Lowest threshold of any comprehensive state privacy law: applies to businesses processing personal data of just 50,000+ Montana residents. Cure period ended April 1, 2026.
Effective
2024-10-01
Penalty max
$10,000
Cure period
None
Honor GPC
Required
Overview
The Montana Consumer Data Privacy Act (MTCDPA) took effect October 1, 2024. Montana stands out because it has the lowest consumer-count threshold of any comprehensive state privacy law — just 50,000 Montana residents — which means a much wider range of e-commerce businesses are covered than under California, Virginia, or Colorado. Montana also requires honoring browser-level Global Privacy Control (GPC) signals as a valid opt-out mechanism. The 60-day cure period sunset on April 1, 2026, so the AG can now bring enforcement actions immediately upon finding a violation.
Who it applies to
Businesses processing personal data of 50,000+ Montana residents annually.
Businesses processing personal data of 25,000+ Montana residents AND deriving 25%+ of revenue from selling personal data.
Consumer rights
Right to access
Consumers can request a copy of the personal data you hold about them.
Right to correction
Consumers can request you correct inaccurate personal data.
Right to deletion
Consumers can request you delete their personal data, subject to limited exceptions.
Right to portability
Consumers can request a machine-readable copy of their data to transfer elsewhere.
Right to opt out of sale
Consumers can opt out of the sale of their personal data to third parties.
Right to opt out of targeted advertising
Consumers can opt out of personalized ad targeting based on their behavior.
Right to opt out of profiling
Consumers can opt out of automated profiling for decisions with legal or similarly significant effects.
What this means for e-commerce
Montana has the lowest consumer-count threshold of any comprehensive state privacy law — just 50,000 Montana residents — meaning many mid-sized e-commerce stores will cross it. Montana also requires honoring GPC signals, and the 60-day cure period sunset on April 1, 2026, so the AG can now bring enforcement actions immediately.
Penalties & enforcement
Enforced by the Montana Attorney General. Penalties range from $0 to $10,000 per violation.
The cure period sunset on 2026-04-01 — the AG can bring enforcement actions immediately upon finding a violation, without first giving you time to fix the problem.
Compliance checklist
Recognize that Montana's 50,000-resident threshold is much lower than most states — most mid-sized stores cross it
Add a 'Your Privacy Choices' link in the site footer
Configure your site to detect and honor Global Privacy Control (GPC) signals
Update privacy policy with MTCDPA-required disclosures
Implement a 45-day consumer request response process
Conduct data protection assessments for high-risk processing
Obtain opt-in consent before processing sensitive personal data
Does the MTCDPA apply to your business?
Run a free 60-second compliance check across all state privacy laws — including Montana.
BriefStack is for informational purposes only and does not constitute legal advice. For decisions specific to your business, consult a qualified attorney.