The Montana Consumer Data Privacy Act originally applied at 50,000 Montana consumers, but 2025 amendments lowered the threshold to 25,000 consumers, or 15,000 if more than a quarter of revenue comes from selling personal data, which is notable in a state with a small population.
What the Montana Consumer Data Privacy Act Requires
Requirements follow the Connecticut model: a privacy notice, access, correction, deletion, and portability rights, opt-in consent for sensitive data, opt-outs for targeted advertising, sale, and significant profiling, data protection assessments, and mandatory recognition of universal opt-out signals like the Global Privacy Control. The 2025 amendments also added stronger protections for minors.
Enforcement and Penalties
The 2025 amendments eliminated the right to cure as of October 1, 2025, so the Attorney General can now bring enforcement without first offering a fix. There is no private right of action. With the lowered thresholds, regional businesses that were previously outside the law should recheck their numbers.
Source: Montana Legislature: SB 384, MCA 30-14-2801 et seq.
Report a violation: If you believe a business is violating this law, you can file a complaint with the Montana Department of Justice Office of Consumer Protection.
