As spring heads into summer, legislative sessions at the state level will be either concluding or gaining momentum, driven by the urgency to finalize pending matters. In recent years, this period has seen a surge in legislation concerning privacy and data security. With 2025 holding true to form, there are two notable bills under consideration worth paying attention to: Connecticut’s Senate Bill 1356 and Montana’s Senate Bill 297.
These bills each propose a number of amendments to their respective state’s comprehensive privacy laws. However, a significant aspect of both bills is the treatment of financial institutions under state privacy laws. Typically, financial institutions subject to the Gramm-Leach-Bliley Act (GLBA) are fully exempt from these state privacy laws. Currently, there are just three states that are outliers to this exemption. In California, Oregon, and Minnesota, only data covered by the GLBA is exempt.
Connecticut and Montana are now taking steps to claw back their full exemption for financial institutions, limiting it specifically to GLBA-covered data. This seemingly minor change has broader implications for businesses that may operate as financial institutions in certain contexts but not in others. For instance, an auto dealership acts as a financial institution when handling financing or leasing for its customers, collecting personal information under GLBA for credit applications and extensions. Conversely, when a customer visits for an oil change or browses the dealership’s website, the data collected does not fall under GLBA.
In cases where financial institutions are fully exempt from comprehensive state privacy laws due to GLBA coverage, these businesses are not required to comply with state privacy laws, leaving a significant amount of data unprotected by both GLBA and state privacy laws. The Connecticut Attorney General has emphasized this issue, advocating for legislative amendments to narrow the scope of exemptions.
As of April 16, the Montana bill has successfully passed both the state Senate and House and is awaiting the governor’s signature. The Connecticut bill has cleared committee review and received favorable reports for passage, suggesting there will be swift progress. Going forward, we expect to see more states revisiting and refining their privacy laws to address perceived over-application of exemptions.
To see a video on this topic, you can visit our LinkedIn. As always, we’re here to help! Contact us if you have any questions.
A Partner at M&S, Josh advises clients on a range of proactive and responsive matters, helping them achieve their business goals while complying with federal and state privacy and other consumer protection laws.