Montana Privacy Law (MCDPA): Compliance Guide
The Montana Consumer Data Privacy Act, effective October 1, 2024, applies to far more businesses than you would expect from a small state — its 50,000-consumer threshold is half the usual bar. And it holds the strictest teen privacy rule in America: for users aged 13 to 16, selling personal data or using it for targeted advertising requires opt-IN consent, which means real age-verification mechanics, not just a footer link. GPC has been mandatory since January 1, 2025.
- Effective
- October 1, 2024
- GPC / universal opt-out
- Required since January 1, 2025
- Required link text
- “Your Privacy Choices”
Last reviewed July 19, 2026 · Montana Consumer Data Privacy Act (MCDPA)
Applicability
Who must comply with the MCDPA
The Montana Consumer Data Privacy Act applies to businesses that meet the following criteria:
- Controls or processes the personal data of 50,000 or more Montana consumers, or
- Controls or processes the personal data of 25,000 or more Montana consumers and derives 25% or more of gross revenue from the sale of personal data
Consumer rights
What Montana consumers can demand
- Right to access personal data
- Right to delete personal data
- Right to data portability
- Right to opt out of the sale of personal data and targeted advertising
Opt-out mechanics
Montana opt-out & GPC requirements
Like every US state privacy law, the MCDPA uses an opt-out model: you do not need a GDPR-style cookie banner, but you must provide a clear and conspicuous opt-out link. The accepted text for Montana is “Your Privacy Choices”.
Global Privacy Control: Required since January 1, 2025
Montana requires covered businesses to honor universal opt-out mechanisms such as Global Privacy Control. The requirement has been in force since January 1, 2025.
Enforcement
MCDPA penalties & enforcement
- Enforced by the Montana Attorney General
- Standard violation penalties under state law
Cure period: Our reference lists no specific cure period for Montana; enforcement runs through the Montana Attorney General.
State quirks
What makes Montana different
Montana's identity is minor protection. It is the only state with a hard opt-in requirement for teens: ages 13 to 16 must affirmatively consent before their data is sold or used for targeted advertising, and businesses need age-verification mechanisms to honor that — COPPA's parental-consent rule covers under-13s. The 50,000-consumer threshold is half what most states demand, and the 25% revenue-from-sales trigger on the 25,000 prong is low as well. GPC has been required since January 1, 2025, just three months after the law took effect.
Ages 13–16 require opt-IN
The strictest teen rule in America: for consumers aged 13 to 16, selling personal data or using it for targeted advertising requires opt-in consent — not a mere opt-out option.
Under 13
COPPA's verifiable parental consent requirement applies.
Age verification
Businesses must implement age verification mechanisms to make the teen opt-in rule work in practice.
Lower coverage threshold
50,000 consumers — half the usual 100,000 bar — brings many more businesses into scope.
Automation
How ConsentKit handles Montana
- ConsentKit's widget is served from Cloudflare's edge and receives the visitor's US state server-side, so Montana visitors are identified before any consent UI renders — no client-side geo-lookup delay.
- Montana visitors see a persistent “Your Privacy Choices” link — the exact statutory text — available to new and returning visitors alike.
- Because Montana requires universal opt-out signals, ConsentKit automatically honors Global Privacy Control for Montana visitors: when the browser broadcasts GPC, the widget applies the opt-out and denies analytics and marketing categories with no click required.
- Every opt-out is recorded server-side with a timestamp and jurisdiction metadata, reviewable and exportable (CSV) from the dashboard — the audit trail regulators ask for.
- Google Consent Mode v2 stays in sync: analytics and advertising tags update the moment a Montana visitor makes a choice.
Montana's 13–16 opt-in rule needs age awareness that your own site must supply; ConsentKit's state map flags Montana's minor opt-in status and handles the GPC mandate automatically.
FAQ
Montana MCDPA FAQ
What is Montana's teen opt-in rule?
The strictest minor-protection rule in the country: for consumers aged 13 to 16, businesses must obtain opt-in consent before selling personal data or using it for targeted advertising — a simple opt-out link is not enough. Under 13, COPPA's parental-consent rule applies. Businesses need age-verification mechanisms to make this work.
Does the MCDPA apply to my business?
More likely than you might think: the threshold is 50,000 Montana consumers — half the usual bar — or 25,000 consumers when 25% or more of gross revenue comes from selling personal data.
Is Global Privacy Control required in Montana?
Yes, since January 1, 2025 — just three months after the law itself took effect. Covered businesses must honor universal opt-out mechanisms for Montana visitors.
What rights do Montana consumers have?
Montana consumers can access and delete their personal data, obtain a portable copy of it, and opt out of the sale of their personal data and targeted advertising.
This guide is for informational purposes and is not legal advice. Work with qualified counsel to confirm your obligations under the MCDPA.
Comply with Montana's MCDPA — and the other 19 state laws
ConsentKit detects each visitor's state at the Cloudflare edge, renders the exact opt-out link their law requires, honors GPC automatically where mandated, and records every choice for your audit trail.