Law / United States / 
Montana
SB 297, Amendments to the Montana Consumer Data Privacy Act
In force since .
An age-appropriate design code rule binding private bodies.
- Private right of action
- No
- Penalties
- Enforcement under the Montana Consumer Data Privacy Act's existing civil penalty structure
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Kept, Produced on request
What it requires
- Applies to a controller that knows or willfully disregards that a consumer is a minor under 18, for online services, products, or features offered to consumers known or reasonably believed to be minors.
- Use reasonable care to avoid a heightened risk of harm to minors from an online service, product, or feature.no control in the NIST Privacy Framework
- Complete a data protection assessment for offerings that pose such a risk to minors.NIST Privacy FrameworkID.RA-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Montana Department of Justice, Office of Consumer Protection
Settledness
- As of
- Open questions
- When does a controller "willfully disregard" that a consumer is a minor under section 9 of Senate Bill 297, for a general-audience online service that does not ask for age?
- What conduct is "reasonable care" under section 9(1)(a) of Senate Bill 297 when the rebuttable presumption in section 9(1)(b) arises only if the controller "complied with this section"?
What it reaches
Age threshold
18
Covered services
Online services, products, or features offered to consumers known or reasonably believed to be minors
How the hook was established
express
What makes it apply
Data subject residence
What it makes you log
Who may demand the log
Regulator
Log retention
Section 9(2)(a)(iii) bars that processing, and section 9(2)(c)(ii) limits retention of a minor's precise geolocation data to the time necessary. Separately, section 11(2)(b) requires documentation of each assessment to be kept for the longer of three years after the processing operations cease or the date the controller stops offering the service.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
- Prohibits retaining
- A minor's personal data processed for longer than is reasonably necessary to provide the online service, product, or feature
Logging duty
Section 11 requires a controller that offers an online service to a consumer it knows or willfully disregards is a minor to conduct a data protection assessment where there is a heightened risk of harm to minors, to review it on a material change, and to maintain documentation of it. The section says documentation, not log, and requires no record of an age check: section 2803(5)(c), as amended, says the part does not require a controller to implement age verification or collect consumers' ages. Section 11(6)(a) makes the assessment confidential.
- Kind
- Implicit
- As of
- Provision
- Senate Bill 297 (2025), section 11(2)(b), codified in Title 30, chapter 14, part 28, MCA
- Trigger
- personal_data_processing
What this law does
Amends Montana's consumer privacy law to require a controller that knows or willfully disregards that a consumer is a minor under 18 to use reasonable care to avoid a heightened risk of harm from an online service, product, or feature, and to complete a data protection assessment for offerings that pose such risk to minors.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .