Manage privacy requirements of the Montana Consumer Data Privacy Act (MTCDPA)
Montana’s privacy law requires covered businesses to give people clear notice, real choice, and reliable ways to opt out without compromising website performance.
With the Usercentrics Consent Management Platform (CMP), you can display a fully customizable cookie banner, support opt-outs for targeted advertising and data sales, and collect opt-in consent for sensitive data — while keeping analytics and advertising working based on real user preferences.
What is the MTCDPA?
The Montana Consumer Data Privacy Act (MTCDPA) is a comprehensive privacy law that took effect on October 24, 2024. It gives Montana residents more control over how their personal data is collected and used, and it sets clear obligations for covered businesses.
Like most U.S. state privacy laws, the MTCDPA uses an opt-out approach for targeted advertising and data sales, but requires opt-in consent for sensitive data. It also adds stronger protections for children and teens.
MTCDPA at a glance
- The Montana Consumer Data Privacy Act (MTCDPA) took effect October 24, 2024
- Applies to: Businesses doing business in Montana or targeting Montana residents, and meet data-processing (at least 25,000 residents) or revenue (25% of gross revenue and process data of at least 15,000 residents) thresholds
- Montana residents have rights of access, correction, deletion, portability, non-discrimination, and opt-out for certain data uses
- Must support an opt-out preference signal for data sale or targeted ads
- Enforcement: Montana Attorney General
- Cure period: 60 days, sunsets April 1, 2026
REQUIREMENTS
What does the MTCDPA require from businesses?
To meet MTCDPA requirements, businesses required to comply must provide a clear, up-to-date privacy notice explaining how personal data is collected, used, shared, or sold. They must offer an easy-to-use opt-out mechanism, such as a cookie banner, for the sale of personal data, targeted advertising, and certain profiling.
Businesses must also obtain affirmative opt-in consent before processing sensitive personal data and meet additional protection requirements for minors. They are expected to respond to consumer rights requests, maintain reasonable security safeguards, and document data protection assessments for higher-risk processing.
RISKS
What are the risks of ignoring the MTCDPA?
Failing to meet Montana Consumer Data Privacy Act (MTCDPA) requirements can lead to enforcement action by the Montana Attorney General. The 60-day cure period sunsets on
April 1, 2026, so businesses no longer have extra time to address issues after notification.
Beyond legal exposure, gaps in consent handling, opt-out mechanisms, or required notices can disrupt analytics and advertising workflows, create additional manual work for teams, and weaken customer trust. As more U.S. state privacy laws and updates take effect, inconsistent privacy controls can also lead to costly rework — and increase reputational risk.
Your questions answered
Talk to our privacy experts
Usercentrics helps businesses operating in Montana provide visitors with clear notice and meaningful choice — without disrupting website or app performance, analytics, or advertising. Whether you’re preparing for MTCDPA requirements or managing multiple U.S. and global privacy laws, our team can help you protect your business and implement the right setup for your website.
- Maintain reliable tracking and marketing performance as privacy rules evolve
- Automate setup and updates to reduce ongoing maintenance
- Address legal and operational risk with a single, scalable platform
Learn more
Frequently asked questions
The MTCDPA applies to organizations that conduct business in Montana or target Montana residents with goods or services, and that meet one of the following thresholds:
- Control or process personal data of at least 25,000 Montana residents in a calendar year, or
- Derive at least 25 percent of gross revenue from the sale of personal data and control or process the personal data of at least 15,000 Montana residents.
Montana residents’ rights under the MTCDPA:
- Right to access: Consumers can request confirmation of whether a controller processes their personal data and obtain access to that information, subject to certain exceptions.
- Right to correction: Consumers can request that a controller correct inaccurate personal data or update outdated information they previously provided.
- Right to delete: Consumers can request deletion of personal data a controller holds about them or collected from them, with some exceptions.
- Right to data portability: Consumers can obtain a copy of personal data they previously provided to the controller in a readily usable format, subject to certain exceptions.
- Right to non-discrimination: Controllers may not unlawfully discriminate against consumers, including when they exercise their privacy rights.
- Right to opt out: Consumers can opt out of the sale of personal data, targeted advertising, or profiling used to make solely automated decisions that produce legal or similarly significant effects concerning them.
The MTCDPA generally follows an opt-out model, but requires opt-in consent before processing sensitive personal data (including data belonging to children). It also requires that consent be freely given, specific, informed, and unambiguous, and includes rules designed to prevent consent being obtained through dark patterns.
Controllers must respond to verified consumer requests within 45 days, with a possible 45-day extension when reasonably necessary. If a request is denied, consumers must be able to appeal and the controller must respond to appeals within 60 days.
Businesses must allow consumers to opt out of targeted advertising and the sale of personal data through an opt-out preference signal — such as the Global Privacy Control (GPC) — sent with the consumer’s consent. This requirement has been in effect since January 1, 2025. Learn more about Global Privacy Control and Universal Opt-Out Mechanisms.