{ "jurisdiction_id": "US-MT", "jurisdiction": "United States – Montana", "url": "https://dataprotection.gi/jurisdictions/united-states-montana/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-06", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 38, "sub_modules": 57, "source_register": 10 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/united-states-montana/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Core omnibus instrument is in force with a clear regulator and settled scope; only the registration/filing sub-module is unpopulated.", "claims": [ { "statement": "The Montana Attorney General has exclusive authority to enforce the provisions of the Montana Consumer Data Privacy Act.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The Montana Consumer Data Privacy Act came into effect on October 1, 2024, after being signed by the Governor of Montana in May 2023.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/montana-mtcdpa-comes-effect", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Senate Bill 297 revises portions of the Montana Consumer Data Privacy Act and is effective October 1, 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "\"Personal data\" means any information that is linked or reasonably linkable to an identified or identifiable individual and does not include de-identified data or publicly available information.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The Act applies to those that conduct business in Montana or deliver commercial products/services intentionally targeted at Montana residents and that control or process the personal data of not less than 25,000 consumers (formerly 50,000), or of 25,000 consumers deriving more than 25% of revenue from data sales.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/united-states-montana/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Consent and sensitive-data protections exist but the regime lacks a GDPR Art 6-equivalent enumerated lawful-basis structure.", "claims": [ { "statement": "Controllers must not process personal data for purposes that are neither reasonably necessary to, nor compatible with, the disclosed purposes for which the personal data is processed unless the controller obtains the consumer's consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Controllers must provide an effective mechanism for a consumer to revoke consent that is at least as easy as the mechanism used to grant consent, and must cease processing the personal data no later than 45 days after receipt of the revocation request.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A controller may not process personal data for targeted advertising or sell a consumer's personal data without consent when it has actual knowledge that the consumer is at least 13 but younger than 16 years of age.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Sensitive data means personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, or genetic/biometric data processed for the purpose of uniquely identifying an individual.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Personal data excludes de-identified data, and data protection assessments must factor in a controller's use of de-identified data as a risk-mitigating circumstance.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "green", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/united-states-montana/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "The rights catalogue and response-deadline framework are clear, consistent, and in force.", "claims": [ { "statement": "Montanans have a right to know what personal data is collected and processed about them.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers have a right to correct inaccuracies in their personal data and a right to delete personal data about the consumer.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers have the right to opt out of the sale of personal data, use of personal data for targeted advertisements, or use of personal data for profiling purposes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers have a right to obtain a copy of the consumer's personal data from the controller.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Controllers must respond to consumer requests without undue delay and no later than 45 days after receipt, extendable by an additional 45 days when reasonably necessary, provided the consumer is informed of the extension within the original 45-day period.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Information provided to consumers in response to rights requests must be provided free of charge up to once during any 12-month period per consumer.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/united-states-montana/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Security, DPIA and breach-notification duties are robust and in force, but the regime omits GDPR-equivalent DPO and ROPA obligations.", "claims": [ { "statement": "Controllers must conduct a data protection assessment for processing activities that present a heightened risk of harm to a consumer, applicable to processing activities created or generated after January 1, 2025, and not applied retrospectively.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Data protection assessments must identify and weigh the direct and indirect benefits of processing against potential risks to consumer rights, factoring the use of de-identified data, reasonable consumer expectations, and the controller-consumer relationship.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "A contract between a controller and a processor must satisfy the requirements of MCA §30-14-2813, and a processor must adhere to controller instructions and assist the controller in meeting its MTCDPA obligations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The MTCDPA imposes an obligation on controllers to establish, implement, and maintain reasonable administrative, technical, and physical data security practices.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/montana-mtcdpa-comes-effect", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Montana statutes governing data breaches require businesses to notify affected Montana residents without reasonable delay, and any business required to issue such a notice must simultaneously submit an electronic copy of the notice to the AG's Office of Consumer Protection.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/reporting-requirements-for-data-breaches/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Controllers must limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the disclosed purposes of processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "red", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/united-states-montana/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "No comprehensive cross-border transfer regime exists in this jurisdiction at the state level.", "claims": [] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/united-states-montana/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Sectoral carve-outs are well-documented for financial services, health and credit reporting, but telecoms/ePrivacy and education overlays are unconfirmed.", "claims": [ { "statement": "SB 297 eliminates the Gramm-Leach-Bliley Act entity ('financial institution') exemption but keeps the GLBA data-level exemption, and adds exemptions for banks, credit unions, insurers, and insurance producers.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Health-care-related information, including information derived from HIPAA-covered sources and de-identified in accordance with HIPAA privacy regulations, is exempt from the MTCDPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The Act defines 'consumer' to exclude individuals acting in a commercial or employment context whose communications or transactions with the controller occur solely within that role.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Personal information bearing on a consumer's creditworthiness that is regulated by and authorized under the Fair Credit Reporting Act is exempt from the MTCDPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "SB 297 limits the nonprofit exemption to nonprofit organizations that detect or prevent fraud in connection with insurance, and adds exemptions for insurers and insurance producers.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "amber", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/united-states-montana/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "Opt-out and UOOM rights are confirmed and in force, but several adtech-specific sub-modules (dark patterns, cookies, clean rooms, direct marketing) are unconfirmed.", "claims": [ { "statement": "Montana is among the states where universal opt-out mechanism (UOOM) requirements are already in effect, with the requirement (excluding California and Colorado's variant timing) going into effect January 1, 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/there-s-no-opting-out-of-universal-opt-outs", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Consumers have the right to opt out of the sale of personal data and of the use of personal data for targeted advertisements.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/united-states-montana/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "Profiling opt-out and a dedicated genetic-privacy statute are confirmed and in force, but ADM transparency, AI-specific risk assessment, and surveillance carve-outs are unconfirmed.", "claims": [ { "statement": "Consumers have the right to opt out of the use of personal data for profiling purposes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Sensitive data under the MTCDPA includes the processing of genetic or biometric data for the purpose of uniquely identifying an individual, requiring consumer consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Montana law requires companies such as DNA-testing providers to obtain consumers' express consent for the sale, transfer, or use of genetic data for research purposes, to allow deletion of a consumer's genetic data and destruction of a consumer's biological sample, and to permit revocation of previously granted consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice", "source_url": "https://dojmt.gov/attorney-general-knudsen-reminds-montanans-to-protect-genetic-data-following-dna-testing-companys-bankruptcy-announcement/", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/united-states-montana/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Parental-consent and minor-specific heightened-risk duties are confirmed and in force, but age-verification, education-settings and dependent-adults sub-modules are unconfirmed or narrower than comparable regimes (e.g., COPPA, GDPR Art 8).", "claims": [ { "statement": "Consumer rights under the Act can be invoked by a known child's parent or legal guardian on behalf of the known child regarding the processing of personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "SB 297 requires a controller offering an online service, product, or feature to a consumer whom it knows or willfully disregards is a minor to use reasonable care to avoid a heightened risk of harm to the minor caused by that service, product, or feature.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/united-states-montana/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Enforcement powers and penalties are clearly defined and in force, but the absence of a private right of action, the sunsetting cure period, and the lack of confirmed enforcement-activity/funding data temper the overall posture.", "claims": [ { "statement": "The Attorney General is entitled to request that a controller disclose any data protection assessment relevant to an investigation, and may evaluate the assessment for compliance; such assessments remain confidential and exempt from disclosure under the Montana Freedom of Information Act.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "SB 297 adds a maximum civil penalty of up to $7,500 per violation and allows the Attorney General to seek an injunction as well as reasonable attorney fees and investigation/enforcement costs.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Montana Department of Justice, Office of Consumer Protection", "source_url": "https://dojmt.gov/office-of-consumer-protection/montana-consumer-data-privacy/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The Act clarifies that nothing within it may be construed as providing the basis for, or be subject to, a private right of action for violations under the Act or any other law.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The Attorney General must issue a notice of violation to a controller before initiating any enforcement action, and the controller has 60 days to cure the violation, a mandatory-cure requirement that sunsets April 1, 2026.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://legacy.dataguidance.com/opinion/montana-consumer-data-privacy-act-comprehensive", "source_tier": null, "observed_at": "2026-08-06" } ] } ] }