Key Facts
Overview
Montana's MCDPA has the lowest applicability thresholds among US state privacy laws following SB 297 amendments. The October 2025 amendments eliminated the cure period, mandated GPC signal honoring, and introduced a unique duty of reasonable care for minors under 18.
What This Means for Your Website
- GPC signals must be honored from October 2025
- Opt-in consent is required for sensitive data
- A unique duty of "reasonable care" applies when processing data of minors under 18
- Sale of data from 13-17 year olds is prohibited, as is targeted advertising
- The cure period was eliminated in October 2025
- Applicability thresholds are the lowest among US states (25,000/15,000 consumers)
Key Requirements
The Montana AG enforces the MCDPA with penalties up to $7,500 per violation. Consumer requests must be fulfilled within 45 days. The duty of reasonable care for minors requires controllers to implement mitigation plans for identified risks. SB 297 significantly expanded coverage and protections.
How ConsentStack Handles This
ConsentStack detects Montana visitors, honors GPC signals, and applies enhanced protections for minors including blocking sale and targeted advertising for under-18 visitors.
Penalties
Up to $7,500 per violation (no statutory cap).
Key Requirements
- Honor GPC/universal opt-out signals from October 2025
- Opt-in consent for sensitive data
- Duty of reasonable care for minors under 18, unique
- Data protection assessments for services with heightened harm risk
- Consumer rights: access, correct, delete, portability, opt-out
Notable Provisions
- Lowest applicability thresholds (25,000/15,000) among US states
- Cure period eliminated October 2025
- Unique duty of reasonable care for minors
- Sale of 13-17 data prohibited
Data Subject Rights
Confirm whether a controller is processing your personal data and access it, unless doing so would reveal a trade secret; the controller must withhold identifiers such as your Social Security number but tell you it holds them.
Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
Have a controller delete personal data about you.
Obtain a copy of the personal data you previously provided to the controller in a portable and, where technically feasible, readily usable format you can transmit to another controller, when the processing is automated.
Opt out of the processing of your personal data for targeted advertising, including through an opt-out preference signal such as a browser setting, browser extension or global device setting.
Opt out of the sale of your personal data, including through an opt-out preference signal such as a browser setting, browser extension or global device setting.
Opt out of profiling in furtherance of automated decisions that produce legal or similarly significant effects, such as decisions about lending, housing, insurance, education, criminal justice, employment, health care or access to necessities.
Designate another person, including through a technology such as a browser setting, browser extension or global device setting, to opt out of targeted advertising, sale or profiling on your behalf; this agent right covers opt-outs only.
Appeal a controller's refusal to act on your request through a process that must be conspicuously available and similar to the request process, and receive a written explanation of the decision.
If a controller denies your appeal, it must give you an online mechanism, if available, or another method to submit a complaint to the Montana Attorney General, who must post an online privacy complaint mechanism.
Revoke consent you gave a controller, for example to process sensitive data, through a mechanism at least as easy as the one used to give it, after which the controller must stop the processing.
A controller may not discriminate against you for exercising your rights, such as by denying goods or services, charging different prices or giving lower quality, but it may offer a different price or level of service if you opt out or join a bona fide loyalty, rewards, premium features, discount or club card program.
US State Specifics
Other North America Regulations
Frequently Asked Questions
Montana MCDPA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.
Stay compliant with Montana MCDPA
ConsentStack helps you implement Opt-out consent for Montana, United States automatically.