The ‘Montana Consumer Data Privacy Act’ Reminds us that Privacy is Bipartisan

On Friday, April 21st, the Montana State Legislature approved the ‘Montana Consumer Data Privacy Act’ (MCDPA) to be sent to the Governor’s desk. If enacted by Governor Gianforte, Montana would join the 6 states that have adopted comprehensive privacy frameworks. Notably, at almost every stage of the legislative process, the MCDPA received unanimous bipartisan support and strengthening amendments.

The MCDPA includes what would be the strongest baseline consumer privacy rights and protections of any Republican-led U.S. state, comparable in substance and scope to leading privacy frameworks in Connecticut and Colorado. Furthermore, the MCDPA is unlikely to require significant modifications to the compliance programs of organizations that are already subject to either of these existing state laws.

Significant privacy-protective elements of the MCDPA include:

• Wide Applicability: In recognition of Montana’s status as only the 43rd most populous state, the MCDPA would apply to businesses that handle the personal information of 50,000 or more residents (rather than the typical 100,000 threshold).
• Broad definition of data “sales”: If enacted, Montana will be the first Republican-led state to define the sale of personal information as encompassing transfers for both monetary and “other valuable consideration.” The other states with laws adopting this definition are California, Colorado, and Connecticut.
• Potent Opt-Out Rights: Consumers’ right to opt out of targeted advertising, data sales, and significant profiling decisions will extend to pseudonymous data, would be able to be exercised through authorized agents, and could not be ignored by businesses, even if the request is unable to be authenticated.
• Opt-Out Preference Signals: If enacted, Montana will join California, Colorado, and Connecticut in allowing individuals to exercise certain rights by default, through the use of technological mechanisms such as browser-level signals.
• Right to Cure Sunsets: The MCDPA would offer organizations an opportunity to cure prior to the Attorney General taking enforcement action; however, this provision would expire two years after taking effect.

So far in 2023 three states, including Montana, have passed privacy legislation through their legislative branch, and one state, Iowa, has seen privacy legislation signed into law. If enacted, the MCDPA will take effect on October 1, 2024.