On April 15, 2025, the Montana legislature unanimously passed Montana SB 297, a bill that would amend the Montana Consumer Data Privacy Act (“MTCDPA”) with provisions expanding online data protections for minors, narrowing the exemptions under the Gramm-Leach-Bliley Act, and removing a controller’s right to cure, among others. We outline some key provisions below.
- Applicability: SB 297 would lower the processing thresholds for the law to apply, and notably, would make sections related to minors applicable to any entity that conducts business in the state or delivers commercial products and services intentionally targeted to Montana residents, regardless of how much data that entity processes.
- Exempted Entities: SB 297 would amend several current exemptions in the MTCDPA, including exemptions for financial institutions and non-profit entities. SB 297 would create a new exception for insurers, insurance providers, and third-party administrators of self-insurance and affiliates or subsidiaries.
- Consumer Rights: SB 297 would require a clear and conspicuous mechanism outside of the privacy notice to exercise an opt-out of sale or targeted advertising request, which the text states may include a “your opt-out rights” or “your privacy rights” link. The proposed text also amends the profiling opt-out right by striking the “solely” modifier for automated decisions, similar to the approach under Virginia’s comprehensive privacy law. Additionally, SB 297 amends the access right to limit certain types of personal data from being provided in response to an access request, such as SSN or account passwords.
- Privacy Notices: The amendment would add required content and address the presentation of privacy notices, such as a requirement that the privacy notice is available to the public in the language in which the controller provides the product or service or carries out activities. When a controller makes a material change to the privacy notice, SB 297 would require that the controller “notify” consumers with respect to any “prospectively collected personal data and provide a reasonable opportunity for consumers to withdraw consent to any further materially different collect, processing, or transfer” activities.
- Minors: A controller that offers an online service, product, or feature to a consumer whom the controller “actually knows or willfully disregards” is a minor under the age of 18 would be required to use reasonable care to avoid a “heightened risk of harm” caused by the product. Further, SB 297 would prohibit the controller from processing a known minor’s personal data for targeted advertising, sale, profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer; for any processing purpose other than that disclosed or that is reasonably necessary for and compatible with the processing purpose; or for longer than reasonably necessary to provide the online service product, or feature without the minor’s consent if they are 13–18 or COPPA verifiable parental consent for under 13-year-olds. Additionally, SB 297 would require data protection assessments for processing activities that present a heightened risk of harm to minors. SB 297 would add that “nothing in this” law would require a controller or processor to implement age verification, age-gating, or otherwise affirmatively collect age of users, but controllers that implement a “commercially reasonable age estimation system” are not liable for erroneous age estimation.
- Enforcement: SB 297 would remove the cure period and would permit the Montana Attorney General to request data protection assessments as part of a civil investigative demand. Additionally, SB 297 would add a new civil penalty provision to the MTCDPA, providing for civil penalties not to exceed $7,500 for each violation.