Montana Privacy Amendment on Notices: What to Change by Oct 1

The Montana Consumer Data Protection Act (MTCDPA), Montana’s privacy law, was amended by SB 297, taking effect on October 1, 2025. The amendments raise the bar for privacy notices, requiring clearer explanations of consumer rights, visible update dates, accessibility for people with disabilities, language coverage to match what a business offers, and explicit privacy and opt-out links on homepages.

The MTCDPA applies to businesses that conduct business in Montana or target Montana residents, meet specific revenue/data processing thresholds (now lower, e.g., 25,000 consumers if 25% revenue from data sales), and control or process personal data.

The Montana Attorney General is accountable for enforcing MTCDPA. The Montana Attorney General is required by the MTCDPA to give a controller sixty (60) days' written notice of a violation before initiating an action. The controller has sixty (60) days to address the claimed violations. The Montana Attorney General may initiate an action against the controller if the situation is not resolved. On April 1, 2026, the right to cure clause expires.