Montana's Consumer Data Privacy Act After Senate Bill 297: Two Scopes, No Cure and a Minors' Duty of Care

Two Session Laws, One Part of the Code

The Act sits in part 28 of Title 30, chapter 14, the Montana Code's chapter on unfair trade practices and consumer protection. The 2025 Montana Code Annotated table of contents for part 28 lists sections 30-14-2801 through 30-14-2820, with 2805 through 2807 and 2810 reserved. Section 2801 gives the short title as the "Consumer Data Privacy Act."

The original act was Senate Bill 384 of the 68th Legislature. Its enrolled text set an effective date of October 1, 2024 in Section 14 and, in Section 15, provided that the cure subsection of the enforcement section "terminates April 1, 2026." The codified history notes cite it as Chapter 681, Laws of 2023.

The rewrite was Senate Bill 297 of the 69th Legislature, introduced by Senator D. Zolnikov. The legislature's session-law index publishes it as Chapter 567, Laws of 2025, the chapter number the codified history notes cite for every amended section. The enrolled text contains no effective-date section, so the general rule in section 1-2-201 applies: a statute takes effect "on the first day of October following its passage and approval" unless it says otherwise, which made the amendments effective October 1, 2025. The new minors assessment section uses the same date. The chapter amended sections 2802, 2803, 2804, 2808, 2812, 2816 and 2817, enacted four new sections now codified as 2811, 2818, 2819 and 2820, repealed Section 15 of the 2023 chapter, and also amended section 20-7-1324, a definitions section in Montana's K-12 student data law.

Thresholds and Who the Act Reaches

Section 30-14-2803 now has two subsections with different reach. Subsection (1) applies the part, other than sections 2811, 2818 and 2819, to a person that conducts business in Montana or targets products or services to its residents and that controls or processes personal data of at least 25,000 consumers (not counting data handled only to complete a payment), or of at least 15,000 consumers while deriving more than 25% of gross revenue from selling personal data. The 2023 Code version of the same section set those figures at 50,000 and 25,000.

Subsection (2) carries the three minors sections to anyone that conducts business in Montana or delivers commercial products or services "intentionally targeted" to its residents. It sets no consumer count and no revenue test. The general controller duties therefore turn on the thresholds, and the minors provisions do not.

The exemption list moved in the opposite direction. The 2023 version of section 30-14-2804 excluded any "nonprofit organization" and any "financial institution or an affiliate of a financial institution" governed by Gramm-Leach-Bliley. The 2025 version names only a nonprofit "established to detect and prevent fraudulent acts in connection with insurance," a state or federally chartered bank or credit union and affiliates principally engaged in financial activities, insurers, insurance producers and third-party administrators of self-insurance. Personal data handled in accordance with Title V of Gramm-Leach-Bliley remains exempt as data. The 2025 list also adds an exemption for air carrier data on price, route or service to the extent the Airline Deregulation Act preempts the part. Section 30-14-2802(17) still defines "nonprofit organization" by reference to sections 501(c)(3), (4), (6) and (12) of the Internal Revenue Code.

Consumer Rights and Opt-Out Signals

Section 30-14-2808(1) lists confirmation and access, correction, deletion of "personal data about the consumer," a portable copy of data the consumer provided, and opt-outs from targeted advertising, sale and profiling. The profiling opt-out once covered decisions made by "solely automated" means; the 2025 text deletes "solely," so the opt-out now reaches profiling in furtherance of automated decisions with legal or similarly significant effects. Controllers answer within 45 days, extendable once by 45, and decide appeals within 60. Deletion requests for data obtained from other sources can be satisfied by keeping a suppression record or by opting the consumer out of all non-exempt processing.

A new subsection (6) bars a controller, when answering an access request, from disclosing a Social Security number, driver's license or other government identification number, financial account number, health insurance or medical identification number, account password or security answers, or biometric data. The controller must instead tell the consumer "with sufficient particularity" that it holds that information.

Section 30-14-2809, unchanged since 2023, lets a consumer name an authorized agent for opt-outs "by way of a technology," including a browser setting, browser extension or global device setting. By January 1, 2025, controllers had to honor an opt-out preference signal for targeted advertising and sale that is sent with the consumer's consent, does not use a default setting, and lets the controller determine whether the sender is a Montana resident. Where the signal conflicts with a controller-specific setting or a loyalty program, the controller "shall comply" with the signal and may ask the consumer to confirm the program choice.

The controller-duty provisions in section 30-14-2812 grew from six subsections to eleven, most of the growth in the privacy notice rules. The notice must now state what the controller sells as well as shares, explain the rights in section 2808, carry the date it was last updated, be offered in each language in which the controller provides the product, be accessible to people with disabilities, and be posted through a homepage link using the word "privacy" or, for apps, in the store page and the settings menu. A controller that sells data or runs targeted advertising must also offer an opt-out method outside the notice, such as a link labeled "your opt-out rights" or "your privacy rights." Sensitive data still requires consent under subsection (2)(b), and the rule against targeted advertising to or selling the data of 13- to 15-year-olds without consent now applies on actual knowledge or willful disregard of age.

Minors Under Section 30-14-2811

Section 30-14-2811 applies to a controller offering an online service, product or feature to a consumer it actually knows or willfully disregards is a minor, defined in section 2802 as a consumer under 18. Telecommunications service, broadband internet access service and delivery of physical products are excluded from the definition of an online service. The controller must use reasonable care to avoid a "heightened risk of harm to minors," defined to include unfair or deceptive treatment, financial, physical or reputational injury, breach-related disclosure, and offensive intrusion on a minor's seclusion. Compliance with the section creates a rebuttable presumption of reasonable care in an Attorney General action.

Without consent (the minor's own, or a parent's for a child under 13), the controller may not:

• Process a minor's data for targeted advertising, sale, or profiling in furtherance of significant decisions
• Process it for purposes beyond those disclosed at collection, or keep it longer than reasonably necessary
• Use a system design feature "to significantly increase, sustain, or extend" a minor's use of the service
• Collect precise geolocation unless it is reasonably necessary, kept only as long as needed, and accompanied by a signal visible to the minor for the whole collection period

The geolocation signal requirement does not apply to a service used by and under the direction of a ski area operator. Consent mechanisms designed to subvert a minor's choice are prohibited, and direct messaging offered to minors must include safeguards limiting unsolicited contact from unconnected adults, except where the service's predominant function is email or private messaging. Services used under the direction of an educational entity are excluded from the processing and design-feature limits. Section 30-14-2816(5)(c) states that nothing in the part requires age verification or age-gating, and that a controller using commercially reasonable age estimation is not liable for an erroneous estimate.

Section 30-14-2819 adds a separate assessment duty for any online service offered on or after October 1, 2025 to a known minor where a heightened risk exists. The assessment must address the service's purpose, the categories of minors' data processed and the risks, be reviewed after material changes, and be kept for three years after processing ends or until the service is withdrawn, whichever is longer. A controller that finds a heightened risk must adopt a plan to mitigate or eliminate it. Section 2818 sets the matching processor duties.

Attorney General Enforcement and the End of the Cure Period

The 2023 Code text of section 30-14-2817 required the Attorney General to send a notice of violation and wait 60 days; a controller that corrected the violation and gave an express written statement could not be sued. The section carried the note that the subsection terminated April 1, 2026. Senate Bill 297 struck the subsection and repealed the termination clause, so the cure ended on October 1, 2025, six months before its scheduled sunset.

The current section 30-14-2817 gives the Attorney General exclusive authority along with the powers of chapter 14, parts 1 and 2. It requires the office to post controller and processor responsibilities, consumer rights and an online complaint mechanism on its website. It authorizes a civil investigative demand under section 30-14-113 on reasonable cause, including a request for a relevant data protection assessment, and applies the limitations period in section 27-2-231. It forecloses a private right of action under the part or any other law.

New section 30-14-2820 makes a violation of the part a violation of chapter 14, parts 1 and 2, and sets a civil penalty of up to $7,500 per violation, plus injunctions, attorney fees and expenses. Its penalty trigger refers to a violation "following the 30-day period described in 30-14-2817(3)." Subsection (3) of the current section 2817 describes the investigative demand power and no 30-day period. The enrolled bill's version also referred to breaching a written statement under section 2817(4)(c), a provision the enrolled section 2817 does not contain; the codified section omits that clause.

No enforcement action under part 28 was located for this post. The Montana Department of Justice consumer data privacy page, where section 2817(2) requires the posted information and complaint mechanism, returned HTTP 403 to every fetch attempt on November 2, 2026, so the office's own record could not be checked. The enforcement record reported here is therefore zero, with that limit stated.

Frequently Asked Questions