Montana Privacy Law Overview
Montana's privacy law took effect October 1, 2024 and was substantially strengthened in 2025. Senate Bill 297 dropped the thresholds so that businesses reaching just 25,000 consumers are covered — capturing far more small and mid-sized companies — and removed the cure period that had let businesses fix violations before enforcement.
The Montana Consumer Data Privacy Act (MCDPA)
Montana's law provides comprehensive consumer rights with opt-in consent for sensitive data. A 2025 amendment (SB 297) lowered its applicability thresholds to among the lowest in the nation and eliminated the right to cure, making the MCDPA meaningfully stricter than its original 2023 form.
MCDPA: Quick Overview
- Effective Date: October 1, 2024
- Citation: Mont. Code Ann. § 30-14-2801 et seq.
- Enforced By: Montana Attorney General
- Maximum Penalty: Up to $7,500 per violation
- Private Right of Action: No (enforcement by the state only)
- Right to Cure: Eliminated October 1, 2025 (was 60 days)
Who Must Comply
The MCDPA applies to businesses that meet Montana's applicability thresholds:
- Controls or processes the personal data of 25,000+ Montana consumers, or
- Processes data of 15,000+ consumers and derives over 25% of gross revenue from selling personal data
What makes Montana different: 2025 amendments gave Montana some of the lowest coverage thresholds in the country and removed the right to cure entirely.
Consumer Rights Under the MCDPA
Montana residents can exercise the following rights over their personal data:
- Right to access / confirm what data is held
- Right to correct inaccurate data
- Right to delete personal data
- Right to data portability
- Right to opt out of targeted advertising
- Right to opt out of the sale of personal data
- Right to opt out of profiling for significant decisions
Sensitive personal data: Businesses must obtain opt-in consent before processing sensitive data (such as health, biometric, precise-geolocation, or demographic data).
Data Breach Notification in Montana
Montana requires notice to affected residents without unreasonable delay and to the Attorney General for breaches involving Montana residents.
- Deadline to notify residents: Without unreasonable delay following discovery
- Attorney General notice: Notify the Montana Attorney General for breaches affecting residents
- Covered data: Name combined with sensitive identifiers (SSN, driver's license, financial-account or medical information, and more)
Federal Privacy Laws That Apply in Montana
Even where Montana law is silent, residents and businesses are covered by federal privacy statutes:
- HIPAA — health information held by providers, plans and their vendors
- GLBA — privacy and safeguards rules for financial institutions
- FERPA — student education records
- FCRA — consumer reporting agencies and background screening
- COPPA — online collection of data from children under 13
- FTC Act §5 — unfair or deceptive privacy and data-security practices
Montana Privacy Law FAQ
Did Montana's privacy law get stricter?
Is my small business covered by Montana's privacy law?
How a Montana Privacy Attorney Can Help
For Businesses
- Build and audit a privacy compliance program
- Draft privacy policies, notices and vendor contracts
- Respond to consumer rights requests
- Manage data-breach response and notification
- Defend regulatory investigations and enforcement
For Consumers
- Enforce your privacy rights against non-compliant businesses
- Pursue or join data-breach litigation
- File complaints with the Montana Attorney General
- Seek damages for identity theft and fraud
- Stop unlawful data sales and unwanted marketing
Need a Montana Privacy Attorney?
Whether you are a business working toward compliance or a Montana resident whose privacy has been violated, our network of Montana-licensed attorneys can help.
Find a Montana Privacy Attorney