Montana Governor Greg Gianforte has signed a privacy law gives state residents new rights to wield control over data about them, including the right to reject some forms of online behavioral
advertising.
Senate Bill 384 provides that residents can opt out of the use of data linkable to them -- including pseudonymous data,
such as information stored on cookies -- for targeted ads. (The measure defines ad targeting as serving ads to people based on their online activity over time and across nonaffiliated websites or
apps.)
The law also requires companies to provide links enabling opt-outs, and says companies must honor opt-out universal signals that consumers send with mechanisms like the Global
Privacy Control. That tool, developed by privacy advocates, transmits an opt-out command to every website consumers visit.
In addition, the law requires companies to tell residents what
non-pseudonymous data has been collected about them, and to delete that data upon request.
Consumer Reports praised the new Montana law, saying it is “more workable” and will
“better protect the privacy rights of consumers” than several other state privacy laws.
“While giant tech companies have successfully pushed weak privacy laws in other
states, Montana held firm on key issues like universal opt-out and authorized agents,” Consumer Reports policy analyst Matt Schwartz stated.
This year, lawmakers in four other states
have passed privacy laws: Iowa, Indiana, Tennessee and Florida. Those state laws, unlike Montana's, don't appear to require companies to allow consumers to opt out of ad targeting based on information
stored on cookies or other pseudonymous identifiers.
Five other states previously enacted online privacy laws -- California, Colorado, Connecticut, Utah and Virginia. Those state laws all
require companies to let residents reject ad targeting based on pseudonymous data.
Montana's law will take effect in October.