Montana’s privacy law has received a refresh and updates will go into effect October 1, 2025 – exactly one year since the law took effect. The law was modified with SB 297, and changes include coverage, approach with minors, and more:
- Broadening who is covered. Previously, Montana’s privacy law applied only to those controlling or processing the personal data of at least 50,000 Montanans. SB 297 cuts those numbers in half, bringing in any business handling the data of just 25,000 state residents or making substantial revenues off the personal data of at least 15,000 people.
- Minors. As amended, businesses offering online services, products, or features to those under 18 must use reasonable care to avoid heightened risks of harm to minors. Data protection impact assessments -will also be needed if engaging in activities that might create a risk of harm to minors. As revised, companies will need to get consent from those 13-18, or from their parents if the minor is under 13, to process minors’ information for targeted advertising, certain profiling activities, or selling of personal data. There are also restrictions on geolocation information collection and using “system design feature[s]” to increase use of online services.
- Narrowed exemptions. Montana has removed the broad GLBA entity-level exemption that exists in most states (joining California, Minnesota, and Oregon). There will still be an exemption for GLBA-covered information, but the only types of financial institutions that receive the entity-level exception are banks and credit unions. Montana’s law also previously exempted non-profits, but now narrows this to only non-profits that detect and prevent fraudulent acts in connection with insurance. Delaware and Oregon’s privacy laws contain similar carveouts for non-profits.
- Privacy policy updates. Under the law’s revisions, privacy policies will need to explain what rights consumers have (not just that the consumer has rights) and the types of data and third parties to whom data is shared or sold. Like California, Colorado, Minnesota, and New Jersey, Montana businesses must also state the date the privacy notice was “last updated.” Privacy notice content will need to be accessible to individuals with disabilities and available in each language in which the business provides a product or service. Links to the notices must be conspicuously posted. Material changes must communicated to consumers for prospective data collection and they must be allowed to opt out of such changes.
- AG and right to cure. Finally, as amended, businesses will no longer have a statutory cure period. Previously, when the AG issued a notice of violation, businesses were given 60 days to cure.
Putting it into Practice: Montana joins California, Colorado, and Virginia in making changes to its comprehensive privacy laws. Provisions to keep in mind include privacy policy content, approach with minors’ information, and who and what is covered under the law.