Montana Consumer Data Privacy Act
Montana privacy law (MCDPA): controller duties
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Controllers must keep collection to what is adequate, relevant and reasonably necessary for disclosed purposes, secure the data, and publish a privacy notice that, since October 2025, also lists the date of last update, is offered in each language used for the service, is accessible, and is linked from the home page with the word 'privacy'. Data protection assessments are required for targeted advertising, sale, risky profiling and sensitive data (for activities after 1 January 2025), and for online services offered to minors where there is a heightened risk of harm (from 1 October 2025). Opt-out preference signals must be honored from 1 January 2025.
Key points
Data minimisation: collection limited to what is adequate, relevant and reasonably necessary for the disclosed purposes.
Section: § 30-14-2812(1)(a)
Privacy notice: categories of data, purposes, categories sold or shared and recipients, contact method, rights and appeal, and the date last updated.
Section: § 30-14-2812(5)
Notice must be available in each language of the service, accessible to people with disabilities, and posted via a conspicuous 'privacy' link.
Section: § 30-14-2812(6), (7), (10)
Material changes to the notice or practices must be notified, with a chance to withdraw consent.
Section: § 30-14-2812(8)
Clear opt-out method outside the notice (for example a 'your privacy rights' link) for sale and targeted advertising.
Section: § 30-14-2812(4)
Opt-out preference signals for sale and targeted advertising must be honored no later than 1 January 2025.
Section: § 30-14-2809(3)(b)
Data protection assessments for heightened-risk processing, for activities created after 1 January 2025.
Section: § 30-14-2814(1), (6)
Minors' assessments for online services from 1 October 2025, with a mitigation plan and records kept at least 3 years.
Section: § 30-14-2819
Sources
- https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0120/0300-0140-0280-0120.html
- https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0090/0300-0140-0280-0090.html
- https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0140/0300-0140-0280-0140.html
- https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0190/0300-0140-0280-0190.html
Compare controller duties across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 35: Data protection impact assessment (assessments)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Montana statute
Reference material, not legal advice.