{
  "type": "practice-guide",
  "canonical": "https://openagreements.org/practice-guides/privacy/us/montana",
  "links": [
    {
      "rel": "self",
      "href": "https://openagreements.org/practice-guides/privacy/us/montana.json",
      "type": "application/json"
    },
    {
      "rel": "alternate",
      "href": "https://openagreements.org/practice-guides/privacy/us/montana",
      "type": "text/html"
    },
    {
      "rel": "alternate",
      "href": "https://openagreements.org/practice-guides/privacy/us/montana/markdown",
      "type": "text/markdown"
    },
    {
      "rel": "alternate",
      "href": "https://openagreements.org/practice-guides/privacy/us/montana/json",
      "type": "application/json"
    }
  ],
  "data": {
    "topic": "privacy",
    "state": "montana",
    "frontmatter": {
      "title": "Montana Consumer Privacy Law (MCDPA)",
      "description": "The Montana Consumer Data Privacy Act gives Montana consumers rights over their personal data and imposes notice, contracting, and consent duties on controllers above notably low thresholds — it requires opt-in consent for sensitive data, recognition of a universal opt-out preference signal, and is enforced exclusively by the Attorney General with no private right of action and, after a 2025 amendment, no general cure period.",
      "state": "Montana",
      "lastReviewed": "2026-06-05",
      "license": "CC BY 4.0",
      "authors": [
        "steven-obiajulu"
      ],
      "summary": {
        "keyLaw": "Mont. Code Ann. §§ 30-14-2801 et seq. (codified short title Consumer Data Privacy Act; commonly the Montana Consumer Data Privacy Act, or MCDPA)",
        "appliesTo": "Persons doing business in Montana (or targeting residents) that control or process the data of 25,000+ consumers, or 15,000+ while deriving over 25% of gross revenue from selling data — no revenue floor; state agencies, higher-education institutions, GLBA banks, HIPAA covered entities, and insurers are exempt",
        "privacyPolicyRequired": "Yes — a reasonably accessible, clear, and meaningful notice with statutorily fixed contents",
        "privateRightOfAction": "No — enforcement is exclusively the Attorney General's",
        "regulator": "Montana Attorney General (exclusive)",
        "bottomLine": "If you meet the 25,000-consumer (or 15,000 plus over-25%-data-sale) threshold in Montana, the MCDPA requires a privacy notice, opt-in consent to process sensitive data, recognition of a universal opt-out preference signal, and processor contracts — enforced by the Attorney General, with no consumer lawsuits and, since the 2025 amendments, no general right to cure before penalties of up to $7,500 per violation.",
        "lawCoverage": "comprehensive",
        "policyMandate": "statutoryContents",
        "consumersCanSue": "no",
        "sensitiveDataConsent": "optIn",
        "universalOptOutSignal": "required"
      },
      "about": [
        "Montana Consumer Data Privacy Act MCDPA",
        "Montana privacy policy requirements",
        "Montana privacy notice contents",
        "MCDPA applicability thresholds",
        "MCDPA sensitive data consent",
        "MCDPA processor contract requirements",
        "Montana Attorney General privacy enforcement"
      ],
      "translations": [
        {
          "language": "中文",
          "status": "planned"
        },
        {
          "language": "Español",
          "status": "planned"
        },
        {
          "language": "Português",
          "status": "planned"
        },
        {
          "language": "Deutsch",
          "status": "planned"
        }
      ]
    },
    "questions": [
      {
        "slug": "does-mcdpa-apply",
        "label": "Does the MCDPA apply to your business?",
        "heading": "Does the MCDPA apply to your business?",
        "answerText": "It turns on consumer volume, not revenue, and the thresholds are low. The MCDPA applies to persons that do business in Montana or target its residents and that control or process the personal data of at least 25,000 consumers, or at least 15,000 consumers while deriving more than 25% of gross revenue from the sale of personal data.",
        "sources": [
          {
            "id": "stat-2801-shorttitle",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2801",
            "citation": "Mont. Code Ann. § 30-14-2801.",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0010/0300-0140-0280-0010.html",
            "proposition": "The codified short title of the act is the Consumer Data Privacy Act.",
            "verbatimQuote": "30-14-2801. Short title. This part may be cited as the \"Consumer Data Privacy Act\".",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2801-shorttitle"
          },
          {
            "id": "stat-2803-apply",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2803",
            "citation": "Mont. Code Ann. § 30-14-2803(1)(a).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html",
            "proposition": "The MCDPA applies to persons doing business in Montana or targeting its residents that control or process the data of at least 25,000 consumers, with payment-transaction-only data excluded from the count.",
            "verbatimQuote": "(a) control or process the personal data of not less than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2803-apply"
          },
          {
            "id": "stat-2803-revenue",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2803",
            "citation": "Mont. Code Ann. § 30-14-2803(1)(b).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html",
            "proposition": "The MCDPA also applies to persons that process the data of at least 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data.",
            "verbatimQuote": "(b) control or process the personal data of not less than 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2803-revenue"
          },
          {
            "id": "stat-2802-consumer",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2802",
            "citation": "Mont. Code Ann. § 30-14-2802(7).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0020/0300-0140-0280-0020.html",
            "proposition": "A consumer is a Montana resident, and the term excludes individuals acting in a commercial or employment context, so employee and business-contact data fall outside the consumer-rights framework.",
            "verbatimQuote": "(b) The term does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency whose communications or transactions with the controller occur solely within the context of that individual's role with the company, partnership, sole proprietorship, nonprofit, or government agency.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2802-consumer"
          },
          {
            "id": "stat-2804-exempt",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2804",
            "citation": "Mont. Code Ann. § 30-14-2804(1)(e).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0040/0300-0140-0280-0040.html",
            "proposition": "The MCDPA exempts state agencies, higher-education institutions, GLBA-regulated banks and credit unions, HIPAA covered entities and business associates, and insurers, along with categories of data regulated under federal laws.",
            "verbatimQuote": "(e) state or federally chartered bank or credit union or an affiliate or subsidiary that is principally engaged in financial activities as described in 12 U.S.C. 1843(k);",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2804-exempt"
          }
        ]
      },
      {
        "slug": "privacy-policy-contents",
        "label": "What must your Montana privacy policy contain?",
        "heading": "What must your Montana privacy policy contain?",
        "answerText": "A controller must provide a reasonably accessible, clear, and meaningful privacy notice that lists the categories of personal data processed, the purpose for processing, the categories of personal data sold to or shared with third parties, the categories of those third parties, a contact mechanism, an explanation of consumer rights and how to exercise and appeal them, and the date the notice was last updated.",
        "sources": [
          {
            "id": "stat-2812-notice",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2812",
            "citation": "Mont. Code Ann. § 30-14-2812(5).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0120/0300-0140-0280-0120.html",
            "proposition": "A controller must provide a reasonably accessible, clear, and meaningful privacy notice that lists the categories of personal data processed, the purpose for processing, the categories of data and of third parties to which data is sold or shared, a contact mechanism, an explanation of consumer rights and appeals, and the date the notice was last updated.",
            "verbatimQuote": "A controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes: (a) the categories of personal data processed by the controller; (b) the purpose for processing personal data; (c) the categories of personal data that the controller sells to or shares with third parties, if any; (d) the categories of third parties, if any, with which the controller sells or shares personal data; and (e) an active e-mail address or other mechanism that the consumer may use to contact the controller; (f) an explanation of the rights provided by 30-14-2808(1) and how consumers may exercise their consumer rights, including how a consumer may appeal a controller's decision regarding the consumer's request; and (g) the date the privacy notice was last updated.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2812-notice"
          },
          {
            "id": "stat-2812-posting",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2812",
            "citation": "Mont. Code Ann. § 30-14-2812(10).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0120/0300-0140-0280-0120.html",
            "proposition": "The privacy notice must be posted online through a conspicuous hyperlink on the controller's website homepage or on a mobile device's application store page or download page.",
            "verbatimQuote": "on the controller's website homepage or on a mobile device's application store page or download page.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2812-posting"
          },
          {
            "id": "stat-2812-minimize",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2812",
            "citation": "Mont. Code Ann. § 30-14-2812(1)(a).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0120/0300-0140-0280-0120.html",
            "proposition": "A controller must limit data collection to what is adequate, relevant, and reasonably necessary to the disclosed purposes for processing.",
            "verbatimQuote": "limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the personal data is processed, as disclosed to the consumer;",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2812-minimize"
          }
        ]
      },
      {
        "slug": "vendor-processor-contracts",
        "label": "What must your contracts with vendors and processors include?",
        "heading": "What must your contracts with vendors and processors include?",
        "answerText": "A contract between a controller and a processor must govern the processor's data processing on the controller's behalf — so a written data processing agreement is a statutory requirement, not a best practice.",
        "sources": [
          {
            "id": "stat-2813-contract",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2813",
            "citation": "Mont. Code Ann. § 30-14-2813(2).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0130/0300-0140-0280-0130.html",
            "proposition": "A contract between a controller and a processor must govern the processor's data processing performed on behalf of the controller.",
            "verbatimQuote": "A contract between a controller and a processor must govern the processor's data processing procedures with respect to processing performed on behalf of the controller.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2813-contract"
          },
          {
            "id": "stat-2813-setforth",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2813",
            "citation": "Mont. Code Ann. § 30-14-2813(2).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0130/0300-0140-0280-0130.html",
            "proposition": "The contract must be binding and clearly set forth instructions for processing, the nature and purpose of processing, the type of data, the duration of processing, and the rights and obligations of both parties.",
            "verbatimQuote": "The contract must be binding and clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2813-setforth"
          },
          {
            "id": "stat-2813-terms",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2813",
            "citation": "Mont. Code Ann. § 30-14-2813(2)(a)-(e).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0130/0300-0140-0280-0130.html",
            "proposition": "The contract must require the processor to maintain confidentiality, delete or return data at the controller's direction, make available information to demonstrate compliance, bind any subcontractor by written contract, and allow and cooperate with reasonable assessments.",
            "verbatimQuote": "(a) ensure that each person processing personal data is subject to a duty of confidentiality with respect to the personal data; (b) at the controller's direction, delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law; (c) on the reasonable request of the controller, make available to the controller all information in the processor's possession necessary to demonstrate the processor's compliance with the obligations in this part; (d) engage any subcontractor pursuant to a written contract that requires the subcontractor to meet the obligations of the processor with respect to the personal data; and (e) allow and cooperate with reasonable assessments by the controller or the controller's designated assessor, or the processor may arrange for a qualified and independent assessor to assess the processor's policies and technical and organizational measures in support of the obligations under this part using an appropriate and accepted control standard or framework and assessment procedure for the assessments.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2813-terms"
          }
        ]
      },
      {
        "slug": "sensitive-data-and-opt-out",
        "label": "Do you need consent for sensitive data, and must you honor an opt-out signal?",
        "heading": "Do you need consent for sensitive data, and must you honor an opt-out signal?",
        "answerText": "Yes on both counts. A controller may not process a consumer's sensitive data without first obtaining consent, and for a known child it must instead follow the federal Children's Online Privacy Protection Act. Separately, a controller must let consumers opt out of targeted advertising and the sale of personal data through a universal opt-out preference signal.",
        "sources": [
          {
            "id": "stat-2812-sensitive",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2812",
            "citation": "Mont. Code Ann. § 30-14-2812(2)(b).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0120/0300-0140-0280-0120.html",
            "proposition": "A controller may not process a consumer's sensitive data without consent, and must handle a known child's sensitive data in accordance with COPPA.",
            "verbatimQuote": "process sensitive data concerning a consumer without obtaining the consumer's consent or, in the case of the processing of sensitive data concerning a known child, without processing the sensitive data in accordance with the Children's Online Privacy Protection Act of 1998, 15 U.S.C. 6501, et seq.;",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2812-sensitive"
          },
          {
            "id": "stat-2802-sensitive",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2802",
            "citation": "Mont. Code Ann. § 30-14-2802(28)(a).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0020/0300-0140-0280-0020.html",
            "proposition": "Sensitive data includes data revealing race or ethnicity, religious beliefs, health condition, sex life, sexual orientation, or immigration status.",
            "verbatimQuote": "(a) data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, information about a person's sex life, sexual orientation, or citizenship or immigration status;",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2802-sensitive"
          },
          {
            "id": "stat-2809-signal",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2809",
            "citation": "Mont. Code Ann. § 30-14-2809(3)(b)(ii).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0090/0300-0140-0280-0090.html",
            "proposition": "Controllers must allow consumers to opt out of targeted advertising or the sale of personal data through an opt-out preference signal that requires an affirmative choice and uses no default setting.",
            "verbatimQuote": "(ii) may not make use of a default setting, but require the consumer to make an affirmative, freely given and unambiguous choice to opt out of any processing of a customer's personal data pursuant to this part;",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2809-signal"
          },
          {
            "id": "stat-2808-optout",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2808",
            "citation": "Mont. Code Ann. § 30-14-2808(1)(e).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0080/0300-0140-0280-0080.html",
            "proposition": "Consumers have the right to opt out of processing of their personal data for the purposes of targeted advertising, the sale of personal data, and certain profiling.",
            "verbatimQuote": "(e) opt out of the processing of the consumer's personal data for the purposes of:",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2808-optout"
          }
        ]
      },
      {
        "slug": "enforcement-and-lawsuits",
        "label": "Who enforces the MCDPA, and can consumers sue?",
        "heading": "Who enforces the MCDPA, and can consumers sue?",
        "answerText": "The Attorney General has exclusive authority to enforce the MCDPA, so there is no private right of action for consumers. An uncured violation exposes a business to a civil penalty of up to $7,500 for each violation.",
        "sources": [
          {
            "id": "stat-2817-enforce",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2817",
            "citation": "Mont. Code Ann. § 30-14-2817(1).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0170/0300-0140-0280-0170.html",
            "proposition": "The Attorney General has exclusive authority to enforce the MCDPA.",
            "verbatimQuote": "The attorney general has exclusive authority and may use the duties and powers provided by Title 30, chapter 14, parts 1 and 2, to enforce violations pursuant to this part.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2817-enforce"
          },
          {
            "id": "stat-2817-nopra",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2817",
            "citation": "Mont. Code Ann. § 30-14-2817(5).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0170/0300-0140-0280-0170.html",
            "proposition": "The MCDPA provides no private right of action for violations.",
            "verbatimQuote": "Nothing in this part may be construed as providing the basis for or be subject to a private right of action for violations of this part or any other law.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2817-nopra"
          },
          {
            "id": "stat-2820-penalty",
            "authorityType": "primary-law",
            "tier": "primary-source-backed",
            "title": "Mont. Code Ann. § 30-14-2820",
            "citation": "Mont. Code Ann. § 30-14-2820(2).",
            "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0200/0300-0140-0280-0200.html",
            "proposition": "A violator is liable for a civil penalty of up to $7,500 for each violation, which the Attorney General may recover by action in the name of the state.",
            "verbatimQuote": "A person who violates the provisions of this part following the 30-day period described in 30-14-2817(3) is liable for a civil penalty in an amount not to exceed $7,500 for each violation.",
            "anchor": "https://openagreements.org/practice-guides/privacy/us/montana#src-stat-2820-penalty"
          }
        ]
      }
    ]
  }
}