Montana Consumer Data Privacy Act (MCDPA)

The Montana Consumer Data Privacy Act (MCDPA) grants Montana residents rights to access, correct, delete, and opt out of the sale of personal data. It also sets data protection requirements for businesses handling consumer data.

JurisdictionMontana
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The Montana Consumer Data Privacy Act (MCDPA) establishes several key requirements for businesses handling personal data of Montana residents:

  • Consumer Rights: The MCDPA grants Montana consumers the following rights:
  • Right to confirm and access personal data
  • Right to correct inaccuracies
  • Right to delete personal data
  • Right to data portability
  • Right to opt out of targeted advertising, sale of personal data, and certain profiling activities Source: Montana Legislature

Compliance Challenges

Organizations face several challenges in complying with the MCDPA:

  • Implementing Consumer Rights: Establishing processes to handle consumer requests for access, deletion, and correction within the required timeframes. Source: National Law Review
  • Consent Management: Ensuring proper consent mechanisms are in place, especially for sensitive data and children's data. Source: OneTrust DataGuidance
  • Third-Party Risk Management: Ensuring service providers and third parties comply with MCDPA requirements. Source: Compliance Week

Implementation Best Practices

To effectively implement MCDPA requirements, organizations should:

  • Conduct a comprehensive data inventory and mapping exercise
  • Implement a robust consent management platform
  • Establish clear processes for handling consumer rights requests
  • Update privacy policies and notices to reflect MCDPA requirements
  • Implement data minimization and purpose limitation practices
  • Conduct regular privacy impact assessments

Source: IAPP Implementation Guide

Useful tools and resources:

Recent Updates

As of February 2025, there have been no significant amendments to the MCDPA since its enactment. However, organizations should monitor the following for potential updates:

The MCDPA is set to take effect on October 1, 2024.

Related Regulations

The MCDPA is part of a growing trend of state-level privacy laws in the United States. Related regulations include:

These laws share common themes but have specific differences in scope, exemptions, and enforcement mechanisms.

Industry Impact

The MCDPA will have significant impacts across various industries:

  • Technology and Software: Required to implement robust data management systems and update privacy features in products. Source: TechCrunch

Sources

Recent developments

  • — Analysis explains how Montana’s newly signed SB 297 “revamps” the Montana Consumer Data Privacy Act by lowering applicability thresholds, expanding notice requirements, eliminating the right to cure early, and adding extensive new protections and obligations for minors’ data, effective October 1, 2025.[1] (source)
  • — Law firm update details May 8, 2025 amendments to the Montana Consumer Data Privacy Act that broaden its applicability by decreasing thresholds, narrowing exemptions, clarifying opt-out mechanisms, and imposing strong new duties and processing limits for data about consumers under 18, with the cure period ending October 1, 2025.[2] (source)
  • — Future of Privacy Forum commentary outlines “big changes” under SB 297, including a new duty of reasonable care and data protection assessments for online services likely used by minors, lowered coverage thresholds, narrowed GLBA-related exemptions, expanded privacy notice content, and modified enforcement with no right to cure after October 1, 2025.[8] (source)
  • — Hunton Andrews Kurth alert reports that on May 8, 2025 Governor Gianforte signed SB 297, amending the MTCDPA to expand online protections for minors, narrow certain financial‑sector exemptions, lower thresholds for coverage, and remove the 60‑day cure period as of October 1, 2025, signaling more immediate enforcement risk for businesses.[6] (source)
  • — Covington’s Inside Privacy blog describes SB 297’s unanimous legislative passage and highlights its broad application of minors’ provisions to any business operating in Montana, new “reasonable care” and heightened‑risk obligations for minors’ data, narrowed GLBA exemptions, data protection assessments, and new civil penalties up to $7,500 per violation.[9] (source)
  • — Policy analysis on the day of signing underscores that the amendments take effect October 1, 2025 by default and will require companies to reassess coverage (25,000/15,000‑consumer thresholds), redesign access responses to withhold certain highly sensitive identifiers, and update privacy notices to include rights explanations and last‑updated dates.[8] (source)
  • — Benesch notes that for minors under 18 there are no processing‑volume thresholds, meaning any business serving Montana minors must comply with the minors’ provisions, implement reasonable care to avoid heightened risk of harm, obtain parental consent for children’s sensitive data, and clearly separate online opt‑out tools from standard privacy notices.[2] (source)
  • — Industry‑facing newsletter emphasizes operational impact: companies must prepare by 2025 for new minors‑specific consent and retention limits, conduct data protection assessments for services posing heightened risk to minors, and adjust compliance programs to the earlier‑than‑planned removal of the right to cure, increasing litigation and enforcement exposure.[1] (source)
  • — Montana Governor Gianforte signed SB 297 amending the MCDPA, adding a duty of reasonable care for minors’ data, new processing restrictions, lowered applicability thresholds, narrowed exemptions, expanded privacy notice requirements, and modified enforcement provisions effective October 1, 2025.[7] (source)
  • — New amendments to the MCDPA broaden applicability by decreasing coverage thresholds, narrowing exemptions (including removal of the GLBA entity exemption), eliminating the 60‑day cure period as of October 1, 2025, and imposing enhanced obligations and reasonable care standards for handling data of consumers under 18.[2] (source)
  • — SB 297, signed on May 8, 2025, revises the MCDPA to introduce stronger protections for minors, adjust thresholds for covered businesses, and update enforcement and notice requirements, prompting companies subject to multiple state privacy laws to reassess their compliance strategies.[6] (source)
  • — Legal analysis of SB 297 highlights reduced processing thresholds (25,000 or 15,000 consumers depending on data‑sales revenue), removal of the GLBA entity exemption, expanded notice and assessment obligations, new consent and retention limits for minors’ data, and early elimination of the right to cure before April 2026.[1] (source)

Read the full guide to Montana Consumer Data Privacy Act (MCDPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates