74%
of Montana's 19 requirements are already met by California (CA). Here is what MCDPA adds, biggest gaps first.
ThresholdsWho it coversBig gap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
MCDPA adds2 25,000+ Montana consumers (excluding payment-only data), or 15,000+ consumers with over 25% revenue from data sales.
Mont. Code Ann. § 30-14-2803(1) · source ↗
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
MCDPA adds2 Internal appeal answered within 60 days; denial must include a way to complain to the Attorney General.
Mont. Code Ann. § 30-14-2808(5) · source ↗
Sensitive dataSensitive data and minorsGap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
MCDPA adds1 Opt-in consent for sensitive data (health, biometrics, precise geolocation, child data and similar).
Mont. Code Ann. §§ 30-14-2802(28), 30-14-2812(2)(b) · source ↗
Children and teensSensitive data and minorsGap
CA2 Opt-in consent needed to sell or share data of consumers under 16: parental consent under 13, the teen's own consent for ages 13 to 15.
MCDPA adds3 Minors under 18: duty of care, consent for ads, sale, profiling and engagement features, geolocation limits, and minors' assessments.
Mont. Code Ann. §§ 30-14-2811, 30-14-2819 · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
MCDPA adds3 Public commitment, reasonable measures and contracts for deidentified data; pseudonymous data exempt from core rights if kept separate.
Mont. Code Ann. § 30-14-2815 · source ↗
Already covered by CA: Exemptions, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means MCDPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
