Montana Data Privacy Law (MCDPA): What Montana Residents Need to Know

Montana's Montana Consumer Data Privacy Act (MCDPA) took effect on October 1, 2024. The law is worth paying attention to for one specific reason: it treats personal data of teenagers ages 13 to 16 as sensitive data, a higher bar than most comparable state laws. Here is what Montana residents need to know about their privacy rights.

What Is the Montana Consumer Data Privacy Act?

Governor Greg Gianforte signed the Montana Consumer Data Privacy Act into law on May 22, 2023. The law became effective October 1, 2024, giving businesses approximately 16 months to achieve compliance. Montana was among the first states to pass comprehensive privacy legislation in the second wave of state laws that took effect in 2024.

The MCDPA applies to businesses that conduct business in Montana or produce products or services targeted to Montana residents, and during the prior calendar year either: controlled or processed personal data of at least 50,000 Montana consumers, excluding data processed solely for completing a payment transaction; or controlled or processed personal data of at least 25,000 Montana consumers and derived more than 25% of gross revenue from the sale of personal data.

Montana has a population of approximately 1.1 million, so a 50,000-consumer threshold covers roughly 4.5% of the state's residents. There is no standalone revenue floor, meaning businesses of any size that meet the data volume thresholds must comply — unlike Utah's law, which requires $25 million annual revenue.

Your Rights Under the MCDPA

Montana residents have five enforceable data privacy rights under the MCDPA:

Controllers covered by the MCDPA must respond to authenticated consumer rights requests within 45 days, extendable by an additional 45 days with proper advance notice. Consumers may submit requests free of charge; businesses may charge a reasonable fee for manifestly unfounded or excessive requests. Retaliation for exercising privacy rights is explicitly prohibited.

Montana's Expanded Protections for Teenagers

One of the most concrete differences in Montana's MCDPA is its treatment of data related to consumers between ages 13 and 16. Under the MCDPA, personal data of individuals known to be in this age range is classified as sensitive data, requiring opt-in consent before processing for targeted advertising and data sales.

Most state privacy laws draw the sensitive-data line at age 13 — the threshold established by the federal Children's Online Privacy Protection Act (COPPA). Montana goes further, treating 14-, 15-, and 16-year-olds' data as sensitive. Businesses cannot sell the personal data of 13-to-16-year-old Montana residents or use it for targeted advertising without first obtaining their affirmative consent.

How the MCDPA Compares to CCPA

What Data Brokers Must Do Under the MCDPA

Data controllers covered by Montana's MCDPA must fulfill these compliance obligations:

• Publish a clear, accessible privacy notice describing the categories of personal data processed, the purposes of processing, consumer rights and how to exercise them, the categories of data shared with third parties, and whether personal data is sold or used for targeted advertising.
• Honor universal opt-out signals including browser-based signals like the Global Privacy Control. When a consumer uses a browser or device with a recognized opt-out signal, covered Montana businesses must treat it as a valid opt-out of data sales and targeted advertising.
• Obtain opt-in consent before processing sensitive data, including data concerning racial or ethnic origin, religious beliefs, mental or physical health, sexual orientation, citizenship status, biometric data, precise geolocation, and — uniquely — personal data of individuals known to be between 13 and 16 years of age.
• Conduct data protection assessments for high-risk processing activities, including targeted advertising, sale of personal data, and profiling for significant decisions. These assessments must be made available to the Montana AG upon request.
• Process deletion requests within 45 days and instruct processors to delete the same personal data. Standard exceptions apply for legal compliance, ongoing transactions, and security purposes.
• Provide an appeals mechanism for denied consumer requests. If an appeal is denied, the controller must provide information about how the consumer can submit a complaint to the Montana Attorney General.

Step-by-Step: How to Submit an MCDPA Deletion Request

1. 1. Enable Global Privacy Control in your browser. Montana businesses must honor universal opt-out signals. Enable GPC in Firefox (Settings > Privacy and Security > Tell websites not to sell or share my data) or use Brave, which enables GPC by default. Your browser will automatically assert opt-out rights on covered sites.
2. 2. Find the data broker's privacy notice. Check the site footer for "Privacy Policy," "Montana Privacy Rights," or "Your Privacy Rights." The MCDPA requires this to be clearly accessible. If you cannot locate it, search "[company name] Montana privacy request" or "[company name] opt out."
3. 3. Submit your deletion request. Use the company's designated request mechanism — web form, email, or phone. State that you are a Montana resident exercising your rights under the Montana Consumer Data Privacy Act. Request deletion of all personal data the company holds about you and opt out of data sales and targeted advertising.
4. 4. Respond to any identity verification request. The company may ask you to verify your identity before processing. Provide the requested information promptly. Companies cannot require you to create a new account solely to submit a privacy rights request.
5. 5. Track the 45-day response window. Keep a record of your submission date and any confirmation number or email. If the company extends the response period, they must notify you within the initial 45-day window and provide a reason for the extension.
6. 6. Appeal or escalate if necessary. If your request is denied, submit a formal appeal through the controller's appeals process. If the appeal is denied, file a complaint with the Montana Attorney General at dojmt.gov. The Montana AG has authority to seek civil penalties up to $7,500 per violation.

The Bigger Picture: State Laws Keep Multiplying

Montana's MCDPA is one of more than 20 state privacy laws now on the books, alongside Virginia, Colorado, Connecticut, Utah, Oregon, Texas, New Jersey, Delaware, and others. As of 2026, the count keeps climbing.

The practical consequence for data brokers is a patchwork of state rules, each with different thresholds, rights, and penalties. Most large brokers have responded by simply honoring deletion requests from all US residents, not just people in states with specific laws. Verifying state residency on every incoming opt-out request creates more legal exposure than just complying across the board.

For Montana residents, that means state law gives you real leverage — but the practical benefits go further than Montana's specific protections. An authorized agent service like GhostVault invokes CCPA and applicable state laws simultaneously, so Montana residents can use California's broader deletion scope while also asserting Montana's stronger teenager protections and universal opt-out requirements. Learn more about California's CCPA or start automated data removal with GhostVault.

Frequently Asked Questions