Montana Consumer Data Privacy Act (MCDPA) Compliance

What is MCDPA?

The Montana Consumer Data Privacy Act (MCDPA) is Montana’s comprehensive consumer privacy law. It was signed on May 19, 2023 as Senate Bill 384, and it was substantially amended in 2025 by Senate Bill 297, which lowered its thresholds, strengthened protections for minors, and removed its cure period.

Under the MCDPA, Montana consumers have the right to:

• Confirm whether a business processes their personal data and access it
• Correct inaccuracies in their personal data
• Delete personal data provided by or obtained about them
• Obtain a portable copy of the personal data they provided
• Opt out of targeted advertising, the sale of their personal data, and profiling that produces legal or similarly significant effects

The law also defines sensitive data, which includes racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, precise geolocation, and personal data collected from a known child. Since the 2025 amendments, businesses also have added duties toward consumers they know are under 18, including getting consent before using their data for targeted advertising or selling it.

What happens if I don’t comply with the MCDPA?

The Montana Attorney General enforces the MCDPA. The main points are:

• No cure period: the 2025 amendments removed the 60-day cure period from October 1, 2025, so the Attorney General can bring an action without first offering a chance to fix the problem.
• Penalties: the Attorney General may seek civil penalties of up to $7,500 for each violation.
• No private right of action: consumers cannot sue a business directly under the law. They can file a complaint with the Attorney General.

Complying with the MCDPA

If the MCDPA applies to your online store, the work that matters most for cookies and tracking looks like this:

1. Offer an opt-out of targeted advertising and sale. Advertising pixels and tags that track visitors across other websites are typically targeted advertising. If you sell personal data or use it for targeted advertising, you must clearly disclose this and explain how consumers can opt out. A visible opt-out link and a cookie banner with clear choices are the usual way to do this. You must also honor universal opt-out signals such as Global Privacy Control.
2. Get opt-in consent for sensitive data. You must not process sensitive data, such as precise geolocation, without the consumer’s consent. Data collected from a known child must be handled under the federal Children’s Online Privacy Protection Act. For consumers you know are under 18, you also need consent before targeted advertising or selling their data.
3. Publish a clear privacy notice. It must describe the categories of personal data you process, why you process it, the categories you share with third parties, and how consumers can exercise their rights and appeal your decisions.
4. Handle consumer requests on time. Provide at least one secure and reliable way to submit requests, without requiring a new account. Respond within 45 days, extendable once by another 45 days when reasonably necessary, and answer appeals within 60 days.
5. Keep collection to what you need. Limit personal data to what is adequate, relevant, and reasonably necessary for the purposes you disclose, and protect it with reasonable security practices.

To make this easier, consider a Consent Management Platform (CMP) like Pandectes GDPR Compliance. It is built for Shopify stores and provides a cookie banner with opt-out options for US states, a “Do not sell or share my personal information” link, automatic cookie scanning and classification, a cookie declaration, consent logs, and data subject request handling. Region-specific banner settings let you show Montana visitors the right experience based on their location.

Every business is different, so review your obligations under the MCDPA with legal counsel where appropriate.