How Montana passed the strongest privacy law among red states

Montana’s data privacy law had all the ingredients to be another notch in a string of red-state victories for the tech industry against tough rules on how Americans’ personal data is mined and shared.

Yet Republican Gov. Greg Gianforte last month ultimately signed one of the most sweeping tech privacy laws for a GOP-controlled state: a suite of consumer protections restraining data collection online and limiting how the industry profits from people’s personal information.

What happened behind the scenes this spring in the Montana Legislature was a stark lesson in what can go wrong in American lobbying when an industry overplays its hand. And the degree to which tech companies fumbled on this legislation may force Silicon Valley to change its state-level tactics as it seeks to ward off a patchwork of regulations and new resistance in conservative territory like Texas.

In Montana, the bill’s Republican sponsor, Sen. Daniel Zolnikov, pivoted — hard — against them.

“I have four business degrees. I’m not an idiot, and you treating us in Montana like a bunch of rural backwoods folks is quite an insult as well,” Zolnikov recalled of the industry’s tactics in an interview.

He said Montana’s local tech lobbyists approached him last summer during the Governor’s Cup, an annual golf tournament where politicians, lobbyists and local business leaders mingle, exchange ideas and pitches. But matters quickly soured shortly after the new year once the national lobbying arms parachuted in.

Zolnikov, who also works as an energy developer, was known to propose privacy regulations during the nearly eight years he spent in the state House and has been concerned that someone’s personal data could be unfairly used against them. He successfully pushed legislation in 2013 requiring police officers to obtain warrants for GPS location data but also felt the sting of seeing lobbyists derail legislation limiting what data internet service providers can collect from customers.

At the Governor’s Cup, lobbyists asked Zolnikov if he was eyeing any data privacy bills since he had several models to choose from, including California’s, widely considered the toughest in the country. What the industry recommended was legislation mirroring a law in Utah, which follows the tech industry’s guidelines and the laissez-faire approach common in other Republican-led states.

Shortly after Zolnikov won his Senate race in November, a Montana lobbyist put him in touch with TechNet and the State Privacy and Security Coalition. Not only do those D.C.-based groups represent some of the industry’s biggest companies — like Google, Meta and Amazon, which make huge revenues from collecting, trading and selling user data — they’ve lobbied on virtually every state privacy bill in the U.S.

The lobbyists, in his recollection, presented themselves as groups looking to create privacy rights for citizens that businesses could easily comply with and he was initially open to their recommendations since lobbyists he’d worked with frequently had vouched for them.

But tech industry groups have played a central role in watering down bills in places like Virginia, where a data privacy measure was drafted by an Amazon lobbyist while being framed as creating new protections for constituents.

In Montana, they started making several recommendations to weaken the legislation in December and January — before Zolnikov even introduced his bill.

A key push was removing language for a universal opt-out — a provision that allows people to block all online tracking of their web browser by default. The lobbyists also wanted companies to always have a window of time to resolve privacy violations before enforcement actions can start, and sought to narrow the definition of “sale” so it only applied to data exchanged for money.

While Zolnikov had a strong relationship with the state’s local lobbyists, he said he never met any of the national lobbyists face-to-face. All of their recommendations came via email and phone calls and were presented as “technical” changes. And many undercut his goal of writing a strong privacy law that could serve as a model for other red states as the industry fans out to capitals amid a policy vacuum in Washington.

One issue that seemed very technical that the companies treated as extremely important: what counts as “selling” user data. The broader the definition, the harder it is for companies to trade in user information. The companies wanted the definition narrowed, pointing to privacy laws in Iowa, Utah and Indiana, which would effectively let them profit from their users’ data as long as they didn’t charge a dollar amount for it.

By the time Zolnikov introduced the Montana Consumer Data Privacy Act in February, tech lobbyists had convinced him to remove a lot of the teeth found in Connecticut’s law, which is considered to be a statute somewhere between California and red states like Utah.

The bill unanimously cleared the Senate in early March and was headed to the Montana House. The industry was on the verge of victory when its efforts would unravel in a matter of weeks. But the pivotal event, as it turned out, didn’t even happen in Montana.

In deep-blue Maryland, legislators were considering their own privacy bill when tech lobbyist Andrew Kingman, who works for the State Privacy and Security Coalition, told lawmakers that his group would have no issue if Maryland followed Connecticut’s model.

Three months earlier, according to Zolnikov, Kingman had been pushing him to abandon the Connecticut model, claiming it was too hard for the industry to comply with.

“This really pissed me off, because why does Maryland get to have the good Connecticut thorough bill, but Montana doesn’t deserve that?” Zolnikov said.

The strategy was clear to Zolnikov: For a blue state, Connecticut’s framework would be considered a compromise. In Montana, a libertarian, business-friendly state, the lobby would see it as a failure.

Asked about the discrepancy between his position in Montana and in Maryland, Kingman didn’t comment specifically but offered a statement saying the group backs “reasonable and interoperable state privacy laws” that are predictable.

Both TechNet and the State Privacy and Security Coalition said their lobbying efforts were intended to ensure that Montana’s privacy law works with other states’ regulations.

“We’ve worked with state lawmakers across the country, including in Montana, to ensure state privacy laws are workable, interoperable, and not overly burdensome for businesses while ensuring consumers can access, correct, and delete their data,” TechNet’s vice president of state policy and government relations David Edmonson said in a statement.

After watching Kingman’s testimony in Maryland, Zolnikov called Matt Schwartz, an analyst for Consumer Reports’ advocacy arm who had written a detailed critique of the bill, to devise a strategy before the legislation made it out of the House.

By April, some of Schwartz’s recommendations became amendments. The bill would get universal opt-out requirements, allowing Montanans to block all tracking with a single click.

Another amendment will allow the state attorney general to immediately begin assessing fines and other penalties for violating the law starting in April 2026, sunseting a provision that gave the industry time to remedy violations first.

Schwartz said one major loophole in the legislation involved an exemption for “pseudonymous data” that would’ve allowed companies to continue tracking people online even after they’ve opted out.

“We went from something that was very close to passing that would’ve been pretty weak — especially if that exemption had been left in there — to something that’s OK,” he said.

When the tech industry made one last attempt to regain control, Zolnikov said, they peppered him with calls and emails asking for changes. A lobbyist from Google, he said, told him a universal opt-out law would hurt Montana residents because someone could accidentally toggle the setting.

“To say that my state doesn’t deserve the right protections as four or five other states? That really didn’t bode well with me,” Zolnikov said.

Google didn’t respond to a request for comment.

The bill passed with unanimous bipartisan support in both chambers.

Sen. Shane Morigeau, a Democratic Montana lawmaker who advised on the bill, wasn’t surprised Zolnikov changed course and dug in.

“I feel like he’s a smart enough guy where he can catch those sorts of changes that people are trying to insert to undermine the intent of the legislation,” he said.

Zolnikov said Montana’s law shows a GOP-led state can remain business-friendly while providing strong privacy protections for residents — a dig at places like Indiana and Utah.

“These guys in these states get to pass a watered-down bill and celebrate that they did something when they didn’t complete the mission, and that’s pretty much the model that you see everywhere,” he said. “I’m just disappointed in my fellow Republican-led states because they could’ve done a much better job on the policies.”