Laws

Montana Consumer Data Privacy Act (MCDPA): rights, opt-out signals and the 2025 changes

Quick answer

Montana's Consumer Data Privacy Act lets you ask a covered company to show you, correct or delete personal data about you, including data it got from other sources, and to stop selling it or using it for targeted ads or significant automated decisions. Since January 1, 2025 companies must honor opt-out signals such as Global Privacy Control, and after 2025 amendments the law reaches businesses with data on as few as 25,000 Montanans. A company has 45 days to answer; if it refuses, appeal first, then complain to the Montana Attorney General.

“A consumer must have the right to: ... delete personal data about the consumer;”

All privacy laws
Applies in
Montana
In force since
Companies must answer within
Without undue delay and within 45 days of receiving your request. The company can extend by 45 more days if it tells you why within the first 45 days (Mont. Code Ann. § 30-14-2808(4)). Appeals get a written decision within 60 days (§ 30-14-2808(5)). Opt-out requests don't need identity checks.
Regulator
Montana Department of Justice, Office of Consumer Protection
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: mca.legmt.gov, archive.legmt.gov, dojmt.gov

Last verified against the official page:

How we research this Report an error

Montana residents. The law applies to companies that do business in Montana or target Montanans and handle the personal data of at least 25,000 Montana consumers (not counting data used only to complete a payment), or of at least 15,000 while making more than 25% of gross revenue from selling personal data. Some duties to protect minors apply to any business, whatever its size. Government bodies, colleges, banks and credit unions, insurers, HIPAA covered entities and national securities associations are exempt, and so is data covered by the Gramm-Leach-Bliley Act, HIPAA and the Fair Credit Reporting Act.

Your rights

  • Confirm and access

    Ask a company whether it processes your personal data, and see it, unless that would reveal a trade secret. The company won't show you identifiers such as your Social Security number, account numbers or passwords, but must confirm whether it collected them (Mont. Code Ann. § 30-14-2808(1)(a), (6)).

  • Correct

    Have inaccurate personal data fixed (Mont. Code Ann. § 30-14-2808(1)(b)).

  • Delete

    Have a company delete personal data about you, not only data you gave it. If it got your data from another source, it can comply by keeping a minimal record so the data stays deleted, or by opting you out of its non-exempt processing (Mont. Code Ann. § 30-14-2808(1)(c), (4)(e)).

  • Get a portable copy

    Get a portable copy of the data you gave the company (Mont. Code Ann. § 30-14-2808(1)(d)).

  • Opt out

    Stop the company using your data for targeted advertising, selling it, or profiling you for automated decisions with legal or similarly significant effects (Mont. Code Ann. § 30-14-2808(1)(e)).

  • Opt-out signal and authorized agent

    Name someone to opt out for you, including through an opt-out preference signal such as Global Privacy Control, which companies must honor since January 1, 2025 (Mont. Code Ann. § 30-14-2809).

  • Appeal

    Appeal a refusal. The company must answer in writing within 60 days and, if it still says no, give you a way to complain to the Attorney General (Mont. Code Ann. § 30-14-2808(5)).

  • Consent for sensitive data and teens

    A company needs your consent to process sensitive data about you, and consent before it uses the data of a known 13 to 15-year-old for targeted ads or sells it (Mont. Code Ann. § 30-14-2812(2)).

General information, not legal advice.

How to use it

  1. 1

    Turn on an opt-out preference signal

    For targeted ads and sales, switch on Global Privacy Control in a browser or extension that supports it. Since January 1, 2025 companies must treat it as your opt-out.

  2. 2

    Find the privacy rights link or privacy notice

    A company that sells data or uses it for targeted ads must offer a clear opt-out method outside its privacy notice. The notice itself must list your rights and an email address or other contact method.

  3. 3

    Send your request

    Say which right you're using: access, correction, deletion, a copy or an opt-out. A line like "Under the Montana Consumer Data Privacy Act, please delete the personal data you hold about me, including data you obtained from other sources" is enough to start.

  4. 4

    Wait up to 45 days

    The company must respond within 45 days, or tell you within that time that it needs 45 more and why.

  5. 5

    Appeal if the company refuses

    Use the company's appeal process. It must decide in writing within 60 days and, if it still says no, give you a way to contact the Attorney General.

  6. 6

    Complain to the Montana Attorney General

    The law requires the Attorney General to offer an online way to complain about consumer data privacy. Start from the Department of Justice's Montana consumer data privacy page. Only the Attorney General enforces the law: you can't sue a company under it yourself.

No answer in time? Complain to Montana Department of Justice, Office of Consumer Protection .

Who has to follow the MCDPA

Montana's law dates from 2023 and, according to the Montana Department of Justice, took effect on October 1, 2024. Amendments passed in 2025 (Senate Bill 297) lowered the thresholds. A company that does business in Montana or targets Montanans is now covered if it handles data on 25,000 Montana consumers, or 15,000 if more than 25% of its revenue comes from selling personal data. That's a low bar. Virginia starts at 100,000, as do Iowa and Indiana.

Deletion reaches data a company bought

The right is to delete "personal data about the consumer", so it isn't limited to what you gave a company. That matters for data brokers, which mostly hold data they got elsewhere. A broker in that position can keep a minimal record of you so the data isn't added back, or opt you out of all its non-exempt processing.

Global Privacy Control

Since January 1, 2025, companies must let you opt out of targeted ads and sales through an opt-out preference signal sent with your consent. The signal can't be switched on by default, and if it conflicts with a setting you chose on a company's site or a loyalty program, the signal wins.

Why a company can say no

Government bodies and colleges are exempt. So are banks and credit unions. Insurers and HIPAA covered entities are exempt too, and so is data covered by the Gramm-Leach-Bliley Act (GLBA), HIPAA (health) and the Fair Credit Reporting Act (credit reports).

If a company cites one of these, that's the likely reason for a refusal. Appeal, and complain to the Attorney General if you think it's wrong. Our guide on what to do when a company won't delete your data covers the next steps.

Where Serus fits

Montana's rights are broad, and GPC handles the opt-outs, but deletion still means finding and writing to each company that holds your data. Serus finds the data brokers that operate where you live, sends the deletion requests and checks whether your data reappears. You can do the same yourself for free with the steps above.

Data brokers that list people in United States

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Related

Frequently asked

Does the Montana law apply to small businesses?

More of them than before. Since the 2025 amendments it covers businesses handling data on 25,000 Montana consumers, or 15,000 if more than 25% of their revenue comes from selling data. Some duties to protect minors apply regardless of size.

Do businesses have to honor Global Privacy Control in Montana?

Yes. Opt-out preference signals must be honored since January 1, 2025.

Can I delete data a company bought about me?

Yes. The right covers "personal data about the consumer", not just data you provided.

Can I sue under the MCDPA?

No. The Attorney General has exclusive authority and the law gives you no right to sue.

What penalties apply?

Civil penalties of up to $7,500 per violation, plus injunctions and attorney fees.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.