Montana Consumer Data Privacy Act (MCDPA)
Complete compliance guide for companies with <200 employees. Everything you need to know about MCDPA requirements, deadlines, and penalties.
45 calendar days
+ 15 days extension
$7,500/violation
Up to $7,500 per violation under the Montana Consumer Protection Act. A 60-day cure period applies until April 1, 2026, after which the Attorney General may proceed directly with enforcement actions.
50,000 consumers
$3,500 – $13,000
4-10 weeks
Mid-Market Compliance Guide
Montana's MCDPA originally had the lowest consumer threshold of any US state privacy law at 50,000 consumers. SB 297 (2025) further lowered thresholds to 25,000 consumers (effective October 2025) and eliminated the mandatory cure period. The extension period is only 15 days (vs. 45 in most states), creating a tighter compliance window.
Key Requirements
- Provide a clear and accessible privacy notice
- Limit data collection to what is adequate, relevant, and necessary
- Obtain consent before processing sensitive data
- Conduct data protection assessments for targeted advertising, profiling, and sale of data
- Implement and maintain reasonable data security practices
Consumer Rights
Business Obligations
- 1.Provide privacy notice with required disclosures
- 2.Respond to consumer requests within 45 days
- 3.Provide an appeals process for denied requests
- 4.Execute data processing agreements with processors
- 5.Implement reasonable data security measures
Exemptions
- •HIPAA-covered entities and data
- •GLBA-covered financial institutions
- •Nonprofits
- •Higher education institutions
- •Government entities
Related Privacy Laws
Recommended Compliance Tools
No vendors have been reviewed for MCDPA coverage yet.
Browse all compliance toolsGet a mid-market compliance checklist for MCDPA
We'll send you a practical, step-by-step checklist tailored for companies with <200 employees. No spam, unsubscribe anytime.
See how DPAs enforce MCDPA in practice
Real fines, real violations, real lessons. Browse our enforcement database to understand what gets penalized under MCDPA.
Disclaimer: This is general information, not legal advice. Consult a qualified attorney for your specific situation. Laws and regulations may change. Last reviewed: 3/3/2026.