Regulations › US states › Montana
MCDPA
Montana Consumer Data Privacy Act
WhenIn effect since 1 October 2024
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
Thresholds25,000+ Montana consumers (excluding payment-only data), or 15,000+ consumers with over 25% re…
Universal opt-outMust honor opt-out preference signals for targeted ads and sales since January 1, 2025
Cure periodSB 297 eliminated the guaranteed 60-day cure period
Request deadline45 days, extendable once by 45 days with notice
Maximum penaltyUp to $7,500 per violation
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
2
25,000+ Montana consumers (excluding payment-only data), or 15,000+ consumers with over 25% revenue from data sales.Mont. Code Ann. § 30-14-2803(1) · source ↗
Lowered by SB 297 (2025) from 50,000 and 25,000.
Exemptions
2
Entity-level for HIPAA covered entities and for banks/credit unions; other GLBA coverage data-level only; nonprofits generally covered.Mont. Code Ann. § 30-14-2804(1)(b), (e)-(g), (2)(a) · source ↗
Sensitive data and minors
Sensitive data
1
Opt-in consent for sensitive data (health, biometrics, precise geolocation, child data and similar).Mont. Code Ann. §§ 30-14-2802(28), 30-14-2812(2)(b) · source ↗
No neural data in the definition read.
Children and teens
3
Minors under 18: duty of care, consent for ads, sale, profiling and engagement features, geolocation limits, and minors' assessments.Mont. Code Ann. §§ 30-14-2811, 30-14-2819 · source ↗
Added by SB 297; applies to services offered on or after Oct. 1, 2025.
Data minimization
1
Collection limited to what is adequate, relevant and reasonably necessary for disclosed purposes.Mont. Code Ann. § 30-14-2812(1)(a) · source ↗
Consumers' rights
Rights
2
Access, correct, delete, portability, and opt out of targeted advertising, sale and significant profiling.Mont. Code Ann. § 30-14-2808(1) · source ↗
Request deadline
2
45 days, extendable once by 45 days with notice.Mont. Code Ann. § 30-14-2808(4)(a) · source ↗
Appeals
2
Internal appeal answered within 60 days; denial must include a way to complain to the Attorney General.Mont. Code Ann. § 30-14-2808(5) · source ↗
Universal opt-out
2
Must honor opt-out preference signals for targeted ads and sales since January 1, 2025.Mont. Code Ann. § 30-14-2809(3)(b) · source ↗
Business duties
Assessments
2
Assessments for targeted ads, sale, risky profiling and sensitive data, plus minors' heightened-risk assessments; AG may demand them.Mont. Code Ann. §§ 30-14-2814, 30-14-2819 · source ↗
Processor contracts
3
Contract with instructions, confidentiality, deletion, compliance info, assessments or independent audit, and written subcontractor flow-down.Mont. Code Ann. § 30-14-2813(2) · source ↗
Privacy notice
2
Notice of categories, purposes, third parties, contacts, rights and last-updated date; must be translated, accessible and linked using 'privacy'.Mont. Code Ann. § 30-14-2812(5)-(10) · source ↗
Loyalty programs
1
Different prices allowed for bona fide loyalty, rewards, discount or club card programs.Mont. Code Ann. § 30-14-2812(3) · source ↗
De-identified data
3
Public commitment, reasonable measures and contracts for deidentified data; pseudonymous data exempt from core rights if kept separate.Mont. Code Ann. § 30-14-2815 · source ↗
Enforcement
Who enforces
1
Attorney General has exclusive enforcement authority, including civil investigative demands.Mont. Code Ann. § 30-14-2817(1), (3) · source ↗
Cure period
3
SB 297 eliminated the guaranteed 60-day cure period.Mont. Code Ann. §§ 30-14-2817, 30-14-2820 · secondary source · source ↗
Uncertain: § 30-14-2820(2) still references a '30-day period described in 30-14-2817(3)', but no cure text appears in § 30-14-2817 as read.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws