In Montana, the bill’s Republican sponsor, Senator Daniel Zolnikov, has argued — harshly — against them.
“I have four business degrees. I’m not an idiot, and even you treating us in Montana like a bunch of rural backwoods people is a real insult,” Zolnikov recalled in an interview on industry tactics.
He said local Montana tech lobbyists approached him last summer during the Governor’s Cup, an annual golf tournament where local politicians, lobbyists and business owners mingle, swap ideas and pitch. But things quickly turned sour shortly after the New Year, once the weapons of national lobbying arrived by parachute.
Zolnikov, who also works as an energy developer, was known for proposing privacy regulations during his nearly eight years in the State House and worried that someone’s personal data could be used unfairly against them. He successfully pushed legislation in 2013 that requires police officers to obtain warrants for GPS location data, but he also felt the pain of seeing lobbyists derail legislation limiting what data Internet service providers can collect from customers.
At the Governor’s Cup, lobbyists asked Zolnikov if he was eyeing any data privacy bills since he had several models to choose from, including California’s, widely considered the toughest in the country. What the industry was recommending was legislation that mirrored a law in Utah, which follows tech industry guidelines and the laissez-faire approach common in other Republican-led states.
Shortly after Zolnikov won his Senate race in November, a Montana lobbyist put him in touch with TechNet and the State Privacy and Security Coalition. Not only do these DC-based groups represent some of the biggest companies in the industry — like Google, Meta and Amazon, which make huge revenues from collecting, trading and selling user data — but they’ve lobbied virtually every privacy law. state privacy in the United States
Lobbyists, he recalled, portrayed themselves as groups seeking to create privacy rights for citizens that businesses could easily respect, and he was initially open to their recommendations as the lobbyists he had worked with often vouched for them.
But tech groups have played a central role in watering down bills in places like Virginia, where a data privacy measure has been drafted from an amazon lobbyist while being framed as creator of new protections for constituents.
In Montana, they began making several recommendations to weaken the legislation in December and January, before Zolnikov even introduced his bill.
A key push was the removal of the language for a universal opt-out, a provision that allows people to block all online tracking of their web browser by default. Lobbyists also wanted companies to always have a window to resolve privacy violations before enforcement actions can begin, and sought to narrow the definition of « sale » so that it only applied to data exchanged for money.
Although Zolnikov had a strong relationship with local state lobbyists, he said he never met any of the national lobbyists face-to-face. All of their recommendations came through emails and phone calls and were presented as « technical » changes. And many have undermined his goal to write a strong privacy law that could serve as a model for other red states as the industry expands to capital cities amid a political vacuum in Washington.
One question that seemed very technical and that companies considered extremely important: what counts as « selling » user data. The broader the definition, the more difficult it is for companies to exchange user information. The companies wanted the definition narrow, pointing to privacy laws in Iowa, Utah and Indiana, which would effectively allow them to profit from their users’ data as long as they didn’t charge a dollar amount for it.
When Zolnikov introduced the Montana Consumer Data Privacy Act in February, tech lobbyists had convinced him to remove many of the teeth found in the Connecticut law, which is considered a statute somewhere between California and red states like Utah.
The bill unanimously authorized the Senate in early March and was headed to the Montana House. The industry was on the brink of victory when his efforts would be thwarted within weeks. But the pivotal event, as it turned out, didn’t even happen in Montana.
In the deep blue of Maryland, lawmakers were considering their own privacy law when tech lobbyist Andrew Kingman, who works for the State Privacy and Security Coalition, told lawmakers his group wouldn’t have a problem if Maryland had followed the Connecticut model.
Three months earlier, according to Zolnikov, Kingman had pressed him to abandon the Connecticut model, arguing that it was too difficult for the industry to abide by.
« That really pissed me off, because Maryland gets the full good score of Connecticut, but doesn’t Montana deserve it? » Zolnikov said.
The strategy was clear to Zolnikov: for a blue state, the Connecticut structure would be considered a compromise. In Montana, a libertarian, business-friendly state, the lobby would consider that a failure.
When asked about the discrepancy between his location in Montana and Maryland, Kingman didn’t comment specifically, but did offer a statement saying the group supports « reasonable and interoperable state privacy laws » that are to be expected.
Both TechNet and the State Privacy and Security Coalition said their lobbying efforts were intended to ensure that Montana’s privacy law works with other states’ laws.
“We have worked with state legislators across the country, including Montana, to ensure that state privacy laws are enforceable, interoperable, and not unduly burdensome to businesses, while ensuring that consumers can access, correct, and delete own data,” TechNet vice president of state policy and government relations David Edmonson said in a statement.
After seeing Kingman’s testimony in Maryland, Zolnikov called Matt Schwartz, an analyst in Consumer Reports’ advocacy arm who had written a detailed critique of the bill, to strategize before the legislation leaves the House.
In April, some of Schwartz’s recommendations became amendments. The bill would get universal opt-out requirements, allowing Montanans to block all tracking with a single click.
Another amendment will allow the state attorney general to immediately begin assessing fines and other penalties for violating the law starting in April 2026, reversing a provision that gave industry time to remedy violations sooner.
Schwartz said one major loophole in the legislation included an exemption for « pseudonymous data » that would allow companies to continue tracking people online even after they opted out.
“We went from something that was very close to passing that would have been pretty weak – especially if that exemption had been left there – to something that is fine,” he said.
When the tech industry made a last-ditch effort to regain control, Zolnikov said, they peppered him with calls and emails demanding changes. A Google lobbyist, he said, told him a universal opt-out law would hurt Montana residents because someone might accidentally change the setting.
“Saying my state doesn’t deserve the right protections like four or five other states? This didn’t bode well for me, » Zolnikov said.
Google did not respond to a request for comment.
The bill passed with unanimous bipartisan support in both houses.
Senator Shane Morigeau, a Democratic lawmaker from Montana who advised the bill, wasn’t surprised that Zolnikov changed tack and pledged.
« I feel like he’s a smart enough guy to be able to pick up on those kinds of changes that people are trying to put in to undermine the intent of the legislation, » she said.
Zolnikov said Montana’s law shows a GOP-led state can remain business-friendly while providing strong privacy protections for residents — a dig in places like Indiana and Utah.
“These kids in these states can pass a watered-down bill and celebrate that they did something when they haven’t completed the mission, and that’s pretty much the pattern you see everywhere,” he said. « I’m just disappointed in my fellow Republican-led states because they could have done a much better job on policies. »
