Montana's Consumer Data Privacy Act will take effect on October 1, 2024, ushering in new regulations for businesses regarding how they handle personal data.
What is Montana’s Consumer Data Privacy Act?
Montana’s Consumer Data Privacy Act (MCDPA) is the latest addition to the growing list of U.S. state-level data privacy laws designed to protect consumers' personal information. Enacted in 2023, the law will go into effect on October 1, 2024. The MCDPA outlines consumers' rights over their data and the obligations businesses must meet when collecting, processing, and sharing personal data.
This new legislation aligns Montana with other states such as California, Virginia, and Colorado, further emphasizing consumer control over personal data and increasing transparency from businesses handling sensitive information.
How Will It Affect Your Privacy Widget?
The privacy widget will be automatically updated on October 1 to reflect the following consumer rights mandated by the MCDPA:
-
Right to Access: Montana consumers will have the right to confirm whether their personal data is being processed and gain access to it.
-
Right to Delete: Consumers can request the deletion of their personal data, provided it is not needed for specific legal or business purposes.
-
Right to Data Portability: Montana consumers will be able to request and receive their personal data in a portable format, allowing them to transmit it to another service provider or business.
-
Right to Opt-Out: Consumers will have the ability to opt out of the sale of their personal data or its use in targeted advertising and profiling.
Similar to other state privacy laws, businesses must respond to consumer requests within 45 days, with an option to extend by another 45 days under certain conditions.
Does the MCDPA Require Cookie Consent?
Unlike the California Consumer Privacy Act (CCPA) or the EU's GDPR, Montana’s MCDPA does not require explicit consent for cookie placement or processing. However, transparency remains key. The privacy widget on your site should still clearly inform users of how their data is being collected and processed and provide easy access to submit requests regarding their personal data rights. Therefore, a widget would now be visible for visitors coming from Montana.
Additionally, MCDPA specifies that businesses must honor unified opt-out mechanisms (UOOM) by January 1, 2025. From this date, companies will be required to accept UOOMs, such as global privacy control signals or browser settings, enabling consumers to opt out of data processing for targeted advertising and the sale of personal data without manually interacting with each website.
If you wish to set footer links for "Privacy Center" and "Do not sell or share my personal information" for visitors coming from Montana, please review our guidelines here.
Stay tuned for updates as we continue to monitor new data privacy laws and their requirements, including the upcoming unified opt-out mechanism mandate in January 2025.