Montana Consumer Data Privacy Act (MTCDPA): An Overview

Montana was the ninth U.S. state to enact a comprehensive consumer privacy law. Governor Greg Gianforte signed SB 384 on May 19, 2023, and the Montana Consumer Data Privacy Act (MTCDPA) took effect on October 1, 2024. In 2025, SB 297 amended the law, with changes effective October 1, 2025.

The amendments lowered the applicability thresholds, added protections for minors, removed the cure period, and introduced civil penalties. Businesses that assessed their obligations under the original 2023 text should review them again.

Montana’s law was one of five comprehensive state privacy laws enacted between March and June 2023, alongside those of Iowa, Indiana, Tennessee, and Texas. Iowa’s and Indiana’s laws were passed before Montana’s but took effect later.

The MTCDPA most closely aligns with the Connecticut Data Privacy Act (CTDPA), and SB 297 moved it closer still to Connecticut’s and Colorado’s approach on minors’ data. The U.S. still has no comprehensive federal privacy law, although several bills have been introduced in Congress.

What Is the Montana Consumer Data Privacy Act?

The Montana Consumer Data Privacy Act (MTCDPA) protects the privacy and personal data rights of Montana’s 1.1 million residents, and establishes data privacy responsibilities for companies doing business in the state or providing goods or services targeting Montana residents. In the course of doing business these organizations process consumers’ personal information. Like other states with data privacy laws, Montana defines a consumer as a resident of the state who is not acting in a commercial or employment context.

The MTCDPA uses an opt-out model for most processing, as do other U.S. state privacy laws, and it requires opt-in consent for sensitive data. This means that businesses covered by the MTCDPA must inform consumers about data collection and processing that they perform, i.e., what data, for what purposes, third parties with whom the data will be shared, etc.

Businesses must give consumers a way to opt out of data collection and processing. They and any third parties they engage for data processing must also implement reasonable security and protections.

Definitions in the Montana Consumer Data Privacy Act

The MTCDPA relies on a set of defined terms that determine who is covered and which obligations apply. The definitions below explain personal data, consent, sensitive data, controllers and processors, sale, and targeted advertising, so the requirements later in this guide are easier to follow.

Personal Data

The MTCDPA uses a fairly standard definition of personal data (also called personal information in some other laws): “any information that is linked or reasonably linkable to an identified or identifiable individual.” The law excludes publicly available information and de-identified data.

The Act does not list specific examples of personal data, as some other state-level data privacy laws do, but common types include name, account/username, IP address, email address, Social Security Number, driver’s license number, or passport number.

Consent

The European Union’s General Data Protection Regulation (GDPR) set the standard for defining consent, which has been followed by many regulations passed since.

Under MTCDPA, consent is defined as: “a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to allow the processing of personal data relating to the consumer. The term may include a written statement, a statement by electronic means, or any other unambiguous affirmative action.”

Since October 1, 2025, the mechanism for revoking consent must be at least as easy to use as the mechanism for giving it.

Interestingly, Montana’s law includes some specific exceptions to consent, which are not present in many other laws, and which reflect common digital user experiences:

• Acceptance of a general or broad term of use or similar document that contains descriptions of personal data processing along with other unrelated information
• Hovering over, muting, pausing, or closing a given piece of content
• An agreement obtained using dark patterns

Sensitive Data / Sensitive Personal Information

This covers more specific categories of personal information, particularly that could cause harm if misused, including that which reveals:

• Racial or ethnic origin
• Religious beliefs
• Mental or physical health condition or diagnosis
• Information about a person’s sex life or sexual orientation
• Citizenship or immigration status
• Processing of genetic or biometric data for the purpose of uniquely identifying an individual
• Personal data collected from a known child (under 13 years of age)
• Precise geolocation data (within 1,750 feet or 533.4 meters)

Controller

Businesses that collect and process personal information will likely qualify as controllers, which the MTCDPA defines as “an individual who or legal entity that, alone or jointly with others, determines the purpose and means of processing personal data”.

Processor

For businesses that share personal data for processing purposes, the business will be the controller and the third-party entity will be the processor, defined in the Montana privacy act as “an individual who or legal entity that processes personal data on behalf of a controller.”

Sale

This is defined as the “the exchange of personal data for monetary or other valuable consideration by the controller to a third party”. Several notable exclusions to the definition of sale of personal data include:

• Disclosure of personal data to a processor that processes the personal data on behalf of the controller
• Disclosure of personal data to a third party for the purposes of providing a product or service requested by the consumer
• Disclosure or transfer of personal data to an affiliate of the controller
• Disclosure of personal data in which the consumer directs the controller to disclose the personal data or intentionally uses the controller to interact with a third party
• Disclosure of personal data that the consumer intentionally made available to the public via a channel of mass media and did not restrict to a specific audience
• Disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction, or a proposed merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller’s assets

Targeted Advertising

Refers to “displaying advertisements to a consumer in which the advertisement is selected based on personal data obtained or inferred from that consumer’s activities over time and across nonaffiliated internet websites or online applications to predict the consumer’s preferences or interests.”

The goal is to use the personal data to predict the consumers’ interests and preferences to increase relevance and personalize the advertising experience.

Targeted advertising does not include:

• Advertisements based on activities within a controller’s own internet websites or online applications
• Advertisements based on the context of a consumer’s current search query or visit to an internet website or online application
• Advertisements directed to a consumer in response to the consumer’s request for information or feedback
• Processing personal data solely to measure or report advertising frequency, performance, or reach

Who Has to Comply With the Montana Consumer Data Privacy Act?

The MTCDPA applies to organizations that conduct business in Montana or offer products or services intentionally targeted to Montana residents. Since October 1, 2025, a business (a “controller” under the law) is covered if it meets one of two threshold criteria:

• Controls or processes the personal data of at least 25,000 Montana consumers during a calendar year, excluding data processed solely to complete a payment transaction (previously 50,000), or
• Controls or processes the personal data of at least 15,000 Montana consumers and derives more than 25 percent of gross revenue from the sale of personal data (previously 25,000)

The provisions on minors’ data apply to businesses that operate in or target Montana regardless of these thresholds. The law’s exemptions still apply.

Montana’s threshold is among the lowest of any state comprehensive privacy law, which is unsurprising given the state’s relatively low population. It was originally 100,000 consumers, was lowered to 50,000 by a House amendment in 2023, and was lowered again by SB 297.

Like some other recently enacted state privacy laws, the MTCDPA has no revenue-only threshold. A company is not covered based on annual gross revenue alone (for example, USD 25 million), but a business of any size is covered if it meets either of the consumer-count thresholds above.

Without this threshold, businesses of any size/value that meet the Montana privacy law’s personal data or personal data plus revenue percentage thresholds must become MTCDPA-compliant.

Exemptions to the Montana Consumer Data Privacy Act

The exemptions in the MTCDPA are fairly consistent with other U.S. state privacy laws, deferring mainly to existing federal laws, including:

• Health Insurance Portability and Accountability Act (HIPAA)
• Health Information Technology for Economic and Clinical Health Act
• Patient Safety and Quality Improvement Act
• Fair Credit Reporting Act (FCRA)
• Children’s Online Privacy Protection Act (COPPA)
• Family Educational Rights and Privacy Act (FERPA)
• Driver’s Privacy Protection Act
• Farm Credit Act (FCA)
• Airline Deregulation Act

Other exemptions include HR data, health records, research data for human subjects that are covered by other federal laws or standards, and data that is processed or maintained for employment-related purposes.

Exempted institutions include:

• State government entities
• National securities associations
• Certain banks, credit unions, insurers, insurance producers, and third-party administrators of self-insurance, as defined in the statute
• Institutions of higher education
• Nonprofit organizations established to detect and prevent fraudulent acts in connection with insurance

Exclusions to the MTCDPA’s definition of “consumer” include individuals acting in an employment or business context. Financial institutions are no longer exempt as entities simply because they are subject to the Gramm-Leach-Bliley Act (GLBA). Only data subject to the GLBA remains exempt. Other nonprofits that meet the thresholds above are now covered.

Consumers’ Rights Under the Montana Consumer Data Privacy Act

Consumers have a number of main personal information rights under the new data protection law.

MTCDPA Consumer Rights

Right to access

Confirmation if the controller is processing the consumer’s personal information and access to that data, with some exceptions. Since October 1, 2025, controllers may not disclose certain highly sensitive data in response to an access request, such as Social Security numbers, government-issued ID numbers, financial account numbers, and biometric data. They must instead tell the consumer with sufficient particularity that they hold it.

Right to correction

Any inaccurate or outdated information the controller has that was provided by the consumer

Right to delete

Any personal data the controller has about or from the consumer (with some exceptions)

Right to portability

Obtain a copy of the consumer’s personal data that the consumer previously provided to the controller, in a readily usable format, with some exceptions

Right not to be discriminated against

Controllers cannot unlawfully discriminate against consumers, including for exercising their rights

Right to opt out

Of sale of personal data, targeted advertising, or profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning the consumer. SB 297 removed the word “solely” from this right, effective October 1, 2025.

Parents or guardians can exercise these rights on behalf of children. The MTCDPA does not include a private right of action, so consumers cannot sue a controller directly for a violation. They can file a complaint with the Attorney General’s office instead.

Meeting MTCDPA Requirements

Controllers must notify consumers of their rights and ways that consumers can exercise those rights by submitting a verifiable request to the company. The controller must include clear information on how to exercise consumer rights in their privacy notice or policy page on their website.

After a consumer request is received, the controller has 45 days to respond. There are some limited reasons that they can decline, including if the consumer’s identity cannot be reasonably verified or if the consumer submits an excessive number of requests in a 12-month period.

If there are extenuating circumstances preventing fulfilling a consumer request, once the consumer has been notified, that response period can be extended by 45 days if reasonably necessary.

If a controller denies a request, the consumer can appeal such a decision, and the controller has to provide information on how to do so. The controller has 60 days to respond to appeals.

Purpose Limitation

Controllers can process personal data for the purpose(s) that they have communicated, as long as the processing is “adequate, relevant, and reasonably necessary” and proportional to those purposes.

Data Security

Controllers must protect personal data by establishing, implementing and maintaining reasonable administrative, technical, and physical security measures. These measures should be appropriate to the nature and volume of personal information being processed.

Data Protection Assessments (DPA)

Controllers must conduct and document data protection assessments when they process information:

• For the purposes of targeted advertising
• To sell the personal data
• Categorized as sensitive personal data
• For the purposes of profiling if there is a reasonably foreseeable or heightened risk of harm to consumers

Under SB 297, the Attorney General can request relevant data protection assessments as part of a civil investigative demand. Controllers that offer an online service, product, or feature to consumers they know or willfully disregard are minors must also conduct a data protection assessment if there is a heightened risk of harm to minors.

Consent Requirements

Like other U.S. states that have passed privacy laws, Montana uses an opt-out model, so visitor consent is not required before collecting and processing personal data in many cases. The exception is that consent must be obtained before collecting or processing sensitive personal data. Consumers must be given clear notice about processing and be able to opt out of sale, targeted advertising, or profiling.

Where children are concerned, the MTCDPA follows the federal Children’s Online Privacy Protection Act (COPPA). Data collected from a known child under 13 is sensitive data by default, so a parent’s or guardian’s consent is required before processing it. Controllers and processors that follow COPPA’s verifiable parental consent requirements are considered to meet this obligation.

Montana’s law adds protection for teens. If a controller knows or willfully disregards that a consumer is at least 13 but younger than 16, it must obtain that consumer’s consent before processing their personal data for sale or targeted advertising. Further duties for all consumers under 18 are described below.

Protections for Minors

Since October 1, 2025, a controller that offers an online service, product, or feature to a consumer it actually knows or willfully disregards is under 18 must use reasonable care to avoid a heightened risk of harm to that minor. These provisions apply to any business that conducts business in Montana or targets Montana residents, regardless of the thresholds described above, although the law’s exemptions still apply.

A controller is entitled to a rebuttable presumption that it used reasonable care if it meets certain design and processing requirements. Among other things, the controller must obtain the minor’s consent before:

• Processing the minor’s data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects
• Using a system design feature to significantly increase, sustain, or extend the minor’s use of the service
• Collecting the minor’s precise geolocation data, unless doing so is reasonably necessary to provide the service

The presumption also depends on design safeguards, such as limiting unsolicited contact from unknown adults and signaling when precise geolocation data is being collected. The law does not require age verification or age-gating, and a controller that uses commercially reasonable age estimation is not liable for an erroneous estimate.

Nondiscrimination

Controllers are prohibited from unlawful discrimination against consumers, and from processing personal data if doing so is in violation of state or federal laws governing discrimination. Controllers cannot discriminate against consumers for exercising their rights. For example, a consumer cannot be blocked from accessing a website if they opt out of allowing personal information collection.

However, there are often website features or functions that will not work without certain cookies being active, so if a consumer does not opt in to their use because they collect personal information, the site may not work optimally. This is not discriminatory.

Controllers can offer voluntary incentives like discounts for consumers’ voluntary participation in operations like an organization’s loyalty program or signing up for a newsletter, where these operations collect and process personal data. Such offers should be reasonable, because regulators may scrutinize disproportionate incentives.

Transparency

Controllers must provide consumers with clear and accessible information about data processing. Commonly this appears on the company’s website in a privacy notice or policy. Under the MTCDPA, this information must include:

• Categories of personal data processed by the controller
• Purpose(s) for processing personal data
• How consumers may contact the controller, exercise their rights and/or appeal a controller’s decision (e.g. if a request for access is denied)
• Categories of personal data that the controller sells to third parties, if any
• Categories of third parties to whom the controller sells personal data, if any
• Notice about the right to opt out of the sale of personal data to third parties or processing personal data for targeted advertising or profiling and how to exercise that right
• An explanation of consumers’ rights under the MTCDPA (added by SB 297)
• The date the privacy notice was last updated (added by SB 297)

SB 297 also added the following requirements, effective October 1, 2025:

• The privacy notice must be reachable through a conspicuous hyperlink using the word “privacy” on the controller’s website homepage. For mobile apps, the link must appear on the app’s store or download page and in the app’s settings menu or a similarly conspicuous location.
• The notice must be available in each language in which the controller provides products or services, and must be reasonably accessible to and usable by people with disabilities.
• Controllers that sell personal data or process it for targeted advertising must disclose this clearly and conspicuously in the privacy notice, and must offer a clear and conspicuous opt-out method outside the notice, such as a “Your Privacy Rights” link.
• When a controller makes a material change to the notice or its practices, it must take reasonable electronic measures to notify consumers and give them a reasonable opportunity to withdraw consent.

A separate Montana-specific notice is not required if the general privacy notice includes everything the MTCDPA requires.

Third-Party Contracts

Controllers must have contracts in place with third-party processors (service providers) with clear information about:

• Duty of confidentiality
• Instructions for processing data
• Nature and purpose of processing
• Type of data subject to processing
• Duration of processing
• Rights and obligations of both parties

Universal Opt-Out Signals

The MTCDPA requires businesses to recognize opt-out preference signals, such as the Global Privacy Control (GPC). Since January 1, 2025, consumers must be able to opt out of targeted advertising and the sale of their personal data through an opt-out preference signal sent with their consent.

Several other state privacy laws also require recognition of opt-out preference signals. The signal lets consumers set their privacy preferences once, in a browser or extension, and communicate them to every website they visit. Honoring it helps support compliance with privacy laws that require signal recognition.

What Happens If a Business Violates the Montana Consumer Data Privacy Act?

The Montana Attorney General is the only enforcer, and since October 1, 2025, the office can act without first offering an opportunity to cure. Civil penalties reach USD 7,500 per violation.

Enforcement

In Montana, the Attorney General has exclusive enforcement authority for the MTCDPA. The law does not provide consumers with a private right of action, but they can report alleged violations, or complaints about denied requests, to the Attorney General’s office. SB 297 expanded the office’s investigative powers: it may use the powers available under the Montana Consumer Protection Act, issue civil investigative demands, and request relevant data protection assessments. The statute of limitations is five years after a cause of action accrues.

The Cure Period Has Been Eliminated

The MTCDPA originally included a 60-day cure period that let organizations fix alleged violations before enforcement, with the right to cure scheduled to sunset on April 1, 2026. SB 297 eliminated it effective October 1, 2025, roughly six months early. The Attorney General can now bring an enforcement action without first offering an opportunity to cure.

Fines and Penalties

SB 297 added civil penalties of up to USD 7,500 per violation. The Attorney General can also seek an injunction and recover reasonable attorney fees and the costs of investigation and enforcement.

Montana’s TikTok Ban: What Happened

In May 2023, Governor Gianforte signed SB 419, which would have banned TikTok in Montana. A federal court blocked the law before it took effect, and it was never enforced. After TikTok’s U.S. operations moved into a new joint venture in January 2026, Montana and TikTok agreed in February 2026 that SB 419 was void and jointly dismissed the lawsuit.

The ban was separate from the MTCDPA, which governs how businesses handle Montana residents’ personal data.

The Montana Consumer Data Privacy Act and Consent Management

The MTCDPA follows the opt-out model for most processing, as do other U.S. state privacy laws, with opt-in consent required for sensitive data. Under this model, controllers do not have to obtain consent before collecting or processing most personal data.

Consumers must be able to opt out of the sale of their personal data, targeted advertising, or profiling at any point. Since SB 297, the opt-out method must sit outside the privacy notice itself, for example in a “Your Privacy Rights” link, and the notice must describe the right and how to exercise it.

The mechanism that lets visitors opt out of data processing can appear in a banner, most commonly as a link or button. Usercentrics Consent Management Platform (CMP) also helps to automate detection of the cookies and other tracking technologies in use on websites and apps.

Use of a CMP streamlines collecting and providing the information to visitors about categories of data and specific services in use by the controller and/or processor(s), and third parties with whom data is shared. Montana’s privacy law, and most data privacy regulations around the world, require this notification.

Because the United States does not have a single federal data privacy law, companies doing business across the country and/or with other countries may need to comply with multiple consumer privacy laws to protect data.

A CMP can make this easier by enabling banner customization and geotargeting. Data processing, consent information and choices for specific regulations can be presented based on specific visitor location. Geotargeting can also improve clarity and user experience by presenting this information in the visitor’s preferred language.

This can help companies meet MTCDPA requirements, as well as those of other current and upcoming U.S. regulations. For companies doing business internationally, a consent management platform can also help support compliance with regulations such as the GDPR, which has stricter consent requirements than U.S. state laws.

Preparing for the Montana Consumer Data Privacy Act

Organizations doing business in Montana have been subject to the MTCDPA since October 1, 2024, and to the SB 297 amendments since October 1, 2025. Businesses that already meet the requirements of other state privacy laws, such as Connecticut’s, will find that much of the work is done.

They should still review the Montana-specific updates above, especially the thresholds, the provisions on minors, and the opt-out link requirements. As always, a privacy by design approach will benefit all operations in an organization, whether specifically for regulatory compliance or not.

Meeting the MTCDPA’s requirements mainly involves confirming whether the law applies, updating privacy notices and opt-out mechanisms, and having a solution in place to give visitors the necessary notices and opt-out options. Usercentrics Web CMP can help manage cookie and tracking notices on websites.

Further updates to the MTCDPA are possible, as SB 297 showed. U.S. state privacy laws continue to evolve alongside technology and consumer expectations. The MTCDPA does not include a private right of action, so consumers cannot bring claims under it directly.

Consulting qualified legal counsel or your organization’s data privacy expert, such as a Data Protection Officer, is recommended to help ensure that responsibilities are met.

Beyond meeting requirements, being proactive about protecting customer privacy is a sound business practice. It can build trust and engagement, improve experiences, and strengthen customer relationships over time, which can support more reliable audience and measurement data for marketing teams.

Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.