The Montana Consumer Data Privacy Act (MCDPA) has applied since 1 October 2024, and businesses it covers have had to honour universal opt-out signals such as Global Privacy Control since 1 January 2025. Since 1 October 2025, the SB 297 amendments have lowered the threshold to 25,000 Montana consumers, removed the 60-day cure period and extended the protections for minors to everyone under 18.
What the MCDPA covers
Governor Gianforte signed SB 384 in 2023 (Chapter 681, Laws of 2023), and the Montana Consumer Data Privacy Act took effect on 1 October 2024. On 8 May 2025 he signed SB 297, a major round of amendments that has applied since 1 October 2025, according to Kelley Drye's review of the 2025 state amendments.
The law grants Montana residents a set of rights over their personal data and places obligations on businesses that collect or process that data. Its structure resembles the Virginia CDPA more than the California CCPA, but Montana adds its own twist: a mandatory universal opt-out mechanism that went live on 1 January 2025.
For website owners outside Montana, the reach of the law may still apply. If your site targets Montana residents or processes personal data from a threshold number of Montana consumers, the MCDPA applies to you regardless of where your servers or headquarters sit.
Who must comply: applicability thresholds
The MCDPA's thresholds changed on 1 October 2025, when the SB 297 amendments lowered them significantly. The original figures from SB 384 applied until 30 September 2025.
| Criterion | Original (October 2024 to September 2025) | Current (since 1 October 2025) |
|---|---|---|
| Consumer data volume (general) | 50,000 or more consumers | 25,000 or more consumers |
| Consumer data volume (data sellers) | 25,000 or more consumers and 25% of revenue from data sales | 15,000 or more consumers and 25% of revenue from data sales |
Montana has a small population of roughly 1.1 million. The 25,000-consumer threshold means that a site processing data from just over 2% of the state's population could fall within scope.
SB 297 also narrowed two exemptions. The nonprofit exemption now covers only organisations that "detect and prevent fraudulent acts in connection with insurance", so other nonprofits that meet a threshold are covered. And instead of exempting financial institutions covered by the Gramm-Leach-Bliley Act as whole entities, the law now exempts only the personal data collected, processed, sold or disclosed under that act. A bank that uses customer data for targeted advertising, for example, can now fall under the MCDPA.
Consumer rights under the MCDPA
Montana residents receive five core rights under the MCDPA. These mirror the rights found in several other US state privacy laws, though the details vary.
The rights are:
- Right to know: confirm whether a controller processes their personal data and access that data
- Right to correct: request corrections to inaccurate personal data
- Right to delete: request deletion of personal data the controller holds
- Right to portability: obtain a copy of their data in a portable, readily usable format
- Right to opt out: refuse the sale of personal data, targeted advertising, or profiling that produces legal or similarly significant effects
Controllers must respond to consumer requests within 45 days, with one 45-day extension permitted when reasonably necessary.
The opt-out from sales reaches further than the word suggests. Section 30-14-2802 of the Montana Code defines a sale as the exchange of personal data "for monetary or other valuable consideration", the broader Connecticut and Colorado approach, so a data-sharing deal paid in services rather than money can count.
Universal opt-out signals and GPC
Since 1 January 2025, the MCDPA has required controllers to recognise universal opt-out signals such as Global Privacy Control (GPC). This places Montana alongside Colorado and Connecticut in mandating browser-level opt-out mechanisms.
When a visitor arrives at your site with GPC enabled, your site must treat that signal as a valid opt-out request for both the sale of personal data and targeted advertising.
From a technical standpoint, your cookie consent platform must detect the Sec-GPC HTTP header or the navigator.globalPrivacyControl JavaScript property. GPC covers sales and targeted advertising, so advertising pixels such as _fbp, and any analytics data you share for advertising, must not fire for a visitor who has GPC enabled. First-party analytics that is not sold or used for targeted advertising is outside the signal's scope.
SB 297 added a website requirement too. A business that sells personal data must offer a conspicuous way to opt out outside the privacy notice, such as a link labelled "your privacy rights" that either completes the opt-out or leads to a page where the consumer can make the request.
Sensitive data and consent
The MCDPA treats certain categories of personal data as sensitive and requires opt-in consent before processing them. Sensitive data includes:
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Sexual orientation
- Citizenship or immigration status
- Genetic or biometric data used to identify an individual
- Personal data of a known child
- Precise geolocation data (within 1,750 feet)
This opt-in requirement is stricter than the opt-out model used for general personal data. If your website collects precise geolocation through location-based services, or processes health-related browsing data, you need a clear affirmative consent mechanism before that processing begins.
Data protection assessments
Controllers must conduct data protection assessments for targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of harm, and the processing of sensitive data.
The assessment must weigh the benefits of the processing activity against the potential risks to consumer rights. This is similar to the data protection impact assessment (DPIA) required under GDPR Article 35, though the MCDPA version is enforced through the Montana Attorney General rather than a supervisory authority.
Privacy notice and disclosure requirements
Controllers must publish a clear, accessible privacy notice. Since SB 297, it must be available through a conspicuous link that includes the word "privacy" on the website's homepage, and in the settings menu of a mobile app. The notice should also disclose:
- The categories of personal data processed
- The purposes for processing
- How consumers can exercise their rights
- The categories of personal data shared with third parties
- The categories of those third parties
A generic privacy policy that only references the GDPR or the CCPA will not cover the MCDPA. The notice must specifically address Montana consumer rights.
Enforcement after the cure period
The Montana Attorney General has exclusive enforcement authority. There is no private right of action, meaning individual consumers cannot sue businesses for MCDPA violations.
Under the original law, the Attorney General had to give a 60-day cure period before taking enforcement action, and that period was due to expire on 1 April 2026. SB 297 removed it from 1 October 2025 and gave the Attorney General the power to issue civil investigative demands under the law. Since then, the Attorney General can pursue a violation without first offering a chance to fix it.
As of October 2026, the SB 297 changes have been in force for a year. A systematic failure, such as ignoring GPC signals across thousands of visitors, can now go straight to enforcement.
Stronger protections for minors under SB 297
SB 297 tightened the rules on minors in two ways. The ban on processing a minor's personal data for targeted advertising, sales or profiling without consent now covers everyone under 18, where the original law stopped at 16. And it applies when the controller actually knows or wilfully disregards the consumer's age, so ignoring obvious signals of age no longer protects a business.
If your site collects age data or can reasonably infer that visitors are under 18, review whether your cookie and tracking practices involve targeted advertising or the sale of their data. Advertising tags aimed at known minors are the clearest area of concern.
Checklist for websites with Montana visitors
Many of these steps overlap with requirements from other US state privacy laws, so a unified approach saves effort.
- Check whether your site meets the current thresholds of 25,000 consumers, or 15,000 with 25% of revenue from data sales
- Honour GPC signals in your consent management setup
- Add a conspicuous "privacy" link on the homepage and, if you sell data, a separate opt-out link
- Classify your cookies and tracking technologies, separating essential from non-essential and identifying any that process sensitive data
- Make sure your opt-out mechanism covers data sales, targeted advertising and certain profiling activities
- Keep advertising and data sales off for visitors you know, or should recognise, are under 18
- Conduct data protection assessments for targeted advertising and any sensitive data processing
- Build a response process for consumer rights requests within the 45-day deadline
Montana privacy law: short answers
Does the Montana Consumer Data Privacy Act apply to businesses outside Montana?
Yes. The MCDPA applies to any business that conducts business in Montana or targets products or services at Montana residents, provided it meets the consumer data thresholds: since 1 October 2025, 25,000 consumers, or 15,000 with 25% of revenue from data sales.
What is the universal opt-out signal requirement under the MCDPA?
Since 1 January 2025, controllers must recognise universal opt-out mechanisms such as Global Privacy Control (GPC). When a Montana consumer sends an opt-out signal through their browser, the controller must treat it as a valid request to opt out of data sales and targeted advertising.
Does Montana require opt-in consent for all cookies?
No. The MCDPA uses an opt-out model for general personal data. Opt-in consent is required for sensitive data, such as precise geolocation, biometric data and health information, and for targeted advertising, sales or profiling involving minors under 18.
Who enforces the MCDPA?
The Montana Attorney General has exclusive enforcement authority, and since SB 297 can issue civil investigative demands. There is no private right of action.
Is there still a cure period for MCDPA violations?
No. Under the original law, a 60-day cure period applied. SB 297 removed it from 1 October 2025, so the Attorney General can take enforcement action without first offering a chance to fix the violation.
How does the MCDPA compare to the CCPA?
The MCDPA follows the Virginia CDPA model rather than the CCPA. It uses consumer-count thresholds instead of a revenue test and has no private right of action. Like the CCPA, it defines a sale as an exchange for monetary or other valuable consideration and requires recognition of universal opt-out signals.
See what your site sends to Montana visitors
If you are not sure which cookies your site sets or whether you meet the MCDPA's thresholds, start with a free scan. Kukie.io finds and categorises every cookie, applies the consent model you set for each region, treats a GPC signal as an opt-out where you use an opt-out model, and keeps a record of each choice.
