Montana Privacy Law

Montana is the only state in this group whose constitution says something about privacy. Article II, section 10, adopted at the 1972 convention, provides that the right of individual privacy “is essential to the well-being of a free society and shall not be infringed without the showing of a compelling state interest” — a standard that predates every modern data-privacy statute. The statutory layer is unusually aggressive too. Senate Bill 297 of the 2025 session dropped the MCDPA’s thresholds to 25,000 consumers, removed the cure period, and left three sections — the duty of care and the two minors provisions — applying to any business targeting Montanans with no threshold at all. Chapter 30-23 reaches genetic data and, unusually, neurotechnology data measured from the nervous system, and from January 1, 2026 Montanans hold a descendible property right in their name, voice and visual likeness against unauthorised digital depictions.

The Montana Consumer Data Privacy Act (MCDPA)

Enacted as Senate Bill 384 in 2023 (Ch. 681) and substantially rewritten by Senate Bill 297 in 2025 (Ch. 567, effective October 1, 2025), part 28 of chapter 14 sits inside the Unfair Trade Practices and Consumer Protection chapter rather than in a chapter of its own, which is why § 30-14-2820(1) can provide that a violation of the part “is a violation of Title 30, chapter 14, parts 1 and 2”. Section 30-14-2803(1) carries thresholds among the lowest in the country and excludes payment-transaction-only data from the count. Section 30-14-2803(2) then does something no other statute in this group does: it applies §§ 30-14-2811, 30-14-2818 and 30-14-2819 — the duty of care, the minors provisions and the heightened-risk assessments for minors — to any person conducting business in the state or delivering commercial products or services intentionally targeted to residents, with no threshold whatever. Section 30-14-2804(1) exempts state and local bodies, insurance-fraud nonprofits, institutions of higher education, registered securities associations, chartered banks and credit unions, Gramm-Leach-Bliley data, HIPAA covered entities and business associates, and insurers and producers — but not nonprofits generally.

Who Must Comply

The MCDPA reaches a business that conducts business in Montana or produces products or services targeted to Montana residents, and controls or processes the personal data of not less than 25,000 consumers, excluding data processed solely to complete a payment transaction, or controls or processes the personal data of not less than 15,000 consumers while deriving more than 25% of gross revenue from the sale of personal data.

The duty of care and both minors provisions apply with no threshold at all, the Attorney General is required by statute to publish compliance information and a complaint mechanism, and the 2025 amendments left the penalty section pointing at a cure period that no longer exists.

Consumer Rights Under the MCDPA

Residents of Montana can confirm whether a business is processing their data and obtain a copy of it, require correction of inaccurate personal data, require deletion of personal data the business holds about them, obtain their data in a portable, readily usable format, opt out of targeted advertising, opt out of the sale of their personal data and opt out of profiling used for decisions producing legal or similarly significant effects.

Sensitive data is treated separately. Health, biometric, precise geolocation and demographic data may not be processed without opt-in consent, which means the default is no processing until the consumer agrees.

Sector-Specific Privacy Laws in Montana

Genetic Information Privacy Act (Mont. Code Ann. ch. 30-23)

Enacted by Ch. 768, L. 2023, chapter 23 of title 30 governs direct-to-consumer genetic testing and, in a departure from every comparable state act, extends to the nervous system. Section 30-23-102(10)(a) defines “neurotechnology data” as information captured by neurotechnologies, generated by measuring the activity of an individual’s central or peripheral nervous systems, or associated with neural activity — the activity of neurons or glial cells — and that is not nonneural information. Section 30-23-104 carries the operative regime for consumer genetic or neurotechnology data: a privacy notice, consent, access, deletion and destruction. Section 30-23-105 governs disclosure, prohibiting it outright in some circumstances and requiring express consent in others. Section 30-23-106 gives the Attorney General sole enforcement authority and, in a civil enforcement action, allows recovery of the consumer’s actual damages, costs, reasonable attorney fees and $2,500 for each violation of § 30-23-104. Section 30-23-103 sets out the exceptions.

Property right in names, voices and visual likenesses (Mont. Code Ann. § 30-14-1714)

Effective January 1, 2026, § 30-14-1714 gives an individual who is a Montana resident, or who was domiciled in Montana at death, property rights in their name, voice and visual likeness. Subsection (2) makes those rights freely transferable, licensable and descendible in whole or in part, provides that they do not expire on death, and vests them in the rights holder’s executors, heirs, transferees or devisees for twenty years after death, whether or not the individual commercially benefited during their lifetime. Subsection (3) attaches liability in two directions. Under (3)(a) a person is liable for distributing, transmitting or otherwise making available to the public an algorithm, software, tool, technology, service or device with actual and specific knowledge that its primary purpose is to produce unauthorized digital voice or visual depictions of a particular identified individual for commercial use. Under (3)(b) a person is liable for intentionally publishing, performing, distributing, transmitting or making available such a depiction for commercial use with actual and specific knowledge that it depicts the individual and is unauthorized.

Unfair Trade Practices and Consumer Protection Act (Mont. Code Ann. §§ 30-14-103, 30-14-142)

Section 30-14-103 declares unlawful unfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce, and it is the provision every Montana privacy statute routes into: § 30-14-1705(3) for breach notification and § 30-14-2820(1) for the MCDPA. The remedies in § 30-14-142 are unusual for a state consumer-protection act in reaching criminal liability. Subsection (1) requires a person who violates an injunction or temporary restraining order issued under § 30-14-111 to forfeit and pay a civil fine of up to $10,000 for each violation, with the issuing district court retaining jurisdiction. Subsection (2) allows the department, on petition, to recover a civil fine of up to $10,000 for each willful violation of § 30-14-103, defined in subsection (4) as one the violator knew or should have known was a violation. Subsection (3) provides that a person who engages in a fraudulent course of conduct declared unlawful by § 30-14-103 shall on conviction be fined not more than $5,000, imprisoned for not more than a year, or both.

Data Breach Notification in Montana

Section 30-14-1704 sits in the identity-theft part of the same consumer-protection chapter. Its trigger is a materiality-and-harm test: under subsection (4)(a) an unauthorized acquisition is a breach only where it “materially compromises” the security, confidentiality or integrity of personal information and “causes or is reasonably believed to cause loss or injury” to a Montana resident. The data elements at subsection (4)(b)(i) are broader than the regional norm and include one element that is distinctly Montana’s: alongside a Social Security number, a driver’s license or state identification card number, and an account or card number with its access code, the list reaches a tribal identification card number, medical record information as defined in § 33-19-104, a taxpayer identification number, and an identity protection personal identification number issued by the Internal Revenue Service. Subsection (8) requires any person issuing a notification to submit simultaneously an electronic copy of it, together with a statement of the date and method of distribution, to the Attorney General’s consumer protection office, with personally identifying details removed and a single copy indicating the number of Montanans notified where more than one person received notice — a filing duty that attaches to every notification rather than to a headcount. Substitute notice is available under subsection (5) above $250,000 in cost or 500,000 affected persons. Section 30-14-1705(3) makes a violation of the part a violation of § 30-14-103, carrying the penalties in § 30-14-142: a civil fine of up to $10,000 for each willful violation, up to $10,000 for violating an injunction, and, for a fraudulent course of conduct, a criminal fine of up to $5,000 or imprisonment for up to a year.

Residents must be notified without unreasonable delay, consistent with law enforcement needs and the measures needed to determine scope and restore integrity. An electronic copy of every consumer notification goes to the Attorney General’s consumer protection office — no headcount threshold. Complaints are taken by the Montana Attorney General, Office of Consumer Protection, which enforces the statute.

How the MCDPA Is Enforced

A statutory duty to publish, and civil investigative demands. Section 30-14-2817 is unusual in placing obligations on the enforcer rather than only on the regulated. Subsection (1) gives the Attorney General exclusive authority, exercisable through the duties and powers in parts 1 and 2 of the chapter. Subsection (2) then requires the Attorney General to post on the office’s website information relating to the responsibilities of controllers, the responsibilities of processors and consumers’ rights under the part, together with an online mechanism through which a consumer may submit a consumer data privacy complaint. Subsection (3), as rewritten by Ch. 567, L. 2025, supplies civil investigative demand power under § 30-14-113 and allows the Attorney General to request and evaluate any data protection assessment relevant to an investigation. Subsection (4) applies the limitation period in § 27-2-231; subsection (5) forecloses a private right of action.

A cross-reference the 2025 amendments left behind. Senate Bill 297 removed the cure period from § 30-14-2817 — subsection (3) of that section, as codified in the 2025 Montana Code Annotated, contains the civil investigative demand power and no notice-and-cure provision. The penalty section enacted by the same bill was not conformed. Section 30-14-2820(2) still reads that a person who violates the part “following the 30-day period described in 30-14-2817(3)” is liable for a civil penalty not exceeding $7,500 for each violation. The subsection it points to no longer describes a 30-day period. Section 30-14-2820(3) allows the Attorney General to sue in the name of the state to recover the penalty, to restrain or enjoin the violation, or both; subsection (4) allows reasonable attorney fees and expenses; and subsection (5) directs collected penalties into a special revenue account to the credit of the department under § 30-14-143.

Pending Privacy Legislation

The 2025 session was the substantive one. Senate Bill 297, Ch. 567, L. 2025, effective October 1, 2025, amended § 30-14-2803 to lower the thresholds to 25,000 and 15,000 consumers and to carve the duty of care and both minors sections out of the threshold test entirely; amended § 30-14-2817 to remove the cure period and add civil investigative demand power over data protection assessments; and enacted §§ 30-14-2818, 30-14-2819 and 30-14-2820, the last of which supplies the $7,500 penalty and the special revenue account. Separately, § 30-14-1714 took effect January 1, 2026, creating the descendible property right in name, voice and visual likeness. The Genetic Information Privacy Act at chapter 30-23 remains as enacted by Ch. 768, L. 2023, including its neurotechnology-data coverage. The breach statute at § 30-14-1704 has not been amended since Ch. 62, L. 2015.

Federal Privacy Laws That Apply in Montana

Federal privacy law applies in Montana by sector, whatever the state has enacted: HIPAA to health information, the Gramm-Leach-Bliley Act to financial institutions, FERPA to student education records, the Fair Credit Reporting Act to consumer reports, COPPA to children under 13, and Section 5 of the FTC Act to privacy claims that do not match practice.

The MCDPA sits alongside those rules rather than displacing them: the Montana Attorney General enforces the state law, while the federal regulators continue to reach the sectors and activities they cover. The state-law counterpart to section 5 is the Unfair Trade Practices and Consumer Protection Act (Mont. Code Ann. §§ 30-14-103, 30-14-142), which the Montana Attorney General, Office of Consumer Protection enforces against businesses whose stated data practices differ from their actual ones.

Montana Privacy Law FAQ