Montana
For Montana, law name and abbreviation is Montana Consumer Data Privacy Act (MCDPA); effective date is October 1, 2024; consumer volume threshold is control or process the personal data of not less than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; revenue-from-data-sales threshold is control or process the personal data of not less than 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data; threshold combination logic is OR — applies to persons that conduct business in this state and meet either threshold, recorded from its source on 2026-08-12.
- State
- Montana our reading
- Law name and abbreviation
- Montana Consumer Data Privacy Act (MCDPA)
- Effective date
- October 1, 2024
- Consumer volume threshold
- control or process the personal data of not less than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction verified
- Revenue-from-data-sales threshold
- control or process the personal data of not less than 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data verified
- Threshold combination logic
- OR — applies to persons that conduct business in this state and meet either threshold verified
- Key exemptions
- Government bodies; HIPAA-covered entities; GLBA-regulated financial institutions; nonprofit organizations; institutions of higher education
- Enforcement mechanism
- Attorney General; 60-day cure period; no private right of action
- Statute citation
- Mont. Code Ann. §§ 30-14-2801 to 30-14-2817
- Notes
- Montana has the lowest consumer threshold in the country at 25,000 consumers, and the lowest data-sales threshold at 15,000 consumers with 25% revenue. Montana's small population (approximately 1.1 million) means these thresholds capture a proportionally larger share of businesses operating in the state.
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
apply to persons that conduct business in this state or persons that produce products or services that are targeted to residents of this state and: (a) control or process the personal data of not less than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (b) control or process the personal data of not less than 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data.
— leg.mt.gov, retrieved 2026-08-12
Source
- leg.mt.govhttps://leg.mt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html