Montana passed its Consumer Data Privacy Act in May 2023, with the law taking effect on October 1 2024. The state has since amended the law to lower applicability thresholds, making it one of the most broadly applicable state privacy laws in the country.
What Is the MCDPA?
The Montana Consumer Data Privacy Act (MCDPA) grants Montana residents rights over their personal data and creates obligations for businesses that collect and process that data. Given Montana’s smaller population, the law uses lower thresholds than most other state privacy laws to ensure meaningful coverage.
The law was amended in May 2025 through Senate Bill 297, with changes taking effect on October 1 2025.
Does It Apply to Your Business?
The MCDPA applies to entities that conduct business in Montana or deliver commercial products or services intentionally targeted to Montana residents.
Original Thresholds (October 2024)
Under the original law, businesses must meet at least one of these thresholds:
Threshold 1: Control or process the personal data of 50,000 or more Montana consumers. Personal data processed solely to complete payment transactions is excluded.
Threshold 2: Control or process the personal data of 25,000 or more Montana consumers AND derive more than 25% of gross annual revenue from selling personal data.
Updated Thresholds (October 2025)
The 2025 amendments lower these thresholds significantly:
Threshold 1: Control or process the personal data of 25,000 or more Montana consumers (down from 50,000).
Threshold 2: Control or process the personal data of 15,000 or more Montana consumers (down from 25,000) AND derive more than 25% of gross annual revenue from selling personal data.
These are among the lowest thresholds of any US state privacy law, reflecting Montana’s smaller population.
Key Consumer Rights
Montana residents have the following rights:
- Right to confirm whether a business is processing their personal data
- Right to access their personal data
- Right to correct inaccuracies
- Right to delete their personal data
- Right to obtain a portable copy of their data
- Right to opt out of targeted advertising
- Right to opt out of the sale of personal data
- Right to opt out of profiling for decisions producing legal or significant effects
Business Obligations
Covered entities must:
- Provide clear privacy notices explaining data practices
- Limit data collection to what is reasonably necessary for disclosed purposes
- Implement reasonable administrative, technical, and physical security measures
- Obtain consent before processing sensitive data
- Respond to consumer requests within 45 days
- Conduct data protection assessments for high-risk processing activities (from January 2025)
- Honor universal opt-out mechanisms such as Global Privacy Control (from January 2025)
Sensitive Data
The MCDPA treats certain categories of personal data as sensitive and requires consent before processing. Sensitive data includes:
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Sexual orientation
- Citizenship or immigration status
- Genetic data
- Biometric data
- Children’s data
- Precise geolocation
Enforcement and Penalties
The Montana Attorney General has exclusive enforcement authority. Consumers cannot bring private lawsuits under the MCDPA.
The law includes a 60-day cure period for alleged violations, which expires on April 1 2026. After that date, the Attorney General can pursue enforcement immediately.
Notable: The MCDPA does not specify caps on monetary penalties for violations. This gives the Montana Attorney General significant discretion to impose higher fines than other states, where caps typically limit exposure.
Key Dates
- May 9 2023: MCDPA signed into law
- October 1 2024: MCDPA took effect
- January 1 2025: Universal opt-out mechanism and data protection assessment requirements took effect
- 8th May 2025: SB 297 signed, amending the MCDPA
- October 1 2025: Amended thresholds took effect
- April 1 2026: 60-day cure period expires
Where to Find Official Resources
- Montana Department of Justice Consumer Data Privacy page: dojmt.gov
- Full legal text: leg.mt.gov – Senate Bill 384 and Senate Bill 297
Getting Started
Montana’s lowered thresholds mean more businesses are covered than under most other state laws. The lack of penalty caps also creates greater potential exposure for non-compliance.
Reassess your applicability under the October 2025 thresholds. If you now meet the 25,000 or 15,000 consumer thresholds, you need to comply with the full MCDPA requirements.
Ensure Global Privacy Control support is in place and that your data protection assessments are documented. With the cure period expiring in April 2026, the window for addressing compliance gaps is narrowing.
