Montana Consumer Data Privacy Act Compliance with ConsentX

The Montana Consumer Data Privacy Act (MCDPA) is Montana's comprehensive consumer privacy law. It became effective on October 1, 2024 and establishes privacy rights for Montana consumers and obligations for covered businesses. Montana subsequently amended the law, with significant changes taking effect on October 1, 2025.

Montana consumers generally have the right to know whether their personal data is being processed, access their personal data, correct inaccurate personal data, request deletion of their personal data, obtain a copy of their personal data, opt out of targeted advertising, opt out of the sale of personal data and opt out of profiling in furtherance of certain automated decisions.

The MCDPA does not require consent for every type of personal-data processing. However, consent is required before processing certain sensitive data. Additional consent requirements apply to specific processing activities involving minors.

Sensitive data includes certain categories of personal information that can create heightened privacy risks, including information concerning racial or ethnic origin, religious beliefs, mental or physical health, sexual orientation, citizenship or immigration status, genetic or biometric data used for identification, precise geolocation, and children's personal data.

Yes. Montana consumers have the right to opt out of processing their personal data for targeted advertising.

Yes. Consumers have the right to opt out of the sale of their personal data.

Yes. Consumers can opt out of profiling conducted in furtherance of decisions that produce legal or similarly significant effects concerning them.

Organizations should evaluate universal opt-out signals in conjunction with the MCDPA and the requirements of other applicable state privacy laws. Montana's privacy framework should not be treated as identical to California's or other state laws with explicit universal opt-out requirements.

The MCDPA regulates personal-data processing rather than cookies as a standalone technology. Cookies, pixels, advertising tags, SDKs, and other tracking technologies may nevertheless collect or process personal data or support targeted advertising. For this reason, tracker discovery, privacy preference management, and enforcement of consumer choices can be important components of an MCDPA compliance program.

Yes. Controllers must provide consumers with a reasonably accessible and clear privacy notice explaining relevant categories and purposes of personal-data processing and information about applicable consumer rights.

Yes. Controllers must conduct data protection assessments for certain processing activities that present heightened risks to consumers, including relevant targeted advertising, profiling, sale of personal data, and sensitive-data processing.

Controllers generally must respond to a consumer request within 45 days of receiving the request. The period may generally be extended by an additional 45 days when reasonably necessary, subject to applicable requirements.

Yes. Consumers have the right to appeal a controller's refusal to take action on a request to exercise their privacy rights.

Yes. The amended MCDPA significantly expands protections for minors. A minor is generally an individual under 18, while children under 13 receive additional protections. Businesses that know or reasonably should know they are processing the personal data of minors must take reasonable care to avoid heightened risks of harm. Additional consent requirements can apply to processing a minor's data for targeted advertising, sale, certain automated profiling, certain precise geolocation processing, extended retention, and certain system designs intended to significantly increase or sustain a minor's engagement.

The MCDPA's general applicability is based primarily on the amount of Montana consumer data processed and, for businesses deriving more than 25% of revenue from selling personal data, a lower consumer threshold applies. Under the current law, the general thresholds are 25,000 consumers, or 15,000 consumers where more than 25% of gross revenue is derived from selling personal data.

The Montana Attorney General has enforcement authority under the MCDPA. Montana's Office of Consumer Protection provides information and resources concerning Montana consumer privacy.

ConsentX can help operationalize important privacy controls such as consent management, tracker discovery, prior-script blocking, consumer opt-out management, rights-request workflows, and audit evidence. However, no software can independently guarantee legal compliance. Organizations should assess their complete privacy program against the MCDPA and all other applicable laws.