Privacy Laws in Montana: What You Need to Know

Montana became one of the first states in the nation to pass a comprehensive consumer data privacy law when Governor Greg Gianforte signed the Montana Consumer Data Privacy Act (MCDPA) on May 19, 2023. The law, originally Senate Bill 384, took effect on October 1, 2024, and has since been strengthened through significant amendments. If you live in Montana or do business with Montana residents, here is everything you need to know about your rights and obligations under this law.

The Montana Consumer Data Privacy Act (MCDPA)

The MCDPA gives Montana residents meaningful control over their personal data. It applies to businesses that conduct business in Montana or produce products or services targeted to Montana residents, and that either control or process the personal data of at least 25,000 consumers, or control or process the personal data of at least 10,000 consumers and derive more than 25% of gross revenue from the sale of personal data.

Montana's threshold of 25,000 consumers is notably lower than most other state privacy laws, which reflects the state's smaller population and ensures that the law provides practical coverage for its roughly one million residents.

Your Rights Under the MCDPA

As a Montana resident, you have the following rights regarding your personal data:

• Right to access: You can request confirmation of whether a business is processing your personal data and obtain a copy of that data
• Right to correct: You can request correction of inaccurate personal data
• Right to delete: You can request deletion of your personal data held by a business
• Right to data portability: You can obtain a copy of your data in a portable, readily usable format
• Right to opt out of data sales: You can direct a business to stop selling your personal data
• Right to opt out of targeted advertising: You can opt out of the processing of your personal data for purposes of targeted advertising
• Right to opt out of profiling: You can opt out of profiling that produces legal or similarly significant effects

2025 Amendments: Stronger Protections

In 2025, Montana passed Senate Bill 297, which introduced significant amendments to the MCDPA effective October 1, 2025. These changes strengthened the law in several important ways:

Elimination of the Cure Period

The original MCDPA included a 60-day cure period that gave businesses a chance to fix violations before facing enforcement action. This cure period was originally set to sunset on January 1, 2026, but the 2025 amendments eliminated it early. As of October 1, 2025, the Montana Attorney General can take enforcement action against violations without first providing businesses an opportunity to cure. The April 1, 2026 deadline marks the point at which the grace period has fully ended and the law is in full enforcement mode.

Enhanced Exemptions

The amendments refined the law's exemption structure:

• GLBA entity exemption eliminated: The original law exempted entire financial institutions covered by the Gramm-Leach-Bliley Act. The amendments removed this broad entity-level exemption while keeping the data-level exemption, meaning financial institutions are now covered by the MCDPA but data already regulated under GLBA remains exempt.
• New sector-specific exemptions: The amendments added specific exemptions for banks, credit unions, and insurers to the extent that their activities are already regulated by existing financial privacy laws

Protections for Minors

The 2025 amendments added important protections for individuals under 18 years of age. Businesses must obtain opt-in consent before processing the personal data of known minors for targeted advertising or data sales. This aligns Montana with the growing national trend of enhanced protections for young people's data.

Enforcement

The MCDPA is enforced exclusively by the Montana Attorney General. There is no private right of action, meaning individual consumers cannot sue companies for violations. Instead, if you believe a company is violating your rights under the MCDPA, you should file a complaint with the Montana Attorney General's Consumer Protection Office.

The Attorney General can investigate complaints, issue civil investigative demands, and pursue enforcement actions. Penalties can reach $7,500 per violation, which can add up quickly when a business is systematically violating the rights of thousands of consumers.

How the MCDPA Compares to Other State Laws

Montana's privacy law is generally aligned with the Virginia Consumer Data Protection Act (VCDPA) model that several states have followed, but it has some notable distinctions:

• Lower thresholds than most states: Montana's 25,000-consumer threshold ensures broader coverage despite the state's smaller population
• Stronger than Virginia's original law: With the cure period eliminated early, Montana now has stronger enforcement teeth than Virginia's original VCDPA
• Similar to Colorado: Montana's consumer rights closely mirror those in the Colorado Privacy Act, including the right to opt out of targeted advertising and profiling
• Less comprehensive than California: California's CCPA/CPRA remains the gold standard with broader scope, a private right of action for data breaches, and a dedicated enforcement agency (the California Privacy Protection Agency)

What This Means for Montana Residents

The MCDPA gives you real, enforceable rights over your personal data. Here is how to put them into practice:

1. Exercise your deletion rights: Identify companies that hold your personal data and submit deletion requests. Many companies now have online forms or privacy portals that make this straightforward.
2. Opt out of data sales: Look for "Do Not Sell My Personal Information" links on websites you use. Under the MCDPA, businesses that sell your data must honor your opt-out request.
3. Opt out of targeted advertising: Use the advertising preference controls provided by businesses and platforms. You can also use browser-based Global Privacy Control (GPC) signals, which many privacy-focused browsers send automatically.
4. File complaints: If a business ignores your requests or violates your rights, file a complaint with the Montana Attorney General at dojmt.gov.

Data Brokers and the MCDPA

While the MCDPA gives you the right to opt out of data sales and request deletion, the practical challenge remains significant. Dozens of data brokers collect and trade personal information about Montana residents, and exercising your rights with each one individually is a time-consuming process. Each broker has its own opt-out procedure, and your data often reappears after removal because brokers continuously acquire new records from public sources.

PrivacyOn simplifies this process by automatically submitting opt-out and deletion requests to over 100 data broker sites on your behalf. With the MCDPA now providing legal backing for your requests, services like PrivacyOn are even more effective — businesses are legally required to honor the removal requests that PrivacyOn submits. Continuous monitoring ensures that when your data inevitably reappears, it gets removed again. Plans start at $8.33/month.

Montana's privacy law represents a meaningful step forward for consumer data rights in the state. By understanding your rights and actively exercising them, you can take control of how your personal information is collected, used, and shared.