--- title: "Montana privacy law (MCDPA): applicability" canonical: "https://dposchool.com/state-privacy-laws/state/montana/applicability" source: "https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Montana Consumer Data Privacy Act # Montana privacy law (MCDPA): applicability Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Since 1 October 2025 the act covers persons doing business in Montana, or targeting products or services to residents, that control or process the personal data of at least 25,000 consumers (payment-only data excluded), or at least 15,000 consumers while deriving more than 25% of gross revenue from selling personal data. The minors' duties in §§ 30-14-2811, 30-14-2818 and 30-14-2819 apply regardless of these thresholds. Nonprofits are now covered except those set up to fight insurance fraud; banks, credit unions, insurers and HIPAA covered entities and business associates remain exempt at entity level, while other GLBA data is exempt at data level. ## Key points 1. Threshold: personal data of 25,000 or more consumers, excluding data processed only to complete a payment. Section: [§ 30-14-2803(1)(a)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 2. Alternative threshold: 15,000 or more consumers plus more than 25% of gross revenue from selling personal data. Section: [§ 30-14-2803(1)(b)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 3. Minors' duty of care, minors' processor duties and minors' assessments apply to anyone doing business in Montana or intentionally targeting residents, with no volume threshold. Section: [§ 30-14-2803(2)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 4. Entity exemptions: state bodies, insurance-fraud nonprofits, higher education, registered national securities associations, banks and credit unions (and financial affiliates), HIPAA covered entities and business associates, insurers and insurance producers. Section: [§ 30-14-2804(1)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 5. GLBA: personal data handled under Title V of the GLBA is exempt at data level; other financial companies are no longer exempt as entities. Section: [§ 30-14-2804(1)(f)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 6. Employee, applicant and contractor data and individuals acting in a commercial or employment context are outside the act. Section: [§ 30-14-2802(7)(b); § 30-14-2804(2)(o)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 7. Data exemptions also cover HIPAA PHI, FCRA activity, DPPA, FERPA, Farm Credit Act data and certain research data. Section: [§ 30-14-2804(2)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) ## Sources - [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0030/0300-0140-0280-0030.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html) - [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0040/0300-0140-0280-0040.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0040/0300-0140-0280-0040.html) - [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0020/0300-0140-0280-0020.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0020/0300-0140-0280-0020.html) [Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Montana statute](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) Reference material, not legal advice. ## Other topics for Montana - [Consumer rights](https://dposchool.com/state-privacy-laws/state/montana/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/montana/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/montana/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/montana/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/montana/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Montana](https://dposchool.com/state-privacy-laws/state/montana) / Applicability Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/montana/consumer-rights) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents