Privacy Map

Montana. Comprehensive data protection. Act

MCDPAMontana Consumer Data Privacy Act (Mont. Code § 30-14-2801 et seq.)

In force

§1Summary

Synopsis

Virginia-style rights including universal opt-out signals. 2025 amendments added a duty of reasonable care to avoid heightened risk of harm to known minors and removed the cure period.

Key themes
  • consumer rights (access, deletion, correction, portability)
  • opt-out of sale, targeted advertising and profiling
  • sensitive data consent
  • data protection assessments
  • processor contracts
  • universal opt-out
  • minors duty of care
Unique features

Low thresholds for a small state (25,000 residents, or 15,000 with 25%+ revenue from sales); minors' provisions apply regardless of thresholds.

SaaS relevance

SaaS with modest Montana user bases may be caught; any service with known minor users has duties regardless of size.

§2Obligations

Extraterritorial
Yes
Breach notification
See Mont. Code § 30-14-1704 (separate statute)
DPO
No
Cross-border transfers
None
Maximum penalty
Not specified in statute (AG enforcement under consumer protection law)

§3Dates

Key dates
  • Adopted
  • In force
  • SB 297 (2025) amendments effective 2025-10-01: lower thresholds, cure period removed, minors' duty of care.

§4Text and authority

Text
Authority
Montana Attorney General (Department of Justice)

§5Where it applies

Domestic law of
Montana

§6Sources and verification

Verification

High confidence.