Montana Consumer Data Privacy Act (MCDPA) Reference Guide

The MCDPA generally applies to persons doing business in Montana or producing products or services targeted to Montana residents that control or process at least 25,000 consumers’ personal data, excluding data used solely to complete payment transactions. The alternative is 15,000 consumers plus more than 25% of gross revenue from personal-data sales. Mont. Code Ann. § 30-14-2803: applicability

The law contains entity and data exemptions, including specified government bodies, higher-education institutions, financial institutions, HIPAA covered entities and business associates, insurers, and defined regulated datasets. Applicability requires a fact-specific review. Mont. Code Ann. § 30-14-2804: exemptions

The current applicability section excludes the minors duties in sections 30-14-2811, 30-14-2818 and 30-14-2819 from the numerical thresholds. Those sections instead apply to persons doing business in Montana or intentionally targeting Montana residents with commercial products or services. Mont. Code Ann. § 30-14-2803(2)

Montana residents may confirm processing and access data, correct inaccuracies, delete personal data, obtain eligible data in portable form, and opt out of targeted advertising, personal-data sales and qualifying profiling. Mont. Code Ann. § 30-14-2808: consumer rights

Controllers generally must respond without undue delay and within 45 days, with one justified 45-day extension. A refusal must include appeal instructions, and an appeal must be decided within 60 days. Mont. Code Ann. § 30-14-2808: requests and appeals

Montana defines sale as an exchange of personal data for monetary or other valuable consideration, subject to listed exclusions. Targeted advertising concerns ads selected using personal data from activity over time and across nonaffiliated sites or apps. Mont. Code Ann. § 30-14-2802: definitions

If a controller sells personal data or processes it for targeted advertising, the current code requires disclosure in the privacy notice and a clear opt-out method outside that notice. Mont. Code Ann. § 30-14-2812(4)

Montana permits a consumer to designate an authorized agent through technology such as a browser setting, extension or global device setting. Since January 1, 2025, covered controllers must allow qualifying preference signals to opt out of targeted advertising and personal-data sales. Mont. Code Ann. § 30-14-2809

Test consent rejection and GPC in separate browser sessions, then compare the results. Compare that run with the site’s direct opt-out route because a site can recognize one mechanism but fail to propagate the other.

The Montana Attorney General has exclusive enforcement authority, and the MCDPA creates no private right of action. The current penalty section authorizes civil penalties up to $7,500 per violation plus injunctive relief and reasonable enforcement expenses. Mont. Code Ann. § 30-14-2817 Mont. Code Ann. § 30-14-2820

The current enforcement section contains no notice-and-cure procedure. The penalty section nevertheless refers to a “30-day period” in section 30-14-2817(3), while current subsection (3) addresses civil investigative demands rather than a cure period. Organizations should not treat that cross-reference as a dependable mandatory cure right and should obtain counsel on enforcement exposure. Current enforcement text Current penalty text

Counsel determines coverage, exemptions, sale, targeted advertising, profiling, sensitive-data treatment and minors obligations. Product and engineering teams implement those decisions across consent tools, hard-coded scripts, tag managers, APIs and downstream platforms.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Qualified privacy counsel should address applicability, exemptions, classifications, minors, notices, contracts, rights requests, assessments, sensitive data and governance.

This guide relies on the current Montana Code Annotated, the Montana Department of Justice consumer-privacy page and a Montana Legislature interim memo confirming the original enactment and effective date. Current 2025 code text controls the thresholds and minors provisions stated here.

Prepared by Etalon Editorial Team. Last reviewed September 28, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for coverage, exemptions, classifications, notices, requests, sensitive data, minors, contracts, assessments and governance.