Cybersecurity Policy Report, Montana Governor Signs Bill to Amend Consumer Privacy Act, (May 12, 2025)
Montana Gov. Greg Gianforte (R.) has signed into law a bill to amend the Montana Consumer Data Privacy Act (MCDPA).
SB 297, among other things, adopts stricter requirements for processing the personal data of minors. The bill adds new definitions related to the processing of student data and a new definition of “adult,” to mean “an individual who is 18 years of age or older” and it defines “minors” as consumers who are under the age of 18. The bill also requires certain entities to conduct data protection assessments for processing activities that impose a “heightened risk of harm to minors.”
The bill also removes the MCDPA’s 60-day cure period which previously gave controllers 60 days to correct an alleged violation. The attorney general, under the revised law, also now has the power to issue a request for a data protection assessment conducted by the controller as part of a civil investigative demand.
SB 297 further lowers the processing thresholds triggering application of the law. The provisions of the MCDPA will now apply to entities that either (1) control or process the personal data of 25,000 Montana consumers (down from 50,000); or (2) control or process the personal data of at least 15,000 Montana consumers (down from 25,000) and derive more than 25% of gross revenue from the sale of personal data.
The new law also requires controllers to disclose in their privacy notices and provide access to a “clear and conspicuous method outside the privacy notice for a consumer to opt out of the sale or processing.” This method may include an Internet hyperlink clearly labeled “your opt-out rights” or “your privacy rights” that “directly effectuates the opt-out request or takes consumers to a web page where the consumer can make the opt-out request.”
In addition, required privacy notices must be made available to the public in each language in which the controller provides a product or service that is subject to the privacy notice or carries out activities related to the product or service. Consumers must be notified when a controller makes a material change to the privacy notices or practices.
The bill further requires the privacy notice to be posted online through a conspicuous hyperlink using the word “privacy” on the controller’s website homepage or on a mobile device’s application store page or download page.
The bill (S.B. 297, Reg Sess.) was sponsored by Sen. Daniel Zolnikov (R.).
News: StateLegislation DataPrivacy