# Montana — US state consumer data privacy laws: applicability thresholds by state

For Montana, law name and abbreviation is Montana Consumer Data Privacy Act (MCDPA); effective date is October 1, 2024; consumer volume threshold is control or process the personal data of not less than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; revenue-from-data-sales threshold is control or process the personal data of not less than 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data; threshold combination logic is OR — applies to persons that conduct business in this state and meet either threshold, recorded from its source on 2026-08-12.

- **State:** Montana _(our reading, not quoted from the source)_
- **Law name and abbreviation:** Montana Consumer Data Privacy Act (MCDPA)
- **Effective date:** October 1, 2024
- **Consumer volume threshold:** control or process the personal data of not less than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction _(verified: appears in the quote below)_
- **Revenue-from-data-sales threshold:** control or process the personal data of not less than 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data _(verified: appears in the quote below)_
- **Threshold combination logic:** OR — applies to persons that conduct business in this state and meet either threshold _(verified: appears in the quote below)_
- **Key exemptions:** Government bodies; HIPAA-covered entities; GLBA-regulated financial institutions; nonprofit organizations; institutions of higher education
- **Enforcement mechanism:** Attorney General; 60-day cure period; no private right of action
- **Statute citation:** Mont. Code Ann. §§ 30-14-2801 to 30-14-2817
- **Notes:** Montana has the lowest consumer threshold in the country at 25,000 consumers, and the lowest data-sales threshold at 15,000 consumers with 25% revenue. Montana's small population (approximately 1.1 million) means these thresholds capture a proportionally larger share of businesses operating in the state.

## What the source says

> apply to persons that conduct business in this state or persons that produce products or services that are targeted to residents of this state and: (a) control or process the personal data of not less than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (b) control or process the personal data of not less than 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data.

## Source

- https://leg.mt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html

Last verified: 2026-08-12. Review by: 2026-11-10.
Part of [US state consumer data privacy laws: applicability thresholds by state](https://referencesource.org/state-data-privacy-applicability-thresholds/).