United States of America: Consumer Data Protection Act (SB 297) revising Privacy Laws including amendments was signed by Governor

On 8 May 2025, the Governor of Montana signed the Consumer Data Protection Act (SB 297), an Act revising state privacy laws. The Act requires businesses to provide transparent privacy notices, notify consumers when personal data is collected, and grant individuals rights to access, correct, delete, and obtain a copy of their data, as well as to opt out of targeted advertising, the sale of personal data, and certain forms of automated profiling. It obliges data controllers and processors to limit data collection to what is necessary, implement reasonable security measures, and provide mechanisms for consumers to exercise their rights. The Act introduces specific protections for minors, prohibiting targeted advertising, data sales, and profiling involving known minors without verified consent, and restricting the use of design features that may extend engagement. It also requires controllers offering services to minors to conduct data protection assessments where processing poses a heightened risk of harm. The Montana Attorney General holds exclusive enforcement authority, with a 30-day cure period before initiating enforcement and civil penalties of up to USD 7'500 per violation.