Privacy Law Library

Montana Consumer Data Privacy Act

MTCDPA

Comprehensive privacy · Children

Montana's comprehensive consumer privacy law gives Montana residents rights to access, correct, delete and port their personal data and to opt out of targeted advertising, sale and significant profiling, and requires opt-in consent for sensitive data. The 2025 amendments (SB 297, Ch. 567, L. 2025) lowered the applicability thresholds, narrowed the financial-institution exemption to entity-level exemptions for banks, credit unions and insurers, expanded privacy-notice rules, removed the cure period, and added a duty of care and design limits for online services offered to known minors under 18.

Where
Montana
Citation
Mont. Code Ann. 30-14-2801 to 30-14-2820
Status
In force
In force since
2024-10-01
Last amended
2025-10-01
Enforced by
Montana Attorney General (exclusive; 30-14-2817(1)), using Montana Unfair Trade Practices and Consumer Protection Act powers
People can sue
No
Penalties
A violation is a violation of the Montana Unfair Trade Practices and Consumer Protection Act (Title 30, ch. 14, parts 1-2); civil penalty up to $7,500 per violation, injunctive relief, and attorney fees and investigation costs (30-14-2820). The original 60-day cure period (set to sunset April 1, 2026) was removed by SB 297 (2025).
Applies to
  • Persons that conduct business in Montana or produce products or services targeted to Montana residents and control or process personal data of at least 25,000 consumers (excluding data processed solely to complete a payment transaction) (30-14-2803(1)(a), as amended 2025; was 50,000)
  • Persons that control or process personal data of at least 15,000 consumers and derive more than 25% of gross revenue from selling personal data (30-14-2803(1)(b), as amended 2025; was 25,000)
  • Minor-protection duties in 30-14-2811, 30-14-2818 and 30-14-2819 apply to any person conducting business in Montana or delivering products or services intentionally targeted to residents, with no volume threshold (30-14-2803(2))
  • Processors acting on behalf of controllers (30-14-2813)
  • Excludes state and local government bodies, insurance-fraud nonprofits, institutions of higher education, registered national securities associations, banks and credit unions and their financial affiliates, HIPAA covered entities and business associates, and insurers/insurance producers; exempts GLBA, FCRA, FERPA, DPPA, PHI and employment-context data (30-14-2804)

What a privacy notice must say

  • Post a privacy notice (linked with the word "privacy") listing data categories, purposes, data sold or shared, third-party categories, a contact method, how to exercise and appeal rights, and the last-updated date; offer it in each language the controller does business in and in an accessible format.Mont. Code Ann. 30-14-2812(5)-(7), (10) · From 2025-10-01
  • Controllers that sell data or use it for targeted advertising must disclose this and provide a clear and conspicuous opt-out method outside the privacy notice.Mont. Code Ann. 30-14-2812(4) · Only if: Controller sells personal data or processes it for targeted advertising

Rights it gives people

  • Consumers may confirm and access, correct, delete, and obtain a portable copy of their personal data, and opt out of targeted advertising, sale, and profiling for decisions with legal or similarly significant effects.Mont. Code Ann. 30-14-2808(1)

Practices it requires

  • When responding to an access request, do not disclose SSNs, government ID numbers, financial or health account numbers, passwords or security answers, or biometric data; instead say that such data has been collected.Mont. Code Ann. 30-14-2808(6) · From 2025-10-01
  • Honor opt-outs from authorized agents and, from January 1, 2025, universal opt-out preference signals; provide a clear and conspicuous website opt-out link.Mont. Code Ann. 30-14-2809(1)-(3) · From 2025-01-01
  • Obtain consent before processing sensitive data (process a known child's sensitive data per COPPA), and obtain consent before targeted advertising to or sale of data of consumers known to be 13 to 15 years old.Mont. Code Ann. 30-14-2812(2)(b), (2)(d)
  • Controllers offering online services to consumers actually known or wilfully disregarded to be minors (under 18) must use reasonable care to avoid heightened risk of harm, and without consent may not process minors' data for targeted ads, sale or significant profiling, use engagement-extending design features, or collect precise geolocation beyond what is necessary; adult-to-minor unsolicited messaging safeguards are required.Mont. Code Ann. 30-14-2811 · Only if: Online service, product or feature offered to a known minor · From 2025-10-01
  • Respond to rights requests within 45 days (extendable once by 45 days), free once per 12 months, and provide an appeal process for refusals.Mont. Code Ann. 30-14-2808(4)-(5)
  • Bind processors by contract covering instructions, confidentiality, deletion or return of data, subcontractor flow-down and audits.Mont. Code Ann. 30-14-2813(2)

Security duties

  • Limit collection to what is adequate, relevant and reasonably necessary, and maintain reasonable administrative, technical and physical data security practices.Mont. Code Ann. 30-14-2812(1)(a)-(b)

Other duties

  • Conduct and document data protection assessments for targeted advertising, sale, risky profiling and sensitive-data processing; provide them to the Attorney General on request.Mont. Code Ann. 30-14-2814 · From 2025-01-01
  • Conduct, review and keep for at least 3 years a minors-specific data protection assessment for online services posing a heightened risk of harm to minors, and implement a mitigation plan.Mont. Code Ann. 30-14-2819 · Only if: Online service offered to known minors on or after October 1, 2025 · From 2025-10-01

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: SB 297 contains no effective-date section; the 2025-10-01 date rests on Montana's default October 1 effective date (Mont. Code Ann. 1-2-201) and 30-14-2819(7), not on a fetched bill-history record. | 30-14-2820(2) still refers to a '30-day period described in 30-14-2817(3)', but the codified 30-14-2817 contains no cure period; this appears to be a drafting cross-reference error. Whether the AG treats any cure period as available is not verified. | Montana DOJ consumer data privacy page (dojmt.gov) returned HTTP 403, so AG guidance and complaint mechanism were not checked.

Research reference, not legal advice.