Montana MCDPA
Montana Consumer Data Privacy Act (MCA 30-14-2801 et seq., as amended by SB 297 of 2025)
Montana's consumer privacy law took effect on 1 October 2024. SB 297, signed on 8 May 2025 and effective 1 October 2025, cut the applicability thresholds, removed the cure period, added a civil penalty, and introduced duties toward known minors.
Who it applies to
Persons doing business in Montana or targeting its residents that control or process the personal data of 25,000 or more consumers (excluding payment-only data), or 15,000 or more consumers while deriving more than 25 percent of gross revenue from selling personal data (thresholds as amended in 2025).
Identity requirements
- Obtain consent before processing sensitive data, including biometric and genetic data
- Use reasonable care to avoid heightened risk of harm to known minors, and obtain consent for targeted advertising, sale, certain profiling and precise geolocation collection involving minors
- Conduct data protection assessments for higher-risk processing, including processing that poses a heightened risk to minors
- Honor rights to access, correct, delete and port data and to opt out of sale, targeted advertising and profiling, including through universal opt-out signals
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Customer identity & consent (CIAM) | Consent capture for sensitive data and minors must be built into registration and preference flows. |
| Identity verification (KYC/proofing) | Biometric proofing is sensitive-data processing; the law does not mandate age verification but protects good-faith age estimation. |
| Audit, logging & accountability | Assessments must be documented, and the Attorney General can issue civil investigative demands. |
Penalties
SB 297 (2025) added civil penalties of up to 7,500 dollars per violation, enforced by the Attorney General; the 60-day cure period was removed from 1 October 2025.
Status and dates last verified against primary sources on 2026-10-31.
Montana MCDPA: frequently asked questions
- What changed in Montana's privacy law in 2025?
- SB 297 lowered the thresholds to 25,000 consumers (or 15,000 with more than 25 percent of revenue from data sales), removed the cure period, added civil penalties and created duties toward known minors, effective 1 October 2025.
- Does the Montana law require age verification?
- No. It sets duties toward known minors but does not require age verification.