---
title: "Montana privacy law (MCDPA): overview"
canonical: "https://dposchool.com/state-privacy-laws/state/montana"
source: "https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Comprehensive state privacy law

# Montana privacy law

Montana Consumer Data Privacy Act

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

- **Citation:** Mont. Code Ann. §§ 30-14-2801 to 30-14-2820
- **Official text:** https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html
- **Enacted:** [Laws of Montana 2023, ch. 681](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)
- **In force:** October 1, 2024
- **Effective dates:**
  - **October 1, 2024:** main provisions (2023 MCA shows each section 'Effective October 1, 2024')
  - **January 1, 2025:** opt-out preference signals must be honored (§ 30-14-2809(3)(b)); data protection assessments apply to processing activities created or generated after this date (§ 30-14-2814(6))
  - **October 1, 2025:** 2025 amendments (Laws of Montana 2025, ch. 567): lower thresholds, narrower exemptions, minors' duties, longer privacy notice, cure period removed, $7,500 civil penalty
- **Enforcer:** Attorney General (exclusive)
- **Private right of action:** No. The part expressly provides no basis for a private right of action (§ 30-14-2817(5)).
- **Cure period:** Ended October 1, 2025. The original act gave a 60-day cure period after an Attorney General notice, set to end on 1 April 2026. The 2025 amendments (in force 1 October 2025) removed it; § 30-14-2817 now has no notice-and-cure step. § 30-14-2820(2) still refers to 'the 30-day period described in 30-14-2817(3)', but § 30-14-2817(3) now deals with civil investigative demands, so that cross-reference has no clear object. (§ 30-14-2817)
- **Rulemaking:** No. The part grants no rulemaking power. The Attorney General must post guidance and a complaint mechanism online (§ 30-14-2817(2)).

## Amendments

- [Laws of Montana 2025, ch. 567 (reported as SB 297)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) (in force October 1, 2025). Lowered thresholds to 25,000 consumers, or 15,000 plus more than 25% of gross revenue from sales; replaced the general nonprofit exemption with a narrow one for insurance-fraud nonprofits; replaced the entity-level GLBA exemption for all financial institutions with entity exemptions for banks, credit unions and insurers plus a data-level GLBA exemption; added duties for online services offered to minors (under 18) and minor-specific assessments; expanded privacy notice content; removed the 60-day cure period; added an express civil penalty of up to $7,500 per violation.

## Topics

- [Applicability](https://dposchool.com/state-privacy-laws/state/montana/applicability): Since 1 October 2025 the act covers persons doing business in Montana, or targeting products or services to residents, that control or process the personal data of at least 25,000 consumers (payment-only data excluded), or at least 15,000 consumers while deriving more than 25% of gross revenue from selling personal data. The minors' duties in §§ 30-14-2811, 30-14-2818 and 30-14-2819 apply regardless of these thresholds. Nonprofits are now covered except those set up to fight insurance fraud; banks, credit unions, insurers and HIPAA covered entities and business associates remain exempt at entity level, while other GLBA data is exempt at data level.
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/montana/consumer-rights): Consumers may confirm and access, correct, delete, and port their data, and opt out of targeted advertising, sale and profiling for automated decisions with legal or similarly significant effects. Controllers must answer within 45 days, extendable once by 45 days with notice, and give information free once in any 12 months. A refusal must be appealable; the controller decides an appeal within 60 days and, on denial, points the consumer to the Attorney General.
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/montana/sensitive-data): Sensitive data (including health, sex life, sexual orientation, citizenship or immigration status, biometric or genetic data used to identify, data from a known child under 13, and precise geolocation within 1,750 feet) may be processed only with consent, and a known child's data only in line with COPPA. Consent is needed to sell or use for targeted advertising the data of a consumer known to be 13 to 15. Since 1 October 2025, controllers of online services known to be used by minors (under 18) owe a duty of reasonable care and need consent before targeted advertising, sale, certain profiling, extended retention or precise geolocation collection.
- [Controller duties](https://dposchool.com/state-privacy-laws/state/montana/controller-duties): Controllers must keep collection to what is adequate, relevant and reasonably necessary for disclosed purposes, secure the data, and publish a privacy notice that, since October 2025, also lists the date of last update, is offered in each language used for the service, is accessible, and is linked from the home page with the word 'privacy'. Data protection assessments are required for targeted advertising, sale, risky profiling and sensitive data (for activities after 1 January 2025), and for online services offered to minors where there is a heightened risk of harm (from 1 October 2025). Opt-out preference signals must be honored from 1 January 2025.
- [Processors](https://dposchool.com/state-privacy-laws/state/montana/processors): Processors must follow the controller's instructions and help with consumer requests, security, breach notice and assessments. A binding contract must set out instructions, nature and purpose, data types, duration and the parties' rights and obligations. It must also require confidentiality, deletion or return at the end, compliance information on request, flow-down to subcontractors, and cooperation with assessments or an independent assessor's report.
- [Enforcement](https://dposchool.com/state-privacy-laws/state/montana/enforcement): The Attorney General has exclusive enforcement authority, using the state's unfair trade practices powers, and may issue civil investigative demands, including for data protection assessments. Since 1 October 2025 there is no cure period, and a violation carries a civil penalty of up to $7,500 each, plus injunctions and recovery of fees and costs. There is no private right of action.

## Sources

- [Montana Code Annotated 2025, Title 30, ch. 14, part 28 (sections 30-14-2801 to 30-14-2820)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)
- [Montana Code Annotated 2023, § 30-14-2803 (Applicability, pre-2025 text)](https://archive.legmt.gov/bills/2023/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html)
- [Montana Code Annotated 2023, § 30-14-2804 (Exemptions, pre-2025 text)](https://archive.legmt.gov/bills/2023/mca/title_0300/chapter_0140/part_0280/section_0040/0300-0140-0280-0040.html)
- [Montana Code Annotated 2023, § 30-14-2817 (Enforcement, pre-2025 text with 60-day cure)](https://archive.legmt.gov/bills/2023/mca/title_0300/chapter_0140/part_0280/section_0170/0300-0140-0280-0170.html)
- [Law-firm and privacy-group summaries of SB 297 (2025), used only to locate the bill number](https://fpf.org/blog/amendments-to-the-montana-consumer-data-privacy-act-bring-big-changes-to-big-sky-country/)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Montana statute](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

Reference material, not legal advice.

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Montana

Previous: [Texas](https://dposchool.com/state-privacy-laws/state/texas)

Next: [Delaware](https://dposchool.com/state-privacy-laws/state/delaware)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents