The Montana Consumer Data Privacy Act was signed in May 2023 and takes effect October 1, 2024.
Montana Privacy & Accessibility Laws
Montana enacted the Montana Consumer Data Privacy Act (MCDPA) in May 2023, becoming one of the states with comprehensive consumer privacy legislation. The law takes effect October 1, 2024. Montana also has a constitutional right to privacy. State agencies must ensure their digital services are accessible to individuals with disabilities.
→
Privacy Law Status
MCDPA Enacted
→
Accessibility Requirements
State Government Websites
Montana state agencies must ensure websites and digital services are accessible under ADA Title II and state IT policies.
Montana Consumer Data Privacy Act (MCDPA)
The Montana MCDPA establishes comprehensive privacy rights for Montana consumers and obligations for businesses that process personal data.
Key Dates
- Enacted: May 19, 2023
- Effective Date: October 1, 2024
- Cure Period: 60 days (until April 1, 2026, then at AG discretion)
Who Must Comply?
The Montana MCDPA has the lowest thresholds of any state privacy law, making it applicable to smaller businesses:
| Threshold | Requirement |
|---|---|
| Data Volume | Control or process personal data of 50,000+ Montana consumers |
| Revenue + Data | Derive more than 25% of gross revenue from selling personal data AND process data of 25,000+ consumers |
Smallest State Population
Montana has the smallest population of any state with a comprehensive privacy law (approximately 1.1 million), making the 50,000 consumer threshold proportionally significant. This lower threshold affects more businesses than comparable laws in larger states.
Consumer Rights Under Montana MCDPA
| Right | Description |
|---|---|
| Right to Know | Confirm whether personal data is being processed and access that data |
| Right to Correct | Correct inaccuracies in personal data |
| Right to Delete | Delete personal data provided by or obtained about the consumer |
| Right to Portability | Obtain personal data in a portable, readily usable format |
| Right to Opt-Out | Opt out of targeted advertising, sale of personal data, and profiling |
Sensitive Data Categories
The Montana MCDPA requires opt-in consent for processing sensitive data, including:
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health conditions
- Sexual orientation or sex life
- Citizenship or immigration status
- Genetic or biometric data
- Personal data of known children
- Precise geolocation data
Montana Constitutional Privacy Right
Montana's constitution includes an explicit right to privacy:
Article II, Section 10
"The right of individual privacy is essential to the well-being of a free society and shall not be infringed without the showing of a compelling state interest."
Accessibility Requirements
Montana government agencies must ensure digital accessibility for all residents:
State Government Obligations
- Montana state agencies must comply with ADA Title II for all public-facing digital content
- State Information Technology Services Division provides accessibility guidance
- State websites must follow WCAG 2.1 Level AA guidelines
- Educational institutions must ensure accessible digital learning materials
- State IT procurement requires vendor accessibility compliance
Private Sector Considerations
- Businesses with physical locations in Montana are subject to ADA Title III
- Website accessibility claims can be brought under federal ADA
- Healthcare providers must ensure accessible patient portals
- Tourism businesses should prioritize accessibility
Enforcement
→
Privacy Enforcement
- Montana Attorney General - Exclusive enforcement authority for MCDPA
- 60-day cure period - Until April 1, 2026
- No private right of action - Only AG can enforce
Contact:
Office of the Attorney General
Consumer Protection Office
215 N. Sanders
Helena, MT 59620
(406) 444-4500
→
Accessibility Enforcement
- U.S. Department of Justice - ADA Title II and III enforcement
- Montana Human Rights Bureau - State disability discrimination
- Private litigation - Federal ADA claims
Contact:
Disability Rights Montana
1022 Chestnut Street
Helena, MT 59601
(406) 449-2344
Montana MCDPA Penalties
| Violation Type | Maximum Penalty |
|---|---|
| Per violation (after cure period) | $7,500 per violation |
| Unfair Trade Practices violation | Additional penalties under Montana Consumer Protection Act |
| Injunctive relief | Court may order business practices to cease |
Business Obligations
| Obligation | Description |
|---|---|
| Privacy Notice | Clear notice of data categories, purposes, rights, and third-party sharing |
| Data Minimization | Limit collection to what is reasonably necessary for disclosed purposes |
| Purpose Limitation | Process data only for purposes disclosed to consumers |
| Security | Implement appropriate technical and organizational security measures |
| Sensitive Data Consent | Obtain opt-in consent before processing sensitive personal data |
| Request Response | Respond to consumer requests within 45 days (may extend 45 days) |
| Data Processing Agreements | Establish contracts with processors that handle personal data |
Consumer Rights
Montana residents have comprehensive privacy rights under the MCDPA:
- Constitutional Privacy: State constitutional protection of individual privacy
- Right to Access: Confirm processing and access personal data
- Right to Correct: Correct inaccurate personal data
- Right to Delete: Request deletion of personal data
- Right to Portability: Receive data in portable format
- Right to Opt-Out: Opt out of targeted advertising, sales, and profiling
- Right to Non-Discrimination: Cannot be penalized for exercising rights
- Right to Appeal: Appeal controller's decision on consumer requests
Important Exemptions
The Montana MCDPA exempts government entities, nonprofits, higher education institutions, HIPAA-covered entities, financial institutions under GLBA, and data regulated by FERPA, HIPAA, FCRA, or GLBA.
Related Resources
- US Privacy Laws Overview
- State Privacy Law Comparison
- ADA Title II Requirements
- All State Laws
- Privacy Compliance Guide
- Report a Violation
Need Help with Montana Compliance?
The Montana MCDPA is now in effect as of October 1, 2024. The lower thresholds mean more businesses are covered. Contact our experts for guidance on privacy policies, consumer request processes, and compliance requirements.