---
title: "Montana privacy law (MCDPA): enforcement"
canonical: "https://dposchool.com/state-privacy-laws/state/montana/enforcement"
source: "https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Montana Consumer Data Privacy Act

# Montana privacy law (MCDPA): enforcement

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The Attorney General has exclusive enforcement authority, using the state's unfair trade practices powers, and may issue civil investigative demands, including for data protection assessments. Since 1 October 2025 there is no cure period, and a violation carries a civil penalty of up to $7,500 each, plus injunctions and recovery of fees and costs. There is no private right of action.

## Key points

1. Attorney General has exclusive authority, using the powers in Title 30, chapter 14, parts 1 and 2.

   Section: [§ 30-14-2817(1)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

2. Civil investigative demands may request relevant data protection assessments.

   Section: [§ 30-14-2817(3)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

3. The former 60-day notice-and-cure period (due to end 1 April 2026) was removed by the 2025 amendments.

   Section: [§ 30-14-2817](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

4. Civil penalty up to $7,500 per violation; injunctions; attorney fees and expenses.

   Section: [§ 30-14-2820(2) to (4)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

5. A violation of the part is also a violation of the unfair trade practices law.

   Section: [§ 30-14-2820(1)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

6. No private right of action.

   Section: [§ 30-14-2817(5)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

## Sources

- [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0170/0300-0140-0280-0170.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0170/0300-0140-0280-0170.html)
- [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0200/0300-0140-0280-0200.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0200/0300-0140-0280-0200.html)

[Compare enforcement across all states](https://dposchool.com/state-privacy-laws/topic/enforcement)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 83: General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83) (enforcement)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Montana statute](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html)

Reference material, not legal advice.

## Other topics for Montana

- [Applicability](https://dposchool.com/state-privacy-laws/state/montana/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/montana/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/montana/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/montana/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/montana/processors)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Montana](https://dposchool.com/state-privacy-laws/state/montana) / Enforcement

Previous: [Processors](https://dposchool.com/state-privacy-laws/state/montana/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents