Montana Children’s Privacy Laws (2026)

SB 297 (Ch. 567, Laws of 2025); MCDPA codified at MCA 30-14-2801 et seq.

In force · Age assurance · effective 2025-10-01 · binds operators, developers

Ages: Under 18 (minor); under 13 requires a parent's or legal guardian's consent (COPPA verifiable parental consent satisfies it); 13-17 requires the minor's own consent

Requires: Amends the MTCDPA to impose child-directed (age-appropriate-design) duties on controllers that know or willfully disregard a consumer is a minor (under 18): a duty of reasonable care to avoid a heightened risk of harm to minors; consent before processing a minor's data for targeted advertising, sale, certain profiling, extended retention, or precise geolocation (the minor's own consent for ages 13-17; under 13, a parent's or guardian's consent, which COPPA verifiable parental consent satisfies); restrictions on dark patterns and design features that significantly increase, sustain, or extend a minor's use; safeguards limiting unsolicited messages from unconnected adults on any direct-messaging feature offered to a minor (services that are predominantly email or private messaging are exempt); and data protection assessments for processing presenting a heightened risk to minors. These minor-specific duties apply with no numerical applicability thresholds. Expressly does NOT require age verification or age-gating, but provides a safe harbor for commercially reasonable age estimation.

Litigation: None found. No lawsuit or injunction against SB 297's minors provisions. (Distinct from the unrelated Montana pornography age-verification law challenged in Free Speech Coalition v. Knudsen, which is out of scope here.)

Entry last reviewed 2026-10-01