Helena, Montana — Montana Governor Greg Gianforte signed the Consumer Data Privacy Act (SB 384) into law today. Montana residents will now have baseline privacy rights, including the right to access, delete, and stop the sale of their personal information. CR worked with lawmakers throughout the session to improve the legislation, including by adding universal opt-out provisions and removing certain exemptions.
The Montana law has key provisions missing from some other state privacy laws that will make it more workable and better protect the privacy rights of consumers:
- The bill requires companies to honor browser privacy signals, such as the Global Privacy Control, so that consumers can opt out of data sales at all companies in a single step;
- It prohibits the use of so-called “dark patterns” in obtaining consent;
- The bill places a sunset on the “right to cure” in administrative enforcement, so that after April 1, 2026, companies will no longer have a “get out of jail free” card for failing to protect consumer privacy.
“We applaud Governor Gianforte for signing privacy legislation into law that will introduce new data rights to the citizens of Montana,” said Matt Schwartz, policy analyst at Consumer Reports. “While giant tech companies have successfully pushed weak privacy laws in other states, Montana held firm on key issues like universal opt-out and authorized agents. We hope this law can be further strengthened in the future, but we’re pleased with the progress that was made here.”
The Montana privacy law will go into effect on October 1, 2024. Montana is one of several states to sign a comprehensive privacy bill into law this year. Montana is now the ninth state after California, Virginia, Colorado, Utah, Connecticut, Iowa, Indiana, and Tennessee to pass a comprehensive privacy bill into law.
Contact: Cyrus Rassool, cyrus.rassool@consumer.org