Montana MCDPA
Montana Consumer Data Privacy Act (MCA 30-14-2801 et seq., as amended by SB 297 of 2025)
Montana's consumer privacy law took effect on 1 October 2024. Amendments made by SB 297 (2025) cut the applicability thresholds, removed the cure period, added a civil penalty, and introduced duties toward known minors.
Who it applies to
Persons doing business in Montana or targeting its residents that control or process the personal data of 25,000 or more consumers (excluding payment-only data), or 15,000 or more consumers while deriving more than 25 percent of gross revenue from selling personal data (thresholds as amended in 2025).
Identity requirements
- Obtain consent before processing sensitive data, including biometric and genetic data
- Use reasonable care to avoid heightened risk of harm to known minors, and obtain consent for targeted advertising, sale, certain profiling and precise geolocation collection involving minors
- Conduct data protection assessments for higher-risk processing, including processing that poses a heightened risk to minors
- Honor rights to access, correct, delete and port data and to opt out of sale, targeted advertising and profiling, including through universal opt-out signals
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Customer identity & consent (CIAM) | Consent capture for sensitive data and minors must be built into registration and preference flows. |
| Identity verification (KYC/proofing) | Biometric proofing is sensitive-data processing; the law does not mandate age verification but protects good-faith age estimation. |
| Audit, logging & accountability | Assessments must be documented, and the Attorney General can issue civil investigative demands. |
Penalties
Section 30-14-2820, added by SB 297 (2025), sets civil penalties of up to 7,500 dollars per violation, recoverable by the Attorney General together with injunctive relief and attorney fees, and makes a violation also a violation of Montana's Unfair Trade Practices and Consumer Protection Act. The enforcement section (30-14-2817) no longer contains a cure period, and there is no private right of action.
Status and dates last verified against primary sources on 2026-10-31.
Montana MCDPA: frequently asked questions
- What changed in Montana's privacy law in 2025?
- SB 297 lowered the thresholds to 25,000 consumers (or 15,000 with more than 25 percent of revenue from data sales), removed the cure period, added civil penalties and created duties toward known minors.
- Does the Montana law require age verification?
- No. It sets duties toward known minors but does not require age verification.