Consumer Data Privacy
Montana Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines
What Montana’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed July 2026.
What You Need to Know
Montana's law is one of the more consumer-friendly laws in the country. Montana was the first state to lower the applicability threshold from 100,000 to 50,000 consumers. It was also the first Republican state to require controllers to recognize universal opt-out mechanisms, and one of the first to include heightened protections for children's data. Montana's law was amended in 2025 to add protections for minors' personal data (including a duty of care), to lower the applicability threshold, and to narrow exemptions, including the GLBA entity-level exemption.
Official law text
Who the law applies to
| Threshold | Requirement |
|---|---|
| Main Provisions | |
| Annual gross revenue | N/A |
| Consumers whose data is processed | 25,000 consumers 2.3% of state's 1.08 million population |
| Revenue from sale of personal data | Derives more than 25% of gross revenue from sale of personal data and controls or processes personal data of not less than 15,000 consumers. |
| Children's Privacy Provisions | |
| Annual gross revenue | – |
| Consumers whose data is processed | – |
| Revenue from sale of personal data | – |
| Other conditions |
|
Consumer rights under Montana's law15
| Right | Provided? |
|---|---|
| Know | Yes |
| Access | Yes |
| Obtain list of third parties to which personal data was disclosed | No |
Data portabilitynoteRight applies only to data provided by the consumer to the controller. | Partial |
| Delete | Yes |
| Correct inaccuracies | Yes |
| Not be discriminated against for exercising rights | Yes |
| Opt-out of sale | Yes |
| Opt-out of targeted advertising/sharing | Yes |
| Opt-out of certain types of profiling | Yes |
| Opt-out of ADMT | No |
| Recognize opt-out signals | Yes |
| Revoke consent | Yes |
| Not process data in discriminatory manner | No |
| Appeal | Yes |
Categories treated as sensitive data10
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Mental or physical health condition
- Sexual orientation
- Sex life
- Citizenship or immigration status
- Genetic or biometric data for purposes of uniquely identifying an individual
- Personal data of known child
- Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.
How sensitive data must be treated2
- Obtain Consent to Process
- Conduct Data Protection or Risk Assessment
Requirements for minors' data3
- Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent
- Opt-in for selling or sharing of personal data of children ages 13-15
- Opt-in to sell personal data, engage in targeted advertising, or profile for consequential decisions for children under 18
Activities that trigger a risk or impact assessment6
- Targeted advertising (“sharing”)
- Sale of personal data
- Processing of sensitive data
- Processing personal data for purposes of profiling where it presents reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial, physical, or reputational injury to consumers; physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; other subject injury to consumers
- Any processing activities involving personal data that present a heightened risk of harm to consumers
- Processing personal data of minors (under 18 years of age) in a manner that presents reasonably foreseeable risk that could cause: (1) unfair or deceptive treatment of, or unlawful disparate impact on, minors; (2) financial, physical, or reputational injury to minors; (3) unauthorized disclosure of personal data of minors as result of security breach, as defined in state law; or (4) physical or other intrusion upon solitude or seclusion, or private affairs or concerns, of minors if intrusion would be offensive to reasonable person
Other notable provisions8
- Definition of “Sale” Includes “Other Valuable Consideration”
- Applies to Nonprofits
- Data Processing Agreements
- Privacy Policy
- Implement Reasonable Data Security Measures
- Duty to Avoid Secondary Use
- Data Minimization
- Attorney General Enforcement
Key dates1
| Date | What happens |
|---|---|
| October 1, 2024 | Montana's consumer data privacy law takes effect |
Questions about Montana’s privacy law?
Stauss PLLC advises companies on state privacy, AI, and data broker compliance.
Contact Stauss PLLCThis page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.