Montana Privacy Law

The Montana Consumer Data Privacy Act (MCDPA) was signed into law on May 19, 2023, and became effective on October 1, 2024. Montana's law is notable for having relatively low consumer data processing thresholds due to the state's smaller population, and for including a universal opt-out mechanism requirement. The MCDPA provides Montana consumers with comprehensive privacy rights, including the right to access, correct, delete, and port personal data, as well as opt-out rights for data sales, targeted advertising, and profiling. Montana requires businesses to honor universal opt-out mechanisms such as Global Privacy Control (GPC), placing it among the more consumer-friendly state privacy laws. The law was significantly amended by SB 297 (effective October 1, 2025), which lowered applicability thresholds to 25,000 consumers (or 15,000 consumers if 25%+ of revenue comes from data sales), added a duty of care with respect to minors, removed the right to cure, broadened enforcement powers for the Attorney General, and removed the "solely" modifier from the opt-out right for profiling in furtherance of automated decisions. The MCDPA carries penalties of up to $7,500 per violation, enforced by the Montana Attorney General.