MT SB297

Lowers applicability thresholds from 50,000 to 25,000 consumers for general data processing, and from 25,000 to 15,000 consumers for entities deriving over 25% of revenue from personal data sales

Adds new protections for minors (under 18), prohibiting targeted advertising, data sales, and certain profiling without consent; requires parental consent for children under 13

Requires controllers to conduct data protection assessments for online services posing heightened risk of harm to minors, effective October 1, 2025

Removes the 60-day cure period for privacy violations, allowing the Attorney General to issue civil investigative demands directly; establishes civil penalties up to $7,500 per violation

Expands privacy notice requirements to include last-updated dates, accessibility for individuals with disabilities, multiple language availability, and notification of material changes to consumers