Law / United States / 
Montana
Montana Consumer Data Privacy Act (MCDPA), general applicability and controller/processor duties
Mont. Code Ann. §§ 30-14-2803, 30-14-2811, 30-14-2813
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- on_request
- Who audits it
- Independent third party
- Where the report goes
- Produced on request
What it requires
- Confirm you meet MCDPA's applicability thresholds under the current, S.B. 297-amended text rather than the original 2023 thresholds; the 2025 amendment lowered them.
- Apply MCDPA's minors' privacy provisions, added by S.B. 297, to any known child's personal data you process for a Montana consumer.
These lines are LexLint's reading of the law's text. Also read by: Montana Department of Justice, Office of Consumer Protection (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://doj.mt.gov/office-of-consumer-protection/montana-consumer-data-privacy/
- Guidance body
- Montana Department of Justice, Office of Consumer Protection
- Open questions
- What makes a product or service "intentionally targeted to residents of this state" under section 30-14-2803(2), which applies sections 30-14-2811, 30-14-2818 and 30-14-2819 to a person that delivers it?
What it makes you log
Who may demand the log
Counterparty
Logging duty
Section 2813(2)(c) requires a processor, on the controller's reasonable request, to make available all information in its possession necessary to demonstrate its compliance, which cannot be done without a kept record, and section 2813(1)(c) has the processor supply what the controller needs to conduct and document data protection assessments. Section 2813(2)(e) lets the controller or its designated assessor assess the processor, or the processor arrange a qualified and independent assessor, with a report to the controller on request. The text names no log contents, no retention period and no public access. Section 2811, the minors' duty of care, states no record, and section 2803 sets applicability. The controller's own duty to conduct and document assessments is in section 30-14-2814, which this row does not cite and is not borrowed. The controller's designated assessor is the other audit route and the vocabulary has no value for it, so only the independent route is listed.
- Kind
- Implicit
- As of
- Provision
- 30-14-2813(2)(c) and (e) (a processor makes available the information needed to demonstrate compliance and allows assessments, with a report to the controller on request)
- Trigger
- personal_data_processing
What this law does
MCDPA governs private-sector processing of Montana consumers' personal data. Originally enacted as Senate Bill 384 (2023 session), chapter 681 of the 2023 Laws of Montana. It took effect on . Substantially amended by S.B. 297 (2025 session), 2025 Mont. Laws ch. 567, signed , effective , which lowered applicability thresholds, added minors' privacy provisions, and added privacy-notice content requirements.
General applicability is set at section 30-14-2803, controller duties at section 30-14-2811 and processor duties at section 30-14-2813.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .