Montana Consumer Data Privacy Act: minor-protection amendments (SB 297) ↗
SB 297 (Ch. 567, 2025) amended the Montana Consumer Data Privacy Act; signed 2025-05-08, effective 2025-10-01. No known legal challenge as of 2026-07-04.
Judgment call at breadth tier: SB 297 is an amendment to the comprehensive Montana Consumer Data Privacy Act, not a standalone child-safety statute. It is authored here (rather than treated as note-only) because it adds a substantive AADC-style duty of care to minors plus distinct minor-data-processing restrictions that go materially beyond a generic targeted-ad opt-out, and those duties are currently in force. The generic (non-minor) comprehensive-privacy provisions of the MTCDPA are out of scope. Per-violation penalty amount and exact code-section pins not verified. Team may wish to demote to note-only for consistency if sibling comprehensive-privacy amendments (e.g. CT, OR) are handled that way.
Scope
The MTCDPA applies to controllers that conduct business in Montana or target Montana residents and meet the Act's processing thresholds; SB 297's minor-specific duties attach to a controller offering an online service, product, or feature to a consumer it 'knows or willfully disregards' is a minor (under 18).
- Controller must meet the MTCDPA's processing thresholds; SB 297 broadened applicability by lowering/adjusting those thresholds. Specific threshold values not verified here.
- The minor-specific duties are knowledge-gated: they attach only where the controller 'knows or willfully disregards' that the consumer is a minor.
Penalties
- Model
- Other
- Detail
- Enforced under the Montana Consumer Data Privacy Act as a violation of the Montana Unfair Trade Practices Act. SB 297 removed the controller's right to cure. Per-violation penalty amount not verified here (omitted rather than guessed).
- Enforcer
- Montana Attorney General (exclusive)
- Private right of action
- No
Key dates
- Signed
- 2025-05-08
- Effective
- 2025-10-01
Obligations (1)
For a consumer the controller knows or willfully disregards is a minor (under 18), use reasonable care to avoid a heightened risk of harm to the minor, and do not process the minor's personal data for targeted advertising, sale, or profiling with legal/significant effects without consent: consent for ages 13-17, or verifiable parental consent for under 13.
Statute’s own ages: Minor = under 18. Consent required from the minor for ages 13-17; verifiable parental consent for under 13. The 'heightened risk of harm' duty of care applies to all known minors under 18.
Cross-state comparisons
- similarmd-kids-code (Maryland): Both impose an affirmative duty to protect minors from data-processing harm, but differ in trigger: Maryland's Kids Code duty attaches to services 'reasonably likely to be accessed' by minors, while Montana's heightened-risk-of-harm duty is knowledge-gated (services offered to a consumer the controller knows or willfully disregards is a minor).