Camera-related state law

The governing audio-recording statute is the Massachusetts Wiretap Statute, Mass. Gen. Laws Chapter 272, Section 99. It is one of the strictest in the country. The statute makes secret interception of any wire or oral communication a crime, with criminal penalties and a private cause of action for civil damages. Unlike many two-party states, the MA statute reaches all secret recording, not just confidential communications, which means the consent rule applies even in some public settings.

Video-only surveillance is treated more permissively. Recording video in places where a person has no reasonable expectation of privacy is generally lawful, with two practical caveats. First, posted notice is the standard for any commercial property and many lease agreements require it. Second, hidden cameras in places where privacy is expected (restrooms, locker rooms, fitting rooms, hotel guest rooms) are off-limits and create exposure under MA invasion-of-privacy theories.

Practical translation for a MA commercial install. Audio capture by a continuously running camera is high-risk and most MA installs default to video-only on the cameras. Audio is routed through a separate intercom or call-recording workflow with all-party consent disclosed at every entry point.

Biometric data law

Massachusetts does not have an enacted biometric information privacy law as of 2026. Bills modeled in part on the Illinois BIPA framework have been introduced in recent MA legislative sessions, including proposals to require informed written consent before collection, retention schedules, and a private right of action. Operators should track MA Senate and House bill activity quarterly because the legislative posture has been moving in the direction of enactment.

That doesn't mean biometric capture is unregulated in MA today. Chapter 93H reaches biometric authenticators when used for authentication in the personal-information definition. 201 CMR 17.00 requires WISP coverage for personal information about MA residents, including biometric records held by covered entities. The federal FTC Act and Safeguards Rule reach biometric data handling for many businesses. MA businesses using facial recognition or fingerprint access control should still document consent, retention, and access controls.

Privacy in the workplace

Mass. Gen. Laws Chapter 149, Section 19B governs employer use of lie detectors and addresses certain electronic monitoring contexts. The MA Wiretap Statute (c. 272 sec. 99) reaches secret audio recording in the workplace and is the controlling statute for employer audio capture. There is no single MA statute requiring written notice for general workplace video surveillance, but posted notice and a documented workplace surveillance policy are the standard practice in MA.

Most MA employers issue a single workplace surveillance notice in the employee handbook that covers cameras, badge access, computer monitoring, and call recording together. Cameras in restrooms, locker rooms, lactation rooms, and other employee privacy areas are off-limits and create criminal and civil exposure. Cameras in production lines, retail floor, loading dock, and warehouse aisles are routine when paired with posted notice.

Audio capture by an employer is the high-risk variable in MA. Continuously-running camera audio without all-party consent is a Wiretap Statute exposure. Employer call recording requires all-party consent and a documented disclosure script.

Public-place and common-area cameras

For commercial real estate, multi-tenant residential, retail, and hospitality, the practical rule set is consistent. Cameras in lobbies, hallways, exterior, parking, retail floor, and other non-private common areas are lawful with posted notice. Cameras in bathrooms, fitting rooms, hotel guest rooms, and any other space where privacy is expected are off-limits.

MA multi-tenant residential operators handle posted notice at the lobby and at unit-level entry points. Hotel operators include guest-area camera coverage in the property security plan and post notice at the front desk. Audio in any common area is the high-risk variable: ambient audio capture without all-party consent runs into the Wiretap Statute regardless of whether the space is public or private.

Video retention requirements

MA has no single statewide video retention statute that applies to all commercial cameras. Retention is set by the regime that governs the industry, plus the WISP obligations under 201 CMR 17.00 for personal information.

  • Cannabis. The MA Cannabis Control Commission (CCC) publishes coverage and retention rules under 935 CMR. Pull the current CCC rules before designing the install.
  • Healthcare. HIPAA Security Rule (45 CFR Part 164) governs PHI-touching footage. Retention is typically 30 to 90 days at the facility, longer when an investigation is open.
  • Retail and hospitality with card data. PCI-DSS Requirement 9 specifies camera coverage of the cardholder data environment with 90-day retention.
  • Banking and finance. Federal banking regulators and the MA Division of Banks set surveillance and retention expectations.
  • Schools. FERPA applies to K-12 districts and higher education. MA Department of Elementary and Secondary Education guidance and district policy add detail.
  • Federal contractors and grantees. NDAA Section 889 controls vendor selection. Retention is contractor-driven through the SSP or grant award terms.

Default retention for MA commercial systems with no specific industry rule is 30 days. Operators in higher-risk industries set longer retention with explicit written retention policies in the WISP, facility security plan, or CCC SOP.

Notable enforcement examples

MA enforcement against businesses for surveillance, data security, and privacy issues runs through several channels. The Massachusetts Attorney General has brought Chapter 93H and Chapter 93A (consumer protection) actions against businesses with documented data security failures, with reported settlements in the six- and seven-figure range. The MA AG also enforces 201 CMR 17.00 WISP obligations. The MA Wiretap Statute is enforced strictly, with appellate decisions reinforcing the all-party consent rule.

Federal HIPAA settlements have reached MA-based defendants where physical safeguards (facility access control, camera coverage of PHI areas) were a documented part of the breach. PCI assessor findings have triggered card brand penalties at MA retailers where camera coverage of the cardholder data environment was inadequate or retention was below 90 days. Real settlements are searchable on the MA AG and HHS OCR enforcement pages.

What Tec-Tel does to comply with Massachusetts regulations

Tec-Tel installs across Massachusetts for retail, manufacturing, healthcare, multi-tenant residential, financial, and licensed cannabis customers. The default install pattern for an MA commercial site:

  • Video-only on cameras unless audio is documented with all-party consent under c. 272 sec. 99.
  • Posted surveillance notice at every public entrance.
  • No cameras in restrooms, locker rooms, fitting rooms, hotel guest rooms, or other spaces where privacy is reasonably expected.
  • WISP-aware retention coordinated with the customer's 201 CMR 17.00 program for any system that captures personal information of MA residents.
  • Retention configured to the regime that governs the industry (HIPAA, PCI, CCC, NDAA), with the facility's written retention policy attached to the install package.
  • NDAA Section 889-compliant vendor selection on any federal-touching install. No Hikvision, Dahua, Hytera, Huawei, ZTE, or covered OEM relabels.
  • Multi-vendor architecture so the customer is not locked into one camera or VMS line as state and federal rules evolve.

This is a buyer-facing reference, not legal advice. For a specific Massachusetts regulatory question, work with your privacy counsel.

Security service in Massachusetts

Tec-Tel deploys AI-era security across Massachusetts with one accountable project manager owning design, install, and service to one standard. The cities below have local service detail, deal sizing, and a free consultation. Don't see yours? We cover the whole state.

Or browse the full city directory and nationwide coverage map.