Montana Consumer Data Privacy Act (MCDPA), publicly available information exemption

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 12 months, effective 1 October 2025.

A personal data rule binding private bodies.

As of 29 August 2026.

What it requires

Personal data that is lawfully made available through a government record or widely distributed media, or that a controller reasonably believes a consumer lawfully made public, falls outside the MCDPA's definition of personal data.
Check the Act's current, lower thresholds (25,000 consumers, or 15,000 with more than 25% of revenue from data sales) as amended by SB 297 in 2025; the original 2023 thresholds were roughly double these and no longer apply.
Cite this Act's origin as Senate Bill 384 (2023), Chapter 681, never House Bill 351, which is an unrelated, unenacted marijuana bill.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 30-14-2802(26) excludes de-identified data and publicly available information from personal data, defined as information lawfully made available through government records or widely distributed media, or that a controller has a reasonable basis to believe a consumer lawfully made public. This is the ordinary, unqualified exemption, with no biometric carve-back of the kind Maryland's MODPA carries.

The Act was enacted as Senate Bill 384 (2023 Regular Session), Chapter 681, Laws of 2023, per Montana's Senate-Bill-to-Chapter-Number-2023 record and every codified section's History line.

Section 30-14-2803, as amended by Senate Bill 297 (2025 Regular Session, Chapter 567), lowered the Act's applicability thresholds to a person controlling or processing personal data of at least 25,000 consumers, or 15,000 consumers while deriving more than 25% of gross revenue from selling personal data, roughly half the original 50,000 and 25,000 thresholds, and eliminated the prior notice-and-cure period for enforcement.

The 2023 Act's October 1, 2024 effective date and SB 297's October 1, 2025 effective date for its amendments are as reported consistently by secondary trackers; the enrolled session-law texts have not been located. Enforcement is by the Montana Attorney General; there is no private right of action.

When LexLint raises it

crawls_web
trains_models
processes_biometrics

Read the law

official code text, Montana Code Annotated (mca.legmt.gov)
the enacting and amending bill numbers are confirmed against Montana's own Senate-Bill-to-Chapter-Number-2023.pdf and House-Bill-to-Chapter-Number-2023.pdf (archive.legmt.gov); the effective dates rest on secondary trackers, not an independently confirmed primary session-law text

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app