Montana (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Montana Consumer Data Privacy Act (MCDPA) | Mont. Code Ann. §§ 30-14-2801 to 30-14-2820 | In force | 1 October 2024 |
| Computer security breach | Mont. Code Ann. § 30-14-1704 | In force | 1 March 2006 |
- Montana Consumer Data Privacy Act (MCDPA): In force from 1 October 2024 under § 14 of the enrolled SB 384 (2023 Mont. Laws ch. 681). SB 297 (2025 Mont. Laws ch. 567) lowered the thresholds, added protections for minors and removed the cure period. It sets no start date of its own, so under MCA 1-2-201 it took effect on 1 October 2025.
- Computer security breach: In force from 1 March 2006 under § 12(1) of the enrolled HB 732 (2005 Mont. Laws ch. 518), whose § 7 enacted this section.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”The Act has applied since 1 October 2024. Since 1 October 2025, it covers businesses that operate in Montana or target its residents and process data of 25,000 or more consumers (not counting payment-only data), or of 15,000 or more while earning over 25% of revenue from selling data. The minors’ rules apply regardless of size. Most non-profits are covered. Government, universities, banks, credit unions, insurers, HIPAA covered entities and GLBA data are exempt. Employees and B2B contacts aren’t consumers.
Sources: docs.legmt.gov/download-ticket · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_003… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_004… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_002… · mca.legmt.gov/bills/mca/title_0010/chapter_0020/part_0020/section_001…
Lawful bases
Section titled “Lawful bases”There are no GDPR-style lawful bases. Controllers give a privacy notice and honour rights to access, correct, delete and port data, and to opt out of targeted advertising, sale and automated decisions with significant effects, within 45 days. Access responses must flag, not reveal, items like Social Security numbers and passwords. Sensitive data needs opt-in consent, and withdrawn consent must be acted on within 45 days.
Sources: mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_008… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_012…
Consent age for online services
Section titled “Consent age for online services”A child is under 13, and a known child’s sensitive data must be handled under COPPA, with parental consent. Controllers that know or wilfully disregard that a consumer is 13 to 15 need that consumer’s consent for targeted advertising or sale. For all minors under 18, broader consent rules apply since 1 October 2025 (see children).
Sources: mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_002… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_012…
Children
Section titled “Children”Since 1 October 2025, online services that know or wilfully disregard that a user is under 18 must take reasonable care to avoid heightened risk of harm. Without the minor’s consent (a parent’s if under 13), they can’t use the data for targeted ads, sale or significant profiling, use engagement-extending design features, or collect precise geolocation. Consent flows can’t be manipulative, adults’ unsolicited messages need safeguards, and risky services need an assessment.
Sources: mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_011… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_019…
Cookies and similar technologies
Section titled “Cookies and similar technologies”There’s no cookie-consent rule. Consumers can opt out of targeted advertising and sale through a clear link, and since 1 January 2025 controllers must honour opt-out preference signals such as Global Privacy Control. Signals can’t be on by default.
Sources: mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_009… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_012…
Electronic marketing
Section titled “Electronic marketing”Email relies on federal CAN-SPAM, and calls and texts also follow the federal TCPA. Montana adds its own rules. Unless exempt, sellers and telemarketers must register with the Department of Justice before telemarketing, post a $50,000 bond and renew every year. Sales calls to residential numbers on Montana’s no-call list, which takes in Montana numbers from national lists, are banned, with penalties or damages up to $5,000 per knowing violation. Automated calls with recorded sales messages need a live operator’s permission first, with narrow exceptions and fines up to $2,500.
Sources: mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0140/section_004… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0140/section_005… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0160/section_002… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0160/section_003… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0160/section_005… · mca.legmt.gov/bills/mca/title_0450/chapter_0080/part_0020/section_016…
Breach notification
Section titled “Breach notification”Notify affected Montana residents without unreasonable delay when unencrypted personal information was or is reasonably believed to have been acquired in a breach. A breach counts only if it materially compromises the data and causes, or is reasonably believed to cause, loss or injury to a Montana resident. At the same time, send an electronic copy of the notice, with the date and method of sending, to the Attorney General’s Office of Consumer Protection.
Sources: mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0170/section_004… · docs.legmt.gov/download-ticket
Registration and fees
Section titled “Registration and fees”The MCDPA requires no registration or fee.
Sources: mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_in…
Data protection officer
Section titled “Data protection officer”There’s no requirement to appoint a data protection officer.
Sources: mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_in…
International transfers
Section titled “International transfers”Montana law sets no restrictions on transferring personal data abroad; federal rules are in us-federal.
Sources: mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_in…
Impact assessments
Section titled “Impact assessments”Document a data protection assessment for targeted advertising, sale, sensitive data and risky profiling, and for online services with a heightened risk of harm to minors. The Attorney General can request assessments through a civil investigative demand.
Sources: mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_014… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_019… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_017…
Automated decisions and AI
Section titled “Automated decisions and AI”Consumers can opt out of profiling in furtherance of automated decisions with legal or similarly significant effects; since 1 October 2025 this isn’t limited to solely automated decisions. The MCDPA has no other AI rules.
Sources: mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_008…
Penalties
Section titled “Penalties”The Attorney General enforces alone, using its consumer protection powers, and a violation also counts as a violation of the Montana Consumer Protection Act. The MCDPA itself sets civil penalties up to $7,500 per violation, plus injunctions and fees. Since 1 October 2025 there’s no right to cure, though § 30-14-2820 still refers to a 30-day period in § 30-14-2817(3), which no longer sets one. There’s no private right of action.
Sources: mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_017… · mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_020… · docs.legmt.gov/download-ticket
Leads, not sources: fpf.org/blog/amendments-to-the-montana-consumer-data-privacy-act-brin…
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-mt.yaml.