Last updated: January 2025

Please note this is a highlighted overview and not a complete overview of privacy laws for this state. If you would like a complete review of this state's privacy laws or a multi-state privacy compliance cheat sheet on specific topics, please contact Vivien Peaden at vpeaden@bakerdonelson.com.

Disclaimer: These materials do not constitute legal advice and should not be substituted for the advice of legal counsel.

The Montana Consumer Data Protection Act (Montana CDPA)

Effective Date: October 1, 2024

1. Applicability Thresholds:

Subject to certain entity-level and data-level exemptions, the Montana CDPA applies to persons doing business in Montana or producing products or services that are targeted to residents of Montana that control or process the personal data of:

• 50,000+ Montana consumers (excluding payment transaction data); or
• 25,000+ Montana consumers and derive more than 25 percent of gross revenue from the sale of personal data.

2. Key Definitions:

Sales of Personal Data: Like California, Montana has opted for a broader definition of the "sale of personal data" including both the exchange of personal data for monetary consideration and other valuable consideration by the controller to a third party (subject to some exceptions).

3. Heightened Protection for Consumers Under the Age of 16:

Montana introduces heightened protection for teenagers between the ages of 13 and 16.

4. Business Obligations:

The Montana CDPA imposes additional obligations on individuals or legal entities that determine the purpose and means of processing personal information (Controller):

• Data Processing Agreement (DPA): Processing activities by a supplier (known as Processor) shall be governed by a written contract, known as the DPA, between the Controller and Processor.
• Privacy Notice: Yes, a Controller must provide consumers with a privacy notice
• Data Protection Impact Assessment: Controllers must conduct and document a data protection impact assessment for certain processing activities that present a higher risk of harm to consumers, including:
  • Processing of personal data for targeted advertising;
  • Sale of personal data;
  • Certain high-risk profiling activities; and
  • Processing sensitive data.
• Universal Opt-out Mechanism: Effective January 1, 2025, a Controller must allow a consumer to opt out of any personal data processing for targeted advertising, or any personal data sales, by sending the Controller an "opt-out preference signal...by a platform, technology, or mechanism."

5. Consumer Rights:

Subject to certain exceptions, Montana consumers can exercise the following consumer rights (or designate an authorized agent) to:

• Confirm whether a Controller is processing their personal data and provide access to that data;
• Correct inaccuracies in their personal data;
• Delete personal data;
• Obtain a copy of their personal data previously provided by the consumer to the Controller in a portable and readily usable format; and
• Opt-out of targeted advertising, sales of personal data, and "profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer."

6. Enforcement and Penalties:

Private Right of Action: None.

Penalties: The state attorney general has sole authority to enforce the statute, but unlike other similar privacy acts, the Montana CDPA does not expressly specify a civil penalty amount for violations.

Cure Period: A 60-day cure period. However, such a grace period is only available until April 1, 2026.