Montana Consumer Data Privacy Act (MCDPA): 2026 Guide to Who Must Comply and What Changed

Last updated November 10, 2026. This article is educational and is not legal advice.

The Montana Consumer Data Privacy Act took effect on October 1, 2024, and it was broadened by Senate Bill 297 on October 1, 2025. If you last read about Montana’s law before the amendment, several things you learned are out of date: the thresholds are lower, the cure period is gone and the penalties are now stated in the law. This guide explains the current rules.

Key takeaways

• Who it covers: Since October 1, 2025, the MCDPA applies to businesses that control or process the personal data of at least 25,000 Montana consumers, or at least 15,000 Montana consumers while deriving more than 25 percent of gross revenue from selling personal data.
• The old thresholds are out: The earlier tests of 50,000 consumers, or 25,000 consumers with the 25 percent revenue test, no longer apply. Businesses with between 25,000 and 50,000 Montana consumers are no longer exempt on that basis.
• No cure period: The 60-day cure period was removed on October 1, 2025, earlier than its planned expiration, so the Attorney General can take action without first offering a chance to fix a violation.
• Penalties: The amended law provides for civil penalties of up to 7,500 dollars per violation, enforced by the Montana Attorney General. There is no private right of action.

What is the Montana Consumer Data Privacy Act?

Montana Governor Greg Gianforte signed the original law, Senate Bill 384, on May 19, 2023. It gives Montana residents rights over their personal data and sets duties for businesses that collect and process it. Governor Gianforte signed Senate Bill 297, which amended the law, on May 8, 2025.

Who must comply with the MCDPA?

Since October 1, 2025, the MCDPA applies to any person that conducts business in Montana or produces products or services targeted to Montana residents and that does either of the following:

• Controls or processes the personal data of at least 25,000 Montana consumers, excluding data processed solely to complete a payment transaction.
• Controls or processes the personal data of at least 15,000 Montana consumers and derives more than 25 percent of its gross revenue from the sale of personal data.

Test	Before October 1, 2025	Since October 1, 2025
General threshold	50,000 consumers	25,000 consumers
Data sale revenue test	25,000 consumers and more than 25 percent of gross revenue from selling data	15,000 consumers and more than 25 percent of gross revenue from selling data
Cure period	60 days, scheduled to end on January 1, 2026	Removed on October 1, 2025

Montana’s law has no overall revenue-size threshold, and its consumer counts are among the lowest in the country. A company with 30,000 Montana customers was exempt under the old thresholds and is covered today.

Exemptions

The MCDPA continues to exempt certain categories of organizations and data, including government bodies and HIPAA-regulated entities and data, along with data covered by laws such as the Fair Credit Reporting Act, the Family Educational Rights and Privacy Act, the Driver’s Privacy Protection Act and the Farm Credit Act. The amendments narrowed the financial institution exemption. Gramm-Leach-Bliley Act covered data remains exempt, but the broader exemption for entire financial institutions was removed. Confirm any exemption you plan to rely on against the amended statute with counsel.

What else Senate Bill 297 changed

• Lower applicability thresholds, described above.
• Removal of the cure period on October 1, 2025.
• Civil penalties of up to 7,500 dollars per violation, enforced by the Attorney General.
• Stronger protections for minors. The amendments add duties for businesses that offer online services to known minors, and the minors provisions reportedly reach more broadly than the general thresholds. If you serve young users, confirm whether you are covered even below 25,000 Montana consumers.
• Privacy notice requirements. Notice requirements were tightened, so privacy policies written for the original law should be reviewed.

Consumer rights under the MCDPA

• Access and confirmation of whether a controller is processing their data.
• Correction of inaccurate personal data.
• Deletion of personal data provided by or obtained about the consumer.
• Portability, a copy of their data in a portable and usable format.
• Opt out of targeted advertising, the sale of personal data and certain profiling.

Controllers must provide ways to exercise these rights, explain them in a privacy notice, and respond within 45 days, with a possible extension, to consumer requests.

What businesses must do

• Limit collection to what is adequate, relevant and reasonably necessary for the disclosed purposes.
• Protect personal data with reasonable security measures.
• Obtain consent before processing sensitive data, and consent from a parent or guardian for known children.
• Avoid processing that unlawfully discriminates against consumers, and avoid targeted advertising or sale of data for known minors without required consent.
• Run data protection assessments for higher-risk processing such as targeted advertising, sale of personal data, certain profiling and sensitive data.
• Sign contracts with processors that set out processing instructions and obligations.
• Make consent valid: freely given, specific, informed and unambiguous, and not obtained through dark patterns.

Enforcement and penalties

The Montana Attorney General has exclusive enforcement authority. Because the cure period is gone, the Attorney General can bring an action for alleged violations immediately, and the amended law provides for civil penalties of up to 7,500 dollars per violation. Consumers cannot sue under the MCDPA.

Montana compliance checklist for 2026

1. Recount Montana consumers against the new 25,000 and 15,000 thresholds, and assume you may be in scope if you were previously just below the old numbers.
2. Review your privacy notice against the amended requirements.
3. Check that your consent platform captures valid consent for sensitive data and honors opt-outs and opt-out preference signals.
4. Confirm that data subject requests are logged and answered within the deadlines.
5. Review your practices for known minors, including advertising and profiling.
6. Update processor contracts and data protection assessments.
7. Document your compliance steps, since there is no guaranteed chance to cure.

Frequently asked questions

Who does the Montana Consumer Data Privacy Act apply to?

Since October 1, 2025, it applies to businesses that control or process the personal data of at least 25,000 Montana consumers, or at least 15,000 Montana consumers while deriving more than 25 percent of gross revenue from selling personal data.

Is there a cure period under the MCDPA?

No. The 60-day cure period was removed on October 1, 2025.

What are the penalties under the MCDPA?

The amended law provides for civil penalties of up to 7,500 dollars per violation, enforced by the Montana Attorney General.

Can Montana consumers sue businesses under the MCDPA?

No. There is no private right of action. Only the Attorney General can enforce the law.

When did the Montana privacy law take effect?

The original law took effect on October 1, 2024. Senate Bill 297’s amendments took effect on October 1, 2025.

This article is general information for educational purposes and does not constitute legal advice. Laws, regulations and enforcement priorities change, and their application depends on your facts. Consult a licensed attorney about your situation.