Does Montana's Consumer Data Privacy Act apply to your business?

Montana's Consumer Data Privacy Act took effect on October 1, 2024, but the version that matters now is the one amended by SB 297, which took effect on October 1, 2025. That amendment lowered the thresholds enough that many businesses which were safely outside the original law are now inside it. If you looked at Montana a year ago and moved on, it is worth looking again.

Who the Montana Consumer Data Privacy Act covers

Under Mont. Code Ann. 30-14-2803, the law applies to a person conducting business in Montana, or targeting products or services to Montana residents, that controls or processes the personal data of at least 25,000 consumers, or controls or processes the personal data of at least 15,000 consumers and derives more than 25 percent of gross revenue from the sale of personal data. Data controlled or processed only to complete a payment transaction is excluded from the 25,000 count. A consumer means a Montana resident acting in a personal capacity, so your employees and business contacts do not count.

What SB 297 changed

The original 2023 law used a 50,000-consumer threshold and a 25,000-consumer data-sales prong, in line with Virginia. SB 297 cut those to 25,000 and 15,000, removed the 60-day cure period that once let businesses fix violations before enforcement, and made the provisions on processing minors' data apply to any business targeting Montana residents, whatever its volume. The practical effect is a wider net and less room for error.

Who is carved out

Section 30-14-2804 exempts state bodies and political subdivisions, national securities associations, chartered banks and credit unions, GLBA financial data, HIPAA covered entities and business associates, insurers and insurance producers, and institutions of higher education. Note what is missing: there is no general nonprofit exemption. Only a nonprofit established to detect and prevent insurance fraud is exempt, so most nonprofits that meet the thresholds are covered.

What covered businesses owe

Covered controllers publish a privacy notice, honor consumer rights to access, correct, delete, and port data, and let consumers opt out of targeted advertising, sale, and certain profiling, including through a universal opt-out signal. Montana requires opt-in consent before processing sensitive data. The low thresholds put Montana closer to Oregon's OCPA and the amended Connecticut Data Privacy Act in reach than to the larger states. To place its 25,000 and 15,000 figures next to every other state, see the privacy thresholds by state comparison, or the US state privacy laws hub.

Next step

Because Montana now counts a much smaller number of people, businesses that never had to think about it may be covered for the first time. The free 2-minute Obligation Scan runs the current 30-14-2803 thresholds against your business and flags the notice, consent, and opt-out duties that follow, so you spend your time on the obligations rather than the arithmetic.