 2: But Cade answered that. What's the second question, Brian?
00:40:00
Speaker 7: The second question is about every month we are prompted to update our apps. And I never know why I'm updating it. Are they sliding things in those updates that would be part of this whole discussion?
00:40:12
Speaker 2: Great question.
00:40:12
Speaker 4: You know, you ought to update your apps because oftentimes app updates include important security fixes. So I would encourage you.
00:40:21
Speaker 5: To download updates to apps.
00:40:24
Speaker 4: This, again, is why we need a law to protect consumers because we shouldn't have to mistrust our technology. And right now.
00:40:32
Speaker 5: We have a lot of good reason.
00:40:33
Speaker 4: To do it.
00:40:34
Speaker 2: The news is here. Brian, thank you, sir.
00:40:37
Speaker 3: Call again. Listen over the weekend. Nightside and Demand. This was a brilliant hour, Kate. I can't thank you enough. How can folks get in touch with you? Give us the website real quickly, and then we've got to run.
00:40:47
Speaker 4: ACLUM.org.
00:40:51
Speaker 2: Thank you so much, Kate. We'll have you back. This was really a great hour. Thank you. I hope people listen to it over the weekend. You're more than welcome.
00:40:58
Speaker 3: Kate Crockford of the American Civil Liberties Union of Massachusetts. I know we've slipped into the news. are almost into the news. To the three callers, Steve, Ann, and Brian, thank you for being cooperative.
00:41:08
Speaker 2: Call earlier. We'll be back.
00:41:10
Speaker 3: We're going to talk about a little horse, a mini horse, and its future in Newton, Massachusetts.
00:41:17
Speaker 2: Coming back.
