Montana Consumer Data Privacy Act (MTCDPA)

The Montana Consumer Data Privacy Act (MTCDPA) was signed into law on May 19, 2023, and takes effect on October 1, 2024. Montana became one of the growing number of US states to enact comprehensive consumer privacy legislation.

What Is the MTCDPA?

The MTCDPA grants Montana residents rights over their personal data and imposes obligations on businesses that collect or process that data. The law follows the opt-out model for general personal data processing and requires opt-in consent for sensitive data.

Who Does the MTCDPA Apply To?

The MTCDPA applies to businesses that conduct business in Montana or produce products or services targeted to Montana residents, and during the prior calendar year either:

• Controlled or processed the personal data of at least 25,000 consumers (excluding data processed solely for payment transactions); or
• Controlled or processed the personal data of at least 15,000 consumers and derived more than 25% of gross revenue from the sale of personal data.

Note: The original 2023 law set thresholds of 50,000 and 25,000 consumers respectively. These were lowered by SB 297, signed May 8, 2025, with amendments effective October 1, 2025.

Consumer Rights Under the MTCDPA

Montana residents are entitled to:

• Right to access: confirm whether a business processes their personal data and request a copy
• Right to correction: request correction of inaccurate personal data
• Right to deletion: request deletion of their personal data
• Right to data portability: obtain a portable copy of their personal data
• Right to opt out: opt out of targeted advertising, sale of personal data, and profiling for significant decisions
• Right to appeal: appeal a business's denial of a rights request

Businesses must respond to verified consumer requests within 45 days, extendable by an additional 45 days when reasonably necessary.

Sensitive Data

Processing sensitive data requires opt-in consent from consumers. Sensitive data under the MTCDPA includes racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship status, genetic and biometric data processed to uniquely identify an individual, precise geolocation data, and personal data of known children.

Enforcement

The Montana Attorney General enforces the MTCDPA. There is no private right of action. The original law included a 60-day cure period, but this was eliminated by SB 297 effective October 1, 2025; the Attorney General may now bring enforcement actions without first providing an opportunity to cure. Civil penalties of up to $7,500 per violation may be imposed, with each affected consumer potentially constituting a separate violation. The Attorney General may also seek injunctions and recover attorney fees and investigation costs.

How UniConsent Supports MTCDPA Compliance

UniConsent provides the tools businesses need to meet MTCDPA requirements:

• Opt-out and opt-in consent banners configurable by state
• Global Privacy Control (GPC) signal recognition
• Consumer rights request management
• Sensitive data consent workflows
• Integration with websites, mobile apps, and tag managers

Get started with UniConsent or explore our features.

Other US State Privacy Laws

• CCPA: California Consumer Privacy Act, learn more at CCPA
• CPRA: California Privacy Rights Act, learn more at CPRA
• CPA: Colorado Privacy Act, learn more at CPA
• VCDPA: Virginia Consumer Data Protection Act, learn more at VCDPA
• UCPA: Utah Consumer Privacy Act, learn more at UCPA
• CTDPA: Connecticut Data Protection Act, learn more at CTDPA
• TDPSA: Texas Data Privacy and Security Act, learn more at TDPSA
• DPDPA: Delaware Personal Data Privacy Act, learn more at DPDPA
• NHPA: New Hampshire Privacy Act, learn more at NHPA

Compare different US State Privacy Laws