Tennessee, Montana Pass Comprehensive Consumer Privacy Bills

The trend of state-level privacy laws is gaining momentum in the U.S. as Montana and Tennessee became the latest to pass comprehensive legislation. Both bills cleared their state legislatures in April and await their respective governors' signatures before becoming law. If passed, Montana’s law would become effective on Oct. 1, 2024, followed by Tennessee on July 1, 2025. Montana takes its privacy concerns a step further with a proposal to ban TikTok. Gov. Greg Gianforte has also requested to broaden the bill, making it applicable to all social media apps that provide certain data to foreign adversaries, according to The Wall Street Journal. The Next Brand Safety Battlefield Is AI-Based Audio, and It’s Surging on TikTok and YouTube Meanwhile, the existing patchwork of state-level laws already poses massive compliance challenges to adland. “California tried to downplay just how expensive it will be to comply with its law,” said Roy Wyman, an attorney at Bass, Berry & Sims who has written about the need for federal-level privacy legislation. “We've got companies that will spend millions of dollars just for compliance with California.” Concurrently, people are increasingly requesting companies to modify or delete their data, limiting marketers' ability to scale customized ads. The net effect is that marketing teams must partner with a capable compliance group, and marketing and advertising technologies must be reviewed much more carefully to ensure risks are known and contained, said Matt Voda, CEO of cross-channel measurement firm OptiMine. “Even things as simple as marketing attribution can create enormous new risks for brands, who may be handling [personal identifiable information] and unknowingly creating future problems for themselves,” he added. Businesses are better shielded from Tennessee’s law Similar to Virginia’s privacy law, Tennessee’s provisions are more business-friendly. The Tennessee Information Protection Act (TIPA) applies to companies with an annual revenue cap of $25 million while processing personal information of 175,000 or more Tennessee residents or processing the data of 25,000 residents and deriving 50% of their gross revenue from the sale of that data. The law exempts nonprofits, HIPPA-covered entities and financial institutions. Meanwhile, residents of Tennessee can exercise rights such as opting out of targeted ads and having their personal information sold, and request companies to delete or correct their data. To that, people can opt into sharing their sensitive data. This includes one’s personal information such as racial/ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation and citizenship/immigration status. If businesses are found in violation, they are granted a 60-day cure window or the attorney general can levee a civil penalty of $7,500. “If the court finds that the violations were willful, they can fine triple of $7,500 for such violations,” said Anokhy Desai, Westin Fellow at the International Association of Privacy Professionals. A unique feature of TIPA is the carveout of the National Institution of Standards and Technology (NIST) framework. This means businesses found in violation of the law can bring their compliance with the NIST into court as a shield. “But it doesn't explain whether that would limit the fines or reduce the company’s violations,” said Desai. Uber’s First Chief Privacy Officer on Finding Mindfulness and a Trip to Vegas Montana is zealous about residents’ privacy Going into effect in fall 2024, The Montana Consumer Data Privacy Act (MCDPA) impacts businesses that control or process the data of at least 50,000 Montana consumers or control or process the data of 25,000 residents and receive over 25% of their gross revenue from the sale of that data. Montana’s population is estimated at 1.12 million as of 2022. “The fact that it applies to 50,000 or more residents is notable,” said Desai. “It shows that they care about their residents.” The bill provides standard consumer privacy rights such as opting out of targeted ads. Meanwhile, companies are to carry out data protection assessments before they engage in various processing activities, including processing for targeted marketing, sensitive data, and the sale of personal data and processing of personal data for profiling if the profiling presents a reasonably foreseeable risk of legal, deceptive, discriminatory, financial, reputational or physical harms. To that, the law provides opt-in rights for advertising and targeted marketing to children aged 13-15. Similar to Tennessee, companies found in violation have a 60-day cure window. But the MCDPA does not explicitly state a maximum damages amount.

Data

Tennessee, Montana to Enact Comprehensive Consumer Privacy Bills

The patchwork of state-level privacy laws brings new marketing attribution risks for brands

Trishla Ostwal

About

Subscriptions

Events

Publications

WORK SMARTER - LEARN, GROW AND BE INSPIRED.

Subscribe today!

Trishla Ostwal