Montana Consumer Data Privacy Act: What Online Sellers Need to Know
Montana's privacy law has the lowest consumer threshold of any pre-2026 state — just 50,000 consumers. Here's how it affects your online business.
2026-03-04
The Montana Consumer Data Privacy Act (MCDPA) took effect on October 1, 2024. Montana is a smaller state by population (~1.1 million), but its privacy law has a notably low threshold — making it relevant even for smaller online businesses.
Who Does the MCDPA Apply To?
The MCDPA applies to businesses that conduct business in Montana or target Montana residents and meet either threshold:
- Control or process personal data of at least 50,000 Montana consumers (excluding payment-only data), OR
- Control or process personal data of at least 25,000 Montana consumers and derive more than 25% of gross revenue from selling personal data
The 50,000 threshold — applied to a state with just over 1 million residents — means this law can catch businesses that wouldn't trigger larger-state thresholds.
Consumer Rights
Montana consumers can:
- Access their personal data
- Correct inaccurate data
- Delete their personal data
- Data portability — obtain a copy
- Opt out of sale, targeted advertising, and profiling
Response deadline: 45 days, with a possible 15-day extension (shorter extension than most states).
Key Requirements
Privacy Notice
Your privacy policy must disclose categories of data processed, purposes, third-party sharing, consumer rights, and whether you sell data or use targeted advertising.
Sensitive Data
Opt-in consent required before processing sensitive categories including racial/ethnic origin, religious beliefs, health data, sexual orientation, biometric/genetic data, children's data, and precise geolocation.
Data Protection Assessments
Required for targeted advertising, data sales, profiling, and sensitive data processing.
Enforcement
Enforced by the Montana Attorney General. No private right of action. Montana's 60-day cure period expired on April 1, 2026 — the AG can now pursue enforcement directly.
Penalties can reach $7,500 per violation.
MCDPA Compliance Checklist
- Privacy policy with required disclosures
- Cookie consent banner with opt-out
- Consumer request process — 45-day response, 15-day extension max
- Sensitive data consent — opt-in
- Data protection assessments for high-risk processing
Check Your Compliance
ClearConsent scans your site against all 19 US state privacy laws including Montana's MCDPA.
Scan your site free — no signup required.