Montana Children's Privacy Laws (2026)

SB 297 (2025) — amendments to the Montana Consumer Data Privacy Act (Ch. 567, Laws of 2025) · SB 297 (Ch. 567, Laws of 2025)

In force — Effective and enforceable today. · Age assurance · effective 2025-10-01 · binds operators, developers

Ages: Under 18 (minor); under 13 requires COPPA verifiable parental consent; 13-17 requires the minor's consent

Requires: Amends the MTCDPA to impose child-directed (age-appropriate-design) duties on controllers offering an online service, product, or feature to consumers the controller actually knows or willfully disregards is a minor (under 18). Imposes a duty of reasonable care to avoid a heightened risk of harm to minors; requires consent before processing a minor's data for targeted advertising, sale, certain profiling, extended retention, or precise geolocation — the minor's own consent for ages 13-17 and COPPA verifiable parental consent for children under 13; restricts design features that significantly increase, sustain, or extend a minor's use; and requires data protection assessments for processing presenting a heightened risk to minors. Expressly does NOT require age verification or age-gating, but provides a safe harbor for commercially reasonable age estimation.

Litigation: None found. No lawsuit or injunction against SB 297's minors provisions as of 2026-06-27. (Distinct from the unrelated Montana pornography age-verification law challenged in Free Speech Coalition v. Knudsen, which is out of scope here.)

Montana Consumer Data Privacy Act (MCDPA) — minors' provisions (as amended by SB 297) · SB 297 (2025); MCDPA codified at MCA 30-14-2801 et seq.

In force — Effective and enforceable today. · Privacy law (minors) · effective 2025-10-01 · binds operators

Ages: Children under 13 (verifiable parental consent); minors under 18 (13-17 give their own consent)

Requires: A controller that knows or willfully disregards that a consumer is a minor (under 18) may not process the minor's personal data for targeted advertising, sale, or profiling in furtherance of legal/significant effects without the minor's consent; for a child under 13, verifiable parental consent is required (consistent with COPPA). Controllers must also exercise reasonable care to avoid a heightened risk of harm to minors, may not use dark patterns or system design to significantly increase/sustain/extend minor engagement, and must limit precise-geolocation collection and data retention. These minor-specific duties apply with no numerical applicability thresholds.