--- title: "Montana privacy law (MCDPA): controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/montana/controller-duties" source: "https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Montana Consumer Data Privacy Act # Montana privacy law (MCDPA): controller duties Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Controllers must keep collection to what is adequate, relevant and reasonably necessary for disclosed purposes, secure the data, and publish a privacy notice that, since October 2025, also lists the date of last update, is offered in each language used for the service, is accessible, and is linked from the home page with the word 'privacy'. Data protection assessments are required for targeted advertising, sale, risky profiling and sensitive data (for activities after 1 January 2025), and for online services offered to minors where there is a heightened risk of harm (from 1 October 2025). Opt-out preference signals must be honored from 1 January 2025. ## Key points 1. Data minimisation: collection limited to what is adequate, relevant and reasonably necessary for the disclosed purposes. Section: [§ 30-14-2812(1)(a)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 2. Privacy notice: categories of data, purposes, categories sold or shared and recipients, contact method, rights and appeal, and the date last updated. Section: [§ 30-14-2812(5)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 3. Notice must be available in each language of the service, accessible to people with disabilities, and posted via a conspicuous 'privacy' link. Section: [§ 30-14-2812(6), (7), (10)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 4. Material changes to the notice or practices must be notified, with a chance to withdraw consent. Section: [§ 30-14-2812(8)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 5. Clear opt-out method outside the notice (for example a 'your privacy rights' link) for sale and targeted advertising. Section: [§ 30-14-2812(4)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 6. Opt-out preference signals for sale and targeted advertising must be honored no later than 1 January 2025. Section: [§ 30-14-2809(3)(b)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 7. Data protection assessments for heightened-risk processing, for activities created after 1 January 2025. Section: [§ 30-14-2814(1), (6)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 8. Minors' assessments for online services from 1 October 2025, with a mitigation plan and records kept at least 3 years. Section: [§ 30-14-2819](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) ## Sources - [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0120/0300-0140-0280-0120.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0120/0300-0140-0280-0120.html) - [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0090/0300-0140-0280-0090.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0090/0300-0140-0280-0090.html) - [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0140/0300-0140-0280-0140.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0140/0300-0140-0280-0140.html) - [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0190/0300-0140-0280-0190.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0190/0300-0140-0280-0190.html) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Montana statute](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) Reference material, not legal advice. ## Other topics for Montana - [Applicability](https://dposchool.com/state-privacy-laws/state/montana/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/montana/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/montana/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/montana/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/montana/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Montana](https://dposchool.com/state-privacy-laws/state/montana) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/montana/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/montana/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents