2024 seems like it is flying by. For those keeping track of US state “comprehensive” privacy laws you know that October 1 – a week away – brings the effective date of the Montana privacy law. The “big sky” state will join Texas, Oregon and Florida as the fourth effective privacy law of 2024. This brings to total to nine state privacy laws in effect (with California, Colorado, Connecticut, Utah, and Virginia). Check out our tracker for the status of the remaining -signed- state laws, along with a comparison between their key provisions.
A few things to keep in mind for next week. Fortunately, Montana’s law mostly mirrors the obligations in other states. This includes respecting opt-out signals and providing individuals with rights (like access and deletion). And like others, there is no private right of action. Montana is also a state with a 60-day cure period (the ability to cure does sunset, though, on April 1, 2026). Montana’s applicability threshold is lower that other state laws in effect (except for Texas). Businesses that control of process the personal data of 50,000 Montana residents will be in scope.
Putting it into Practice: The next set of state laws to go into effect will be in January 2025: Delaware, Iowa, New Jersey, Nebraska, and New Hampshire. As of now, there will be three additional US states with similar laws that go into effect in 2025, and three slated for January 2026. For those who have not already developed an adaptable privacy program, next week’s Montana law effective date is a reminder to consider that for the list for 2025.