--- title: "Montana privacy law (MCDPA): sensitive data" canonical: "https://dposchool.com/state-privacy-laws/state/montana/sensitive-data" source: "https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Montana Consumer Data Privacy Act # Montana privacy law (MCDPA): sensitive data Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Sensitive data (including health, sex life, sexual orientation, citizenship or immigration status, biometric or genetic data used to identify, data from a known child under 13, and precise geolocation within 1,750 feet) may be processed only with consent, and a known child's data only in line with COPPA. Consent is needed to sell or use for targeted advertising the data of a consumer known to be 13 to 15. Since 1 October 2025, controllers of online services known to be used by minors (under 18) owe a duty of reasonable care and need consent before targeted advertising, sale, certain profiling, extended retention or precise geolocation collection. ## Key points 1. Sensitive data list includes data revealing racial or ethnic origin, religious beliefs, health, sex life, sexual orientation, citizenship or immigration status, identifying biometric or genetic data, a known child's data, and precise geolocation. Section: [§ 30-14-2802(28)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 2. Processing sensitive data requires consent; a known child's sensitive data must be processed under COPPA. Section: [§ 30-14-2812(2)(b)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 3. Targeted advertising or sale for consumers known (or wilfully disregarded) to be 13 to 15 requires consent. Section: [§ 30-14-2812(2)(d)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 4. Online services known to be offered to minors (under 18) must use reasonable care to avoid a heightened risk of harm to minors. Section: [§ 30-14-2811(1); § 30-14-2802(16)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 5. Without the minor's consent (or a parent's, for a child under 13), no targeted advertising, sale, significant profiling, unrelated secondary use or over-long retention of a minor's data, no engagement-extending design features, and limits on precise geolocation. Section: [§ 30-14-2811(2), (3)(a)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 6. No manipulative consent mechanisms for minors; direct messaging needs safeguards against unsolicited adult contact. Section: [§ 30-14-2811(3)(b)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) 7. Consent must be revocable as easily as given; processing stops within 45 days of revocation. Section: [§ 30-14-2812(1)(c)](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) ## Sources - [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0020/0300-0140-0280-0020.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0020/0300-0140-0280-0020.html) - [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0110/0300-0140-0280-0110.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0110/0300-0140-0280-0110.html) - [https://archive.legmt.gov/bills/mca/title\_0300/chapter\_0140/part\_0280/section\_0120/0300-0140-0280-0120.html](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0120/0300-0140-0280-0120.html) [Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Montana statute](https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html) Reference material, not legal advice. ## Other topics for Montana - [Applicability](https://dposchool.com/state-privacy-laws/state/montana/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/montana/consumer-rights) - [Controller duties](https://dposchool.com/state-privacy-laws/state/montana/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/montana/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/montana/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Montana](https://dposchool.com/state-privacy-laws/state/montana) / Sensitive data Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/montana/consumer-rights) Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/montana/controller-duties) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents