MTCDPA Compliance: The Montana Consumer Data Privacy Act, Handled
Montana's low thresholds reach a wide range of businesses, and a 2025 amendment removed the cure period. ConsentPixel makes compliance a one-pixel install.
The Montana Consumer Data Privacy Act (MTCDPA, also abbreviated MCDPA) gives Montana residents control over their personal data — and its low applicability thresholds mean it reaches a wider range of businesses than most state laws. ConsentPixel — Privacy · Verified handles opt-outs, universal opt-out signals, privacy documents, and audit-ready logs so MTCDPA compliance is one pixel away.
What is the MTCDPA?
The Montana Consumer Data Privacy Act took effect on October 1, 2024. It grants Montana residents rights over their personal data and imposes obligations on businesses that process it. A 2025 amendment (SB 297, effective October 1, 2025) lowered the thresholds further and added strong protections for minors, making Montana one of the more protective state regimes.
Because Montana has a smaller population, the law deliberately uses lower thresholds than the typical 100,000-consumer standard. After the 2025 amendment, the thresholds dropped to 25,000 consumers (from 50,000), and to 15,000 consumers (from 25,000) where a business derives over 25% of gross revenue from selling personal data. The law follows an opt-out model for general data and opt-in for sensitive data, and it requires recognition of universal opt-out signals.
Who must comply
- Businesses that conduct business in Montana or target Montana residents and, in a calendar year, either:
- Control or process the personal data of at least 25,000 consumers (excluding data solely for completing payment transactions); or
- Control or process the personal data of at least 15,000 consumers and derive more than 25% of gross revenue from selling personal data.
- Nonprofits, higher-education institutions, and standard categories (HIPAA, GLBA, FERPA, etc.) are generally exempt.
(These are the amended thresholds effective October 1, 2025; the original law used 50,000 / 25,000.)
What the MTCDPA requires
- Privacy notice: Provide a clear, accessible privacy notice describing data practices and consumer rights.
- Consumer rights: Honor access, correction, deletion, portability, and opt-out of sale, targeted advertising, and certain profiling.
- Opt-out mechanisms & universal opt-out: Provide clear opt-outs and recognize universal opt-out signals such as GPC.
- Sensitive data consent: Obtain opt-in consent before processing sensitive personal data.
- Minor protections: Apply heightened protections for the data of minors (strengthened by the 2025 amendment).
- Data protection assessments: Conduct assessments for higher-risk processing.
The Montana Attorney General has exclusive enforcement authority through the Office of Consumer Protection — there is no private right of action. The original 60-day cure period was removed by the 2025 amendment, so enforcement can proceed without a mandatory cure opportunity. Notably, the statute does not specify caps on monetary penalties.
How ConsentPixel makes you MTCDPA-compliant
ConsentPixel — Privacy · Verified sits between your visitors and your trackers. It detects what's running, presents a geo-aware consent banner, enforces the visitor's choice, and keeps an immutable record of every decision. Here's how that maps to your obligations:Geo-aware opt-out model. Montana visitors get the opt-out experience the MTCDPA requires, with sensitive data gated behind opt-in consent and GPC honored — especially important given the removed cure period.
Auto-detecting scanner finds every cookie and tracker on your site, so your disclosures and consent categories are complete and accurate — not guesswork.
Signal passthrough drives Google Consent Mode v2, Microsoft UET, Meta Pixel, and IAB TCF 2.3 from a single consent event, so every platform respects the same choice.
GPC honoring recognizes Global Privacy Control opt-out signals and applies them automatically.
Document generator auto-creates Privacy Policy, Cookie Policy, Terms, and DPA documents to support your transparency obligations.
Immutable, tamper-evident logs record every consent decision — audit-ready proof of what each visitor saw and chose.
One pixel, under 5 minutes. Everything above ships from a single pixel install, with a public trust badge and verification page.
Why ConsentPixel
- Auto-detection ensures opt-outs actually suppress the right trackers.
- One pixel handles opt-outs, GPC, documents, and signals together.
- Audit-ready logs matter even more where there's no mandatory cure period.
- Multi-regulation: the same install covers other state laws your visitors fall under.
Frequently asked questions
What are the current MTCDPA thresholds?
As of the October 1, 2025 amendment, the law applies at 25,000 consumers, or 15,000 consumers where a business derives more than 25% of gross revenue from selling personal data — lower than most states.
Is there still a cure period under the MTCDPA?
The original 60-day cure period was removed by the 2025 amendment, so the Montana Attorney General can pursue enforcement without a mandatory opportunity to cure. Clean, audit-ready records are therefore especially important.
Do I have to honor GPC under the MTCDPA?
Yes. The law requires recognition of universal opt-out signals. ConsentPixel honors Global Privacy Control automatically.
Are there penalty caps under the MTCDPA?
The statute does not specify a cap on monetary penalties, which gives the Attorney General broad discretion. Consult counsel for an assessment of your exposure.
Does the MTCDPA protect children's data specifically?
Yes. The 2025 amendment added strengthened protections for the data of minors.
The bottom line
Montana's 2025 amendment made an already-protective law sharper: lower thresholds, no mandatory cure period, no penalty cap, and stronger minors' protections. With no automatic chance to fix mistakes, getting opt-outs and logging right the first time is the whole game.
Make MTCDPA compliance a one-pixel job
Install ConsentPixel to serve Montana visitors the right opt-out model, honor GPC, generate your privacy documents, and keep audit-ready logs.
Scan your site free Start free trialThis page is informational and is not legal advice. The MTCDPA is a Montana state law; consult qualified counsel for advice on your specific obligations.