United States of America: Consumer Data Protection Act (SB 297) revising Privacy Laws was passed by Senate of Montana

On 24 February 2025, the Montana Senate passed the Consumer Data Protection Act (SB 297), an Act amending state privacy laws with new obligations for data controllers and processors and enhanced rights for consumers and minors. The Act would require businesses to provide transparent privacy notices, notify consumers of data collection, and offer rights to access, correct, delete, and obtain a copy of personal data, as well as to opt out of targeted advertising, the sale of personal data, and certain forms of automated profiling. It would obligate businesses to limit data collection to what is necessary, implement reasonable data security measures, and establish mechanisms for consumers to exercise their rights. Specific provisions address the protection of minors, prohibiting targeted advertising, data sales, and profiling involving known minors without verified consent, and restricting the use of design features that may prolong minor engagement. Controllers offering services to minors would be required to conduct data protection assessments where processing poses a heightened risk of harm. The Montana Attorney General would have exclusive enforcement authority, with a 30-day cure period prior to enforcement action and civil penalties of up to USD 7'500 per violation.