Consumer Reports writes in respectful opposition to Montana S.B. 384. The bill seeks to extend to Montana consumers important new protections, including the right to know the information companies have collected about them, the right to access, correct, and delete that information, as well as the right to opt out of data sales, targeted advertising, and profiling.
Though the bill largely tracks with the provisions of the Connecticut Data Privacy Act (CDPA), it strips out key protections contained in that law, including the ability for consumers to opt out using an opt-out preference signal, making it a substantially weaker effort. The bill in its current form would not do enough to protect Montana consumers’ personal information, or to rein in major tech companies like Google and Facebook. The bill needs to be substantially improved before it is enacted; otherwise, it would risk locking in industry-friendly provisions that avoid actual reform.
Privacy laws should set strong limits on the data that companies can collect and share so that consumers can use online services or apps safely without having to take any action, such as opting in or opting out. Privacy legislation should limit companies’ collection, use, and disclosure of data to what is reasonably necessary to operate the service (i.e. data minimization) or that at least restrict certain types of processing (sales, targeted advertising, and profiling). S.B. 384 does neither of these things.
While S.B. 384 does nod toward a framework for universal opt out via authorized agents (Section 6), it strips out language from the CDPA that permits a consumer to designate an authorized agent “by way of, among other things, a technology, including, but not limited to, an Internet link or a browser setting, browser extension or global device setting, indicating such consumer’s intent to opt out of such processing.” As such, it’s unclear how consumers can actually take advantage of their authorized agent rights under this act, including whether such agents can be designated through a technological mechanism. Given the current ambiguity, businesses are likely to construe such allowances as narrowly as possible in order to limit consumer opt outs. S.B. 384 should restore the provision as drafted in the CDPA.
For the full letter, please see the attached PDF.