Montana & Tennessee to enact comprehensive privacy laws

Julie Rubash, Chief Privacy Counsel
April 24, 2023

Want to receive these weekly privacy recaps in your inbox? Sign up for our privacy newsletter, A Little Privacy, Please.

United States

Montana / Tennessee To Enact Comprehensive Privacy Laws, Barring Governor Veto

Montana SB 384, establishing the Montana Consumer Data Privacy Act, and Tennessee HB 1181, establishing the Tennessee Information Protection Act, were both unanimously passed by the States’ respective Legislatures on April 21.

Unless the bills are vetoed by their State Governors, the Tennessee law will go into effect July 1, 2024, and the Montana law will go into effect October 1, 2024.


The Montana Consumer Data Privacy Act largely resembles Connecticut’s privacy law, including obligations to obtain opt-in consent to process sensitive data, to provide mechanisms for users to revoke consent as easily as providing it, and to respect opt-out preference signals by January 1, 2025.

The Tennessee law also includes requirements largely taken from other existing state privacy laws with one major exception: this is the first law to require adherence to the National Institute of Standards and Technology (NIST) Privacy Framework

Washington My Health My Data Act Delivered to Governor

The Washington State Senate signed off on the final version of the My Health My Data Act  and delivered the bill to the Governor. As long as the Governor does not veto the bill by April 25, the law will go into effect March 31, 2024.


The My Health My Data Act is significant for several reasons.

First, the law prohibits regulated entities from collecting consumer health data except consent from the consumer for a specified purpose.

Second, the definition of “consumer health data” under the bill is extremely broad, encompassing even health-related inferences derived from non-health information.

Third, the definition of “collect” is extremely broad to include essentially any type of processing.

And finally, it’s notable that the law includes a private right of action.  

Federal Online Privacy Act Reintroduced

U.S. House Representatives Eshoo and Lofgren (both from California) introduced an updated version of the Online Privacy Act (OPA) that was previously introduced in 2019 and again in November 2021.


This version of the bill creates a federal floor, allowing states to legislate only when state action would provide greater protection than federal law.

Like previous versions, the bill would require opt-in consent from users for processing, establish a Digital Privacy Agency for enforcement, and allow individuals to appoint non-profits to represent them in private class actions.

Want more of the privacy highlights that matter to adtech and martech? Sign up for our privacy newsletter, A Little Privacy, Please.

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.

Latest Blog Posts

FTC asserts that COPPA does NOT preempt state law claims

May 31, 2023

The Premom settlement is the third recent enforcement action...

Safeguarding quality publishing

May 25, 2023

The digital age has brought numerous benefits, but it...

Health data privacy “a high priority” for FTC

May 22, 2023

The Premom settlement is the third recent enforcement action...

Latest White Papers

Benchmark Report: US Privacy Compliance

August 19, 2022

The current state of publisher compliance with CCPA, and...

Ebook: A Publisher’s Guide to Vendor List Curation

December 16, 2021

How to review your vendor list to mitigate compliance...

Keep in touch

Sign up for our newsletter to keep up with privacy news for adtech and martech,
plus occasional company news.

© Sourcepoint 2023. All Rights Reserved

Let's explore what we can do together.

We'll be in touch within 48 hours

[contact-form-7 id="593" title="Schedule a Demo"]