Keypoint: Montana becomes first Republican-controlled legislature to pass a consumer data privacy bill requiring controllers to recognize universal opt out mechanisms, providing additional rights for children, sunsetting the right to cure, and adjusting the applicability threshold to take into account a state’s smaller population.
On April 21, 2023, the Montana legislature unanimously passed Republican Senator Daniel Zolnikov’s SB 384. In doing so, Montana became the first Republican-controlled legislature to pass a consumer privacy bill with provisions that closely align with last year’s Connecticut Data Privacy Act (CTDPA). As a result, Montana joins California, Colorado, and Connecticut as states with the strongest consumer data privacy bills passed to date. In a first, the Montana bill lowers the traditional 100,000 consumer threshold to 50,000 to presumably take into account Montana’s smaller population.
Pending any remaining procedural formalities, the bill will be sent to Montana Governor Greg Gianforte in the coming days. Governor Gianforte can sign the bill, veto it, or allow it become law without his signature.
In the below post, we provide a summary of some of the bill’s more notable provisions. Click here for a more detailed comparison of the Montana bill against the seven bills passed to date.
Lower Applicability Threshold Based on State Population
In a unique provision, the Montana bill applies to persons that conduct business in Montana or that produce products or services that are targeted to Montana residents and that control or process the personal data of not less than 50,000 state residents, excluding personal data controlled or processed solely for purposes of completing a payment transaction. The 50,000-consumer threshold was lowered from 100,000 in a House committee amendment.
The lower threshold presumably was done because of Montana’s smaller population in comparison to the populations of other states that have passed bills. Montana’s population is approximately 1.1 million. Therefore, a 100,000-consumer threshold would have been approximately 9% of the state’s population, which is a much higher percentage than in other states.
Requirement to Recognize Universal Opt-Out Mechanisms
Montana is the first Republican-controlled legislature to pass a bill requiring controllers to recognize universal opt-out mechanisms to effectuate requests to opt-out of sales and for targeted advertising. The Montana bill aligns with the Connecticut law and will not require the Montana Attorney General’s office to engage in rulemaking such as occurred in Colorado this past year. This provision will go into effect on January 1, 2025.
Additional Children’s Privacy Protections
Montana’s bill provides additional privacy protections for children between the ages of 13 and 15. Controllers cannot process the personal data of a consumer for the purposes of targeted advertising or sell the consumer’s personal data without the consumer’s consent under circumstances in which a controller has actual knowledge that the consumer is at least 13 years of age but younger than 16 years of age. The California and Connecticut laws have similar provisions.
Broad Privacy Rights
The Montana bill aligns with the privacy rights provided in the CTDPA. Consequently, Montana becomes only the second state (after Connecticut) to statutorily provide its residents with the right to revoke their consent (Colorado did so through rulemaking). Montana’s bill also allows a state resident to request that a controller delete all personal data that the controller possesses about the consumer as opposed to just personal data that the controller collected directly from the consumer.
The Montana bill also does not require opt-out requests to be verified. In other words, a Montana resident will not have to prove their identity to opt out of the sale of their personal data, for targeted advertising, or for certain types of profiling. Only California and Connecticut have similar provisions.
Sunset on Right to Cure
The Montana bill is enforceable only by the state Attorney General’s office. It does not provide a private right of action. The Montana bill requires the Attorney General’s office to provide a notice of violation and opportunity to cure; however, the right to cure sunsets on April 1, 2026. Montana is the first Republican-controlled legislature to pass a privacy bill with a sunsetting right to cure.
If signed by the Governor, the Montana law will go into effect on October 1, 2024. That is fourteen months before the January 1, 2026, effective date for the Indiana bill passed earlier this month and three months before the January 1, 2025, effective date for the Iowa bill passed in March.