Comprehensive state privacy law
Montana privacy law
Montana Consumer Data Privacy Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Mont. Code Ann. §§ 30-14-2801 to 30-14-2820
- Official text
- https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html
- In force
- October 1, 2024
- Effective dates
- October 1, 2024: main provisions (2023 MCA shows each section 'Effective October 1, 2024')
- January 1, 2025: opt-out preference signals must be honored (§ 30-14-2809(3)(b)); data protection assessments apply to processing activities created or generated after this date (§ 30-14-2814(6))
- October 1, 2025: 2025 amendments (Laws of Montana 2025, ch. 567): lower thresholds, narrower exemptions, minors' duties, longer privacy notice, cure period removed, $7,500 civil penalty
- Enforcer
- Attorney General (exclusive)
- Private right of action
- No. The part expressly provides no basis for a private right of action (§ 30-14-2817(5)).
- Cure period
- Ended October 1, 2025. The original act gave a 60-day cure period after an Attorney General notice, set to end on 1 April 2026. The 2025 amendments (in force 1 October 2025) removed it; § 30-14-2817 now has no notice-and-cure step. § 30-14-2820(2) still refers to 'the 30-day period described in 30-14-2817(3)', but § 30-14-2817(3) now deals with civil investigative demands, so that cross-reference has no clear object. (§ 30-14-2817)
- Rulemaking
- No. The part grants no rulemaking power. The Attorney General must post guidance and a complaint mechanism online (§ 30-14-2817(2)).
Amendments
- Laws of Montana 2025, ch. 567 (reported as SB 297) (in force October 1, 2025). Lowered thresholds to 25,000 consumers, or 15,000 plus more than 25% of gross revenue from sales; replaced the general nonprofit exemption with a narrow one for insurance-fraud nonprofits; replaced the entity-level GLBA exemption for all financial institutions with entity exemptions for banks, credit unions and insurers plus a data-level GLBA exemption; added duties for online services offered to minors (under 18) and minor-specific assessments; expanded privacy notice content; removed the 60-day cure period; added an express civil penalty of up to $7,500 per violation.
Topics
- ApplicabilitySince 1 October 2025 the act covers persons doing business in Montana, or targeting products or services to residents, that control or process the personal data of at least 25,000 consumers (payment-only data excluded), or at least 15,000 consumers while deriving more than 25% of gross revenue from selling personal data. The minors' duties in §§ 30-14-2811, 30-14-2818 and 30-14-2819 apply regardless of these thresholds. Nonprofits are now covered except those set up to fight insurance fraud; banks, credit unions, insurers and HIPAA covered entities and business associates remain exempt at entity level, while other GLBA data is exempt at data level.
- Consumer rightsConsumers may confirm and access, correct, delete, and port their data, and opt out of targeted advertising, sale and profiling for automated decisions with legal or similarly significant effects. Controllers must answer within 45 days, extendable once by 45 days with notice, and give information free once in any 12 months. A refusal must be appealable; the controller decides an appeal within 60 days and, on denial, points the consumer to the Attorney General.
- Sensitive dataSensitive data (including health, sex life, sexual orientation, citizenship or immigration status, biometric or genetic data used to identify, data from a known child under 13, and precise geolocation within 1,750 feet) may be processed only with consent, and a known child's data only in line with COPPA. Consent is needed to sell or use for targeted advertising the data of a consumer known to be 13 to 15. Since 1 October 2025, controllers of online services known to be used by minors (under 18) owe a duty of reasonable care and need consent before targeted advertising, sale, certain profiling, extended retention or precise geolocation collection.
- Controller dutiesControllers must keep collection to what is adequate, relevant and reasonably necessary for disclosed purposes, secure the data, and publish a privacy notice that, since October 2025, also lists the date of last update, is offered in each language used for the service, is accessible, and is linked from the home page with the word 'privacy'. Data protection assessments are required for targeted advertising, sale, risky profiling and sensitive data (for activities after 1 January 2025), and for online services offered to minors where there is a heightened risk of harm (from 1 October 2025). Opt-out preference signals must be honored from 1 January 2025.
- ProcessorsProcessors must follow the controller's instructions and help with consumer requests, security, breach notice and assessments. A binding contract must set out instructions, nature and purpose, data types, duration and the parties' rights and obligations. It must also require confidentiality, deletion or return at the end, compliance information on request, flow-down to subcontractors, and cooperation with assessments or an independent assessor's report.
- EnforcementThe Attorney General has exclusive enforcement authority, using the state's unfair trade practices powers, and may issue civil investigative demands, including for data protection assessments. Since 1 October 2025 there is no cure period, and a violation carries a civil penalty of up to $7,500 each, plus injunctions and recovery of fees and costs. There is no private right of action.
Sources
- Montana Code Annotated 2025, Title 30, ch. 14, part 28 (sections 30-14-2801 to 30-14-2820)
- Montana Code Annotated 2023, § 30-14-2803 (Applicability, pre-2025 text)
- Montana Code Annotated 2023, § 30-14-2804 (Exemptions, pre-2025 text)
- Montana Code Annotated 2023, § 30-14-2817 (Enforcement, pre-2025 text with 60-day cure)
- Law-firm and privacy-group summaries of SB 297 (2025), used only to locate the bill number
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Montana statute
Reference material, not legal advice.