Bill > SB297

This bill comprehensively updates Montana's privacy laws, focusing on protecting consumer and minor data privacy rights. The legislation expands definitions related to personal data processing, reduces the threshold for businesses to be covered (from 50,000 to 25,000 consumers), and introduces significant new protections for minors. Specifically, controllers (businesses collecting data) must now provide clear privacy notices, offer consumers the ability to opt-out of data sales and targeted advertising, and obtain consent before processing certain types of personal data for minors. For online services targeting minors, controllers must use reasonable care to avoid harm, cannot use design features that excessively engage minors, and are prohibited from certain data processing activities without explicit consent. The bill requires data protection assessments for services with heightened risk to minors and empowers the Attorney General to enforce these provisions, with potential civil penalties of up to $7,500 per violation. The law applies to businesses that either process data from a significant number of consumers or derive substantial revenue from data sales, with exemptions for certain types of organizations like financial institutions and healthcare providers. Notably, the bill does not create a private right of action, meaning only the Attorney General can bring enforcement actions.

Justice

https://bills.legmt.gov/#/laws/bill/2/LC0372