• by Wendy Davis  @wendyndavis, May 23, 2023

Montana Governor Greg Gianforte has signed a privacy law gives state residents new rights to wield control over data about them, including the right to reject some forms of online behavioral advertising.

Senate Bill 384 provides that residents can opt out of the use of data linkable to them -- including pseudonymous data, such as information stored on cookies -- for targeted ads. (The measure defines ad targeting as serving ads to people based on their online activity over time and across nonaffiliated websites or apps.)

The law also requires companies to provide links enabling opt-outs, and says companies must honor opt-out universal signals that consumers send with mechanisms like the Global Privacy Control. That tool, developed by privacy advocates, transmits an opt-out command to every website consumers visit.

In addition, the law requires companies to tell residents what non-pseudonymous data has been collected about them, and to delete that data upon request.

Consumer Reports praised the new Montana law, saying it is “more workable” and will “better protect the privacy rights of consumers” than several other state privacy laws.

“While giant tech companies have successfully pushed weak privacy laws in other states, Montana held firm on key issues like universal opt-out and authorized agents,” Consumer Reports policy analyst Matt Schwartz stated.

This year, lawmakers in four other states have passed privacy laws: Iowa, Indiana, Tennessee and Florida. Those state laws, unlike Montana's, don't appear to require companies to allow consumers to opt out of ad targeting based on information stored on cookies or other pseudonymous identifiers.

Five other states previously enacted online privacy laws -- California, Colorado, Connecticut, Utah and Virginia. Those state laws all require companies to let residents reject ad targeting based on pseudonymous data.

Montana's law will take effect in October.