Montana Consumer Data Privacy Act (MCDPA)
A practical compliance guide for website owners. Learn what Montana's privacy law requires and how to implement it on your site.
Who Must Comply
Conducts business in Montana or targets Montana residents AND controls/processes personal data of 25K+ consumers in a calendar year, OR controls/processes data of 15K+ consumers and derives 25%+ of gross revenue from selling personal data. SB 297 (1 Oct 2025) lowered both thresholds and narrowed the entity-level exemption for GLBA-covered financial institutions.
What Your Website Must Do
| Requirement | Status |
|---|---|
| Cookie consent banner | Recommended |
| Do Not Sell link | Required |
| Do Not Share link | Required |
| Honor GPC browser signals | Required |
| Universal opt-out mechanism | Required |
| Sensitive data opt-in consent | Required |
Checked against the MCDPA on August 29, 2026. Read the source This is a summary, not legal advice.
Required Links & Notices
The MCDPA requires the following links or notices to be visible on your website:
- 1Do Not Sell My Personal Data
- 2Privacy Policy
Enforcement & Penalties
Key Things to Know
The Montana Consumer Data Privacy Act (MCDPA) has applied in Montana since October 1, 2024.
Who it covers: Conducts business in Montana or targets Montana residents AND controls/processes personal data of 25K+ consumers in a calendar year, OR controls/processes data of 15K+ consumers and derives 25%+ of gross revenue from selling personal data. SB 297 (1 Oct 2025) lowered both thresholds and narrowed the entity-level exemption for GLBA-covered financial institutions.
Do Not Sell and opt-out rights: residents may opt out of the sale of their personal data and opt out of targeted advertising. MCDPA expects the choice to be reachable from your site under the heading “Do Not Sell My Personal Data”, and you may not degrade the service of someone who exercises it.
Global Privacy Control: MCDPA requires you to honour a universal opt-out mechanism sent by the visitor’s browser. A GPC signal has to be treated as the opt-out itself — not as a request to show someone a banner — and it applies to that browser without any further action from the person.
Cookie banner: MCDPA is an opt-out law, so it does not require the opt-in banner the GDPR does. What it does require is that the tracking you run for advertising can be switched off on request, which in practice means a preference control that actually blocks tags rather than a notice that only records a click. Sensitive data is the exception: that needs consent before you process it.
Recently amended. MCDPA changed on October 1, 2025. The summary above reflects the amended law.
Enforcement: Up to $7,500 per violation. The guaranteed 60-day cure period was removed by SB 297 on 1 Oct 2025; the Attorney General may act without offering one. Enforced by the Montana Attorney General.
How to Configure LegalBanner for MCDPA
- 1
Create your site
Sign up for free and add your website domain in the dashboard.
- 2
Set consent mode to "Opt-out"
In Settings, select the consent mode that matches Montana's requirements.
- 3
Install the snippet
Add the one-line script tag to your website. The banner, opt-out links, and GPC support are automatic.
- 4
Generate your Privacy Policy
Use the built-in policy wizard to generate a MCDPA-compliant privacy policy.
Set up MCDPA compliance in 5 minutes
LegalBanner handles Montana privacy requirements automatically — cookie banner, opt-out links, and GPC support included.
Frequently Asked Questions
Why does Montana have a lower threshold than other states?
Montana has about 1.1 million residents, much smaller than states like California or Texas. The 50,000 consumer threshold is proportionally equivalent to other states' 100,000 thresholds, ensuring the law covers a meaningful portion of businesses.
Does Montana require honoring GPC signals?
Yes. The MCDPA requires businesses to recognize and honor universal opt-out mechanisms, including Global Privacy Control (GPC) browser signals.
Does Montana require a cookie consent banner?
The MCDPA does not require opt-in cookie consent. You must provide clear opt-out mechanisms for targeted advertising and sale of personal data.
What are the penalties for MCDPA violations?
Up to $7,500 per violation. The Montana AG must provide a 60-day cure period before enforcement.
When did the Montana privacy law take effect?
The Montana Consumer Data Privacy Act took effect October 1, 2024. Businesses should already be in compliance.