Montana Consumer Data Privacy Act
Montana privacy law (MCDPA): sensitive data
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Sensitive data (including health, sex life, sexual orientation, citizenship or immigration status, biometric or genetic data used to identify, data from a known child under 13, and precise geolocation within 1,750 feet) may be processed only with consent, and a known child's data only in line with COPPA. Consent is needed to sell or use for targeted advertising the data of a consumer known to be 13 to 15. Since 1 October 2025, controllers of online services known to be used by minors (under 18) owe a duty of reasonable care and need consent before targeted advertising, sale, certain profiling, extended retention or precise geolocation collection.
Key points
Sensitive data list includes data revealing racial or ethnic origin, religious beliefs, health, sex life, sexual orientation, citizenship or immigration status, identifying biometric or genetic data, a known child's data, and precise geolocation.
Section: § 30-14-2802(28)
Processing sensitive data requires consent; a known child's sensitive data must be processed under COPPA.
Section: § 30-14-2812(2)(b)
Targeted advertising or sale for consumers known (or wilfully disregarded) to be 13 to 15 requires consent.
Section: § 30-14-2812(2)(d)
Online services known to be offered to minors (under 18) must use reasonable care to avoid a heightened risk of harm to minors.
Section: § 30-14-2811(1); § 30-14-2802(16)
Without the minor's consent (or a parent's, for a child under 13), no targeted advertising, sale, significant profiling, unrelated secondary use or over-long retention of a minor's data, no engagement-extending design features, and limits on precise geolocation.
Section: § 30-14-2811(2), (3)(a)
No manipulative consent mechanisms for minors; direct messaging needs safeguards against unsolicited adult contact.
Section: § 30-14-2811(3)(b)
Consent must be revocable as easily as given; processing stops within 45 days of revocation.
Section: § 30-14-2812(1)(c)
Sources
- https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0020/0300-0140-0280-0020.html
- https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0110/0300-0140-0280-0110.html
- https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0120/0300-0140-0280-0120.html
Compare sensitive data across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 9: Processing of special categories of personal data (sensitive data)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Montana statute
Reference material, not legal advice.