United States of America: Implemented Consumer Data Privacy Act (SB 384)

On 1 October 2024, the Consumer Data Privacy Act (SB 384) entered into force. The Act applies to covered entities, defined as persons conducting business in Montana or producing products or services for residents of Montana with two alternative thresholds that must be met. Either the covered entity has to control the data of at least 100'000 consumers or control the data of at least 25'000 consumers, the sale of which accounts for more than 25% of the company's gross revenue. Under the Act, a consumer has the right to access their data and delete and edit inaccuracies of their personal information. The consumer may also opt out of the use of their personal data for targeted advertising, sale and profiling. Finally, data controllers must set up reasonable data protection practices with regular assessments.