Montana Consumer Data Privacy Act

The Montana Consumer Data Privacy Act took effect on October 1, 2024. Amendments (SB 297) in force since October 1, 2025 lowered the thresholds. It now applies to businesses that handle the personal data of 25,000 or more Montana consumers (not counting payment-only data), or 15,000 or more while getting over 25% of gross revenue from selling personal data. They were 50,000 and 25,000.

Nonprofits aren’t exempt, apart from those set up to fight insurance fraud. The 2025 amendments also ended the exemption for financial institutions as entities; only Gramm-Leach-Bliley data itself stays exempt.

• Rights to confirm and access, correct, delete, get a copy, and opt out of targeted advertising, sale, and profiling used for automated decisions.
• Respond within 45 days, extendable by 45 more where reasonably necessary. Free once every 12 months.
• Appeals: answer in writing within 60 days.

Since January 1, 2025, businesses must let consumers opt out of targeted advertising and sale through an opt-out preference signal such as Global Privacy Control. The signal can’t be a default setting. If it conflicts with a loyalty program setting, follow the signal; you may let the consumer know.

Sensitive data needs consent. Since October 1, 2025, a new section protects minors (under 18) when a business knows or willfully disregards their age: it sets a duty of reasonable care, and without consent bars targeted advertising, sale and profiling of their data. For children under 13, a parent consents. Online offerings aimed at minors need a data protection assessment.

Since the 2025 amendments, the notice must list the categories of data processed and why, what you sell or share and with which categories of third parties, an active email address or other contact method, how to appeal, and the date it was last updated. Post it through a conspicuous link using the word “privacy”, in every language you offer your service in. Offer the opt-out outside the notice too, for example a link labeled “your privacy rights”.

The Attorney General has exclusive authority; there’s no private right of action. The 2025 amendments removed the statute’s notice-and-cure provision, and added penalties of up to $7,500 per violation, plus injunctions and attorney fees. The Attorney General can also issue civil investigative demands and ask for data protection assessments.