Covered entities may not process or transfer biometric data in any manner that the end user has not affirmatively consented to. Consent must be freely given, specific, informed, and unambiguous — a general terms-of-service acceptance is explicitly insufficient. Consent obtained through abusive trade practices is void. Passive actions such as hovering, muting, pausing, or closing content do not constitute consent. This effectively requires opt-in consent before any biometric data processing, with the scope of processing limited to the narrowly defined purpose stated in the consent.

Covered entities owe a broad duty of loyalty to end users: they may not take any action in processing biometric data or designing biometric recognition technology that conflicts with an end user's best interests. This is a fiduciary-style obligation that goes beyond mere consent requirements — even if the end user consents, the covered entity cannot act contrary to the user's interests. The attorney general has rulemaking authority to interpret this provision further.

Covered entities must secure biometric data from unauthorized access using security measures at least as protective as those applied to other confidential and sensitive data. Additionally, covered entities are prohibited from engaging in harmful data practices — defined as processing or transferring biometric data in a manner that causes or is likely to cause financial, physical, or reputational injury, highly offensive intrusion upon privacy, or other substantial injury to an individual. The security obligation sets a floor, not a ceiling: the entity's existing security posture for other sensitive data is the minimum benchmark.

Covered entities face three interlocking restrictions on biometric data transfers: (1) sale of biometric data to third parties is categorically prohibited; (2) disclosure to any other person or entity is only permitted if consistent with the duties of loyalty, care, and confidentiality; and (3) any person receiving biometric data must enter into a contract imposing the same fiduciary-style duties toward the end user. Together these provisions mean biometric data may never be sold and may only be shared under contractual safeguards that extend the full suite of end-user protections to the recipient.

When a covered entity shares biometric data with a third party, the covered entity must take reasonable steps to verify that the recipient actually complies with the contractual duties of care, loyalty, and confidentiality — including regular audits of the recipient's data security and data practices. This creates an ongoing vendor oversight obligation, not a one-time contractual formality. Note the statute uses 'online service provider' in this subsection, which appears to be a drafting inconsistency with the rest of the chapter, which uses 'covered entity.'

Covered entities may not retaliate against or discriminate against end users who refuse to consent to biometric data processing. Prohibited retaliatory actions include denying goods or services, charging different prices, providing inferior service quality, or even suggesting that the user will face differential treatment. This ensures that consent is genuinely voluntary — end users cannot be economically pressured into providing biometric data.

Covered entities must not engage in deceptive, unfair, or abusive biometric data practices. Deceptive practices are those that constitute deception under Mass. ch. 93A. Unfair practices are those causing substantial, non-avoidable injury to end users not outweighed by countervailing benefits. Abusive practices include interfering with users' ability to understand terms of biometric data agreements or exploiting users' lack of understanding, inability to protect their interests, or reasonable reliance on the covered entity. Courts must interpret these standards following FTC Act § 5(a)(1) precedent. The 'abusive' category — drawn from CFPB-style authority rather than traditional UDAP law — is noteworthy and may capture practices that are not technically deceptive or unfair but exploit power imbalances.

Covered entities are categorically prohibited from using biometric data to make or assist in making decisions that produce legal effects or similarly significant effects on end users. This is a blanket ban — not a requirement for human oversight or impact assessment — covering a broad range of consequential decisions including financial services, housing, insurance, education, criminal justice, employment, healthcare, and access to basic necessities. Unlike most automated decision-making statutes that require safeguards, this provision prohibits the use of biometric data in such decisions entirely.

Covered entities may not operate, install, or commission the installation of biometric recognition technology equipment in any place open to and soliciting the patronage of the general public — whether the place is licensed or unlicensed. This is a total ban on public-facing biometric surveillance by private covered entities. The legislature declares any violation of this provision a per se unfair or deceptive trade practice under ch. 93A, meaning the attorney general does not need to independently establish unfairness or deceptiveness in an enforcement action. Government entities, law enforcement, and intelligence agencies are excluded from the definition of covered entity and thus not subject to this ban.

This chapter does not preempt or supplant existing state or federal personal information protection and privacy laws. Covered entities must continue to comply with all applicable data protection laws (e.g., HIPAA, state data breach notification laws) in addition to this chapter's requirements.