Montana Consumer Data Privacy Act (MCDPA)
Amended Montana · In force Oct 1, 2024 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Oct 1, 2024 | MCDPA takes effect24 months ago | 24 months ago |
| Oct 1, 2025 | SB 297 amendments take effect; cure period eliminated12 months ago | 12 months ago |
Summaries for reference, not legal advice. Check the official text.
What it does
Comprehensive privacy law with access, correction, deletion, portability and opt-out rights and mandatory recognition of opt-out preference signals. SB 297 (2025) lowered thresholds, removed the cure period, added minors' protections that apply regardless of size, and lets the AG demand data protection assessments in investigations.
- Who it applies to
- From Oct 1, 2025: persons doing business in Montana or targeting residents that control or process personal data of 25,000+ consumers (excluding payment-only data), or 15,000+ consumers and derive over 25% of gross revenue from selling personal data. Minors' provisions (30-14-2811, -2818, -2819) apply to anyone doing business in Montana or intentionally targeting products at residents regardless of volume. Original thresholds (Oct 1, 2024): 50,000 consumers, or 25,000 + over 25% revenue from sale.
- Penalties
- AG enforces using Montana Unfair Trade Practices and Consumer Protection Act powers (MCA Title 30, ch. 14, parts 1-2); no private right of action. SB 297 eliminated the 60-day cure period.
- Enforced by
- Montana Attorney General (exclusive)
- Official name
- Montana Consumer Data Privacy Act (SB 384, 2023), Mont. Code Ann. 30-14-2801 et seq., as amended by SB 297 (2025)
- Citation
- SB 384 (2023 Mont. Laws ch. 681); SB 297 (2025 Mont. Laws ch. 567); MCA 30-14-2801 to 30-14-2819
- Topics
- privacy, children
Research notes
The original act's 60-day cure period was scheduled to expire April 1, 2026; SB 297 removed it effective Oct 1, 2025 (per Hunton; MCA 30-14-2817 as amended by ch. 567 L. 2025 no longer contains a cure provision). The Oct 1, 2025 effective date of SB 297 is from secondary sources and the task brief, not the session law text. Hunton reports penalties up to $7,500 per violation under SB 297, but the codified enforcement section (30-14-2817) contains no dollar figure; penalties flow from the Montana Consumer Protection Act, so no exact per-violation figure is asserted here.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)Questions about Montana Consumer Data Privacy Act (MCDPA)
- What are the Montana Consumer Data Privacy Act (MCDPA) compliance deadlines?
- Oct 1, 2024: MCDPA takes effect. Oct 1, 2025: SB 297 amendments take effect; cure period eliminated.
- When does Montana Consumer Data Privacy Act (MCDPA) take effect?
- Montana Consumer Data Privacy Act (MCDPA) took effect on Oct 1, 2024.
- Who does Montana Consumer Data Privacy Act (MCDPA) apply to?
- From Oct 1, 2025: persons doing business in Montana or targeting residents that control or process personal data of 25,000+ consumers (excluding payment-only data), or 15,000+ consumers and derive over 25% of gross revenue from selling personal data. Minors' provisions (30-14-2811, -2818, -2819) apply to anyone doing business in Montana or intentionally targeting products at residents regardless of volume. Original thresholds (Oct 1, 2024): 50,000 consumers, or 25,000 + over 25% revenue from sale.
- What are the penalties under Montana Consumer Data Privacy Act (MCDPA)?
- AG enforces using Montana Unfair Trade Practices and Consumer Protection Act powers (MCA Title 30, ch. 14, parts 1-2); no private right of action. SB 297 eliminated the 60-day cure period.