Montana Consumer Data Privacy Act (SB 384, Ch. 681, L. 2023, amended by SB 297, Ch. 567, L. 2025; Mont. Code Ann. 30-14-2801 et seq.): profiling opt-out and data protection assessments

Summary

Montana's comprehensive consumer privacy law (SB 384, 2023), codified at Mont. Code Ann. 30-14-2801 et seq. and in force since October 1, 2024, was substantially amended by SB 297 (2025), effective October 1, 2025. As amended, it applies to persons doing business in Montana or targeting its residents that control or process the personal data of 25,000 or more consumers (excluding payment-only data), or 15,000 or more consumers while deriving over 25 percent of gross revenue from selling personal data. Consumers may opt out of profiling in furtherance of automated decisions that produce legal or similarly significant effects; SB 297 removed the word 'solely', so the opt-out now reaches decisions that are not fully automated. Such decisions include the provision or denial of financial or lending services, housing, insurance, education, criminal justice, employment, health care and necessities. Controllers must conduct and document a data protection assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury; the Attorney General may demand assessments through a civil investigative demand. Banks and credit unions principally engaged in financial activities, and data handled under Title V of the Gramm-Leach-Bliley Act, are exempt. The Attorney General has exclusive enforcement authority using the consumer protection powers of Title 30, chapter 14; there is no private right of action. SB 297 also removed the cure period and added duties toward minors.

Key dates

1. May 19, 2023Enacted
2. October 16, 2026Checked against sources
3. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. This part may be cited as the "Consumer Data Privacy Act". History: En. Sec. 1, Ch. 681, L. 2023.

   Supports: Name and session-law chapter

   Mont. Code Ann. 30-14-2801 Montana Legislature (Montana Code Annotated 2025) Primary source

2. SB 384, sponsored by Sen. Daniel Zolnikov (R – SD22), was signed into law on May 19, 2023, and will take effect October 1, 2024.

   Supports: Signing and effective dates

   Section 14. Effective date. [This act] is effective October 1, 2024. Section 15. Termination. [Section 12(2)] terminates April 1, 2026.

   Supports: Effective date and cure-period termination in enrolled bill

   SB 384 memo to the Economic Affairs Interim Committee (May 2024), with enrolled bill attached Montana Legislative Services Division Primary source

3. (iii) profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning the consumer.

   Supports: Profiling opt-out as amended

   History: En. Sec. 5, Ch. 681, L. 2023; amd. Sec. 5, Ch. 567, L. 2025.

   Supports: Amended by Ch. 567, L. 2025

   Mont. Code Ann. 30-14-2808 Montana Legislature (Montana Code Annotated 2025) Primary source

4. means decisions made by the controller that result in the provision or denial by the controller of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities

   Supports: Legal or similarly significant effects include financial or lending services

   Mont. Code Ann. 30-14-2802 Montana Legislature (Montana Code Annotated 2025) Primary source

5. control or process the personal data of not less than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction

   Supports: Threshold

   control or process the personal data of not less than 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data

   Supports: Alternative threshold

   Mont. Code Ann. 30-14-2803 Montana Legislature (Montana Code Annotated 2025) Primary source

6. the processing of personal data for the purposes of profiling in which the profiling presents a reasonably foreseeable risk of: (i) unfair or deceptive treatment of or unlawful disparate impact on consumers; (ii) financial, physical, or reputational injury to consumers

   Supports: Data protection assessment for risky profiling

   Mont. Code Ann. 30-14-2814 Montana Legislature (Montana Code Annotated 2025) Primary source

7. personal data collected, processed, sold, or disclosed in accordance with, Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801, et seq.

   Supports: GLBA data exemption

   Mont. Code Ann. 30-14-2804 Montana Legislature (Montana Code Annotated 2025) Primary source

8. The attorney general has exclusive authority and may use the duties and powers provided by Title 30, chapter 14, parts 1 and 2, to enforce violations pursuant to this part.

   Supports: Exclusive Attorney General enforcement

   Nothing in this part may be construed as providing the basis for or be subject to a private right of action for violations of this part or any other law.

   Supports: No private right of action

   Mont. Code Ann. 30-14-2817 Montana Legislature (Montana Code Annotated 2025) Primary source

9. SB 297 broadened this right by removing " solely ," so businesses must now allow consumers to opt out of profiling for automated decisions, even if those decisions are not entirely automated.

   Supports: Broadening of profiling opt-out

   the law's effective date on October 1, 2025

   Supports: SB 297 effective date

   Montana's Consumer Data Privacy Law Update: SB 297's Sweeping Changes at a Glance Ashurst Perkins Coie Reporting or analysis

10. The amendment, which Governor Gianforte signed into law on May 8, 2025, significantly lowers the threshold for applicability of the law

    Supports: SB 297 signing date

    Montana enacts law amending Consumer Data Privacy Act, increasing consumer protections Thompson Coburn Reporting or analysis

11. SB 297 removes the MTCDPA's guaranteed 60-day cure period in the event of an alleged violation

    Supports: Cure period removed

    SB 297 introduces civil penalties of up to $7,500 for each violation

    Supports: Reported penalty (not confirmed in code text read)

    Montana Amends Consumer Data Privacy Act Hunton Andrews Kurth Reporting or analysis