United States of America: Consumer Data Protection Act (SB 297) revising Privacy Laws including data protection assessments for high-risk processing enters into force

On 1 October 2025, provisions of the Consumer Data Protection Act (SB 297) concerning data protection assessments for high-risk processing involving minors enter into force. The Act amends state privacy legislation by setting requirements on transparency in data processing and granting individuals rights to access, correct, delete, and obtain a copy of their personal data, as well as to opt out of targeted advertising, the sale of personal data, and certain automated profiling activities. Businesses are required to limit data collection to what is necessary, implement security measures, and provide clear privacy notices. Additional provisions apply to minors, including restrictions on targeted advertising, data sales, and profiling without verified consent, as well as limits on design features intended to extend engagement. The Montana Attorney General has the power to enforce the Act and impose civil penalties of up to USD 7’500 per violation.