DPO SchoolDPO School

Montana Consumer Data Privacy Act

Montana privacy law (MCDPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Since 1 October 2025 the act covers persons doing business in Montana, or targeting products or services to residents, that control or process the personal data of at least 25,000 consumers (payment-only data excluded), or at least 15,000 consumers while deriving more than 25% of gross revenue from selling personal data. The minors' duties in §§ 30-14-2811, 30-14-2818 and 30-14-2819 apply regardless of these thresholds. Nonprofits are now covered except those set up to fight insurance fraud; banks, credit unions, insurers and HIPAA covered entities and business associates remain exempt at entity level, while other GLBA data is exempt at data level.

Key points

  1. Threshold: personal data of 25,000 or more consumers, excluding data processed only to complete a payment.

    Section: § 30-14-2803(1)(a)

  2. Alternative threshold: 15,000 or more consumers plus more than 25% of gross revenue from selling personal data.

    Section: § 30-14-2803(1)(b)

  3. Minors' duty of care, minors' processor duties and minors' assessments apply to anyone doing business in Montana or intentionally targeting residents, with no volume threshold.

    Section: § 30-14-2803(2)

  4. Entity exemptions: state bodies, insurance-fraud nonprofits, higher education, registered national securities associations, banks and credit unions (and financial affiliates), HIPAA covered entities and business associates, insurers and insurance producers.

    Section: § 30-14-2804(1)

  5. GLBA: personal data handled under Title V of the GLBA is exempt at data level; other financial companies are no longer exempt as entities.

    Section: § 30-14-2804(1)(f)

  6. Employee, applicant and contractor data and individuals acting in a commercial or employment context are outside the act.

    Section: § 30-14-2802(7)(b); § 30-14-2804(2)(o)

  7. Data exemptions also cover HIPAA PHI, FCRA activity, DPPA, FERPA, Farm Credit Act data and certain research data.

    Section: § 30-14-2804(2)

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Montana statute

Reference material, not legal advice.