Guide · US state law

MTCDPA: Montana's law got stricter in 2025

The Montana Consumer Data Privacy Act has been in force since October 1, 2024 and was strengthened by an amendment that took effect on October 1, 2025. In this guide you will understand the new thresholds, the end of the cure period, the universal opt-out signal and what changes for a site with AdSense or Ad Manager.

Audit my site for the US Read the guide

✓Based on the Montana Code and the state Department of Justice
✓Practical examples for sites with ads
✓Read-only scan, no changes to the site

25,000Montana consumers per year: the threshold since the 2025 amendment

15,000consumers are enough if more than 25% of gross revenue comes from selling data

45 daysto respond to requests, with an extension of another 45 days

$7,500maximum civil penalty per violation, added by the 2025 amendment

What it is

A privacy law that has already been reformed

The Montana Consumer Data Privacy Act, or MTCDPA, is Montana's general privacy law. It was passed in 2023, sits in Title 30, Chapter 14, Part 28 of the Montana Code and took effect on October 1, 2024.

The model follows Connecticut's. Visitors can access, correct, delete and take their data, and can refuse the sale of data, targeted advertising and certain automated profiling. Sensitive data can only be used with consent. And a covered site must honor universal opt-out signals, such as the GPC.

In 2025, the state passed amendment SB 297, signed in May 2025 and in effect since October 1, 2025. It lowered the applicability thresholds, ended the cure period before enforcement, set a penalty of up to $7,500 per violation and created new rules for people under 18.

For a site with visitors from the United States, Montana has become a state to watch. With 25,000 consumers per year you can already be covered, and there is no longer a guaranteed prior notice before an attorney general action.

Checklist

What you need to meet

If the site exceeds the MTCDPA thresholds, this is the basic list, from most urgent to least.

Link the notice on the home page with the word privacy
The privacy notice needs a visible link on the home page that uses the word privacy.
Example
Home page footer: Privacy Policy.
Have an opt-out path outside the notice
Anyone who sells data or does targeted advertising needs a clear opt-out path outside the privacy notice.
Example
Footer link: Your Opt-Out Rights or Your Privacy Rights.
Accept the browser preference signal
Since January 1, 2025, the site must accept an opt-out sent by a preference signal. If the signal contradicts an earlier choice, the signal wins.
Example
Visitor with GPC turned on: stop the sale and targeted ads for them.
Ask for consent for sensitive data and teens
Sensitive data only with consent. If the company knows, or deliberately ignores, that the visitor is 13 to 15 years old, targeted ads and sale also require consent.
Keep the notice complete and up to date
The notice lists data, purposes, third parties, rights and an active email, with the date of the last update. It must exist in every language in which the site offers the service.
Example
At the top of the notice: Last updated on November 3, 2026.
Do not require an account and make withdrawal easy
The visitor cannot be forced to create a new account to exercise rights. Withdrawing consent must be as easy as giving it.
Do the data protection assessment
Targeted advertising, sale, risky profiling and sensitive data require a recorded assessment, which the attorney general can request.
8
Pass the opt-out to Google
Google does not require a CMP for US states. Use the US state regulations message, in Privacy & messaging, or turn on restricted data processing, RDP, in the tag for people who opted out. With GPP, Google reads the US National section for Montana.
Example
AdSense or Ad Manager: Privacy & messaging, US state regulations card, Create. Then choose the sites and publish.
```
// Só para o visitante que recusou
googletag.pubads().setPrivacySettings({
  restrictDataProcessing: true,
});
```

In practice

Right and wrong

WrongThe opt-out only appears in the middle of the policy text.
RightYour Opt-Out Rights link visible in the footer, outside the privacy notice.
WrongThe site keeps the old choice and ignores the signal.
RightThe browser sends GPC and the site treats it as an opt-out, even if the visitor accepted before.
WrongPersonalized ad for a teenager the site knows to be 14.
RightNo targeted ads for a visitor aged 13 to 15 without consent.
WrongPolicy with no date, only in English on a Spanish site, and no link on the home page.
RightLink with the word privacy on the home page and the date of the last update in the notice.

Official tools

Certified CMPs and official links

Google does not require a certified CMP or GPP for US state laws. You can use Google's own message or turn on RDP in the tag.

Who must comply

The thresholds after the 2025 amendment

The law applies to anyone who does business in Montana or offers products and services targeted to residents of the state and passes one of the thresholds below.

25,000 consumers

Controls or processes data of at least 25,000 Montana consumers. Data used only to complete a payment does not count. Before the amendment, the threshold was 50,000.

15,000 and data sales

Controls or processes data of at least 15,000 consumers and earns more than 25% of gross revenue from selling personal data. Before, it was 25,000 consumers.

Minor rules with no threshold

The minor protection rules apply to any business that does business in Montana or targets its residents, with no minimum volume requirement.

Narrower exemptions

The amendment limited the nonprofit exemption to those fighting insurance fraud and replaced the broad exemption for financial institutions with specific exemptions for banks, credit unions and insurers.

Definitions

The words of the law, in plain site-owner language

The definitions are in section 30-14-2802 of the Montana Code.

Consumer and minor

A consumer is a Montana resident outside a commercial or employment context. An adult is someone 18 or older. A minor is a consumer under 18.

Sensitive data

Racial or ethnic origin, religion, physical or mental health, sex life, sexual orientation, immigration status, genetic or biometric data that identify the person, data of a known child and precise geolocation.

Sale

The exchange of personal data for money or other valuable consideration with a third party. Transfers to processors, to companies in the same group and in mergers are left out.

Targeted advertising

An ad chosen using data obtained or inferred from the visitor's activity over time on other companies' sites and apps. Ads based on the context of a search or the visit do not count.

People's rights

What a Montana resident can ask for

The response must go out within 45 days, with a further 45-day extension if needed and communicated within the initial period. If the business denies the request, it offers an appeal and responds in writing within 60 days.

Confirm and access

Find out whether the business processes their data and get access to that data, without the business having to reveal trade secrets.

Fix

Ask for wrong data to be corrected.

Delete

Ask for their personal data to be deleted.

Portability

Receive in a portable format the data they provided, when the processing is automated.

Refuse targeted ads and sale

Ask that the data not be used for targeted advertising and not be sold. This can be done through a universal signal, such as the GPC.

Refuse automated profiling

Refuse profiling that leads to decisions with legal or similarly significant effects.

Site obligations

What a covered site must have working

Full privacy noticeThe notice must include the categories of data processed, the purposes, the categories of data sold or shared, the categories of third parties, an active email or other contact, an explanation of rights and the appeal, and the date of the last update.
Link with the word privacyAfter the amendment, the notice must be linked from the home page by a visible link with the word privacy and must be available in each language in which the site offers its services.
Opt-out outside the noticeAnyone who sells data or does targeted advertising must offer a clear opt-out path outside the privacy notice, such as a link called your opt-out rights or your privacy rights.
Consent for sensitive data and teenagersSensitive data only with consent. If the business knows, or willfully disregards, that the visitor is between 13 and 15 years old, it also needs consent for targeted advertising and sale.
Care for under-18sOnline services used by known minors need reasonable care to avoid a heightened risk of harm and specific assessments of that risk.
Data protection assessmentTargeted advertising, sale, risky profiling and sensitive data require a recorded assessment, which the attorney general can request in an investigation.

Enforcement and fines

No cure period since October 2025

Only the Montana attorney general enforces the law. Consumers cannot sue the business under it, but can complain through the Department of Justice channel.

End of the cure period

The original law gave 60 days to fix a problem before an action. The 2025 amendment removed this guarantee, which would only have ended in 2026.

Up to $7,500 per violation

The amendment set a civil penalty of up to $7,500 per violation. The attorney general can also seek a court order and reimbursement of costs.

Investigation with assessments

In an investigation, the attorney general can request documents and the business's data protection assessments.

Complaint channel

The law requires the attorney general to publish information about business duties and an online channel for complaints.

Timeline

MTCDPA dates

In just over two years, Montana passed, enacted and reformed its own law.

2023
Law passed
Montana passes the Consumer Data Privacy Act.
October 1, 2024
Entry into force
The law takes effect, with thresholds of 50,000 consumers, or 25,000 with data sales, and a 60-day cure period.
January 1, 2025
Universal signal required
A covered site must honor the opt-out of sale and targeted advertising sent by a preference signal, such as the GPC.
May 2025
Amendment signed
The governor signs SB 297, which reforms the law.
October 1, 2025
Amendment in effect
The thresholds of 25,000 and 15,000 consumers, the minor rules, the $7,500 penalty and the end of the cure period take effect.

Sites with AdSense and Ad Manager

Required GPC and the opt-out path to Google

Since January 1, 2025, a covered site must honor the opt-out of sale and targeted advertising sent by a preference signal, with the visitor's consent. The best-known example is the Global Privacy Control, or GPC. If the signal conflicts with an earlier setting by the visitor, the signal prevails.

In AdSense and Ad Manager, under Privacy & messaging, Google offers a US state regulations message, and Montana is among the states covered. The message shows the Do Not Sell or Share link, and the opt-out turns on restricted data processing, called RDP, which prevents ads based on past behavior.

On the GPC, Google says the partner that implemented the signal can choose to turn on RDP when it receives an opt-out GPC. The setup is up to the site or the CMP. A direct way is through the tag: the restrictDataProcessing parameter in GPT or the data-restrict-data-processing attribute in AdSense.

The IAB Tech Lab GPP has a specific Montana section, but it is not on the list of sections Google accepts. For Google, the path is the US National section, where refusing sale, sharing or targeted advertising turns on RDP.

In practice

What is and is not allowed in Montana

Examples for a site with Montana traffic that monetizes with programmatic ads.

Allowed

Show contextual ads to people who opted out or arrived with GPC turned on
Use a footer link called your privacy rights for the opt-out, separate from the policy
Use the US National section of the GPP to take the opt-out to Google
Keep a single privacy notice for the US, with a visible update date
Ask the visitor for confirmation when the GPC conflicts with an earlier choice, while still applying the signal

Not allowed

Ignore the GPC and keep requesting personalized ads for that visitor
Hide the opt-out inside the text of the privacy policy
Use data of teenagers aged 13 to 15 for targeted ads without consent
Publish the policy only in English if the site is also offered in another language
Wait for a 60-day notice before fixing: that guarantee ended in October 2025

Common errors

Where sites trip up with Montana's law

The 2025 amendment caught many sites with setups made for the old version of the law.

Using the old thresholds

The site thought it was outside because it had fewer than 50,000 Montana consumers. With the new 25,000 threshold, it may be covered.

GPC ignored

The CMP reads the GPC only for California. Montana has required the same since January 2025.

Policy without a date

The privacy page does not show when it was updated, an item the amendment made mandatory.

Link without the word privacy

The policy is hidden behind a generic link such as terms or legal, without the word privacy on the home page.

State section that Google does not read

The CMP sends only the Montana section in the GPP and leaves out the US National one. The opt-out does not reach Google.

Opt-out that does not change the ads

The visitor opts out, but ad requests continue without RDP and without an opt-out in the GPP string.

In ConsentMode

What the audit checks for Montana

Opens the site as a visitor from the United States and looks for the opt-out link and the link with the word privacy on the home page.
Turns on the GPC signal in the audit browser and compares the page and the ad requests with and without the signal.
Reads the GPP string and checks that the US National section exists and records the opt-out.
Identifies the CMP or Google's state regulations message from the page code.
Checks that the privacy page includes data categories, third parties, rights, appeal, contact and the date of the last update.

Run an audit See everything that is checked

Frequently asked questions

What changed in Montana in 2025?

Amendment SB 297, in effect since October 1, 2025, lowered the thresholds to 25,000 consumers, or 15,000 with more than 25% of revenue from selling data, ended the cure period, set a penalty of up to $7,500 per violation, required more items in the privacy notice and created rules for people under 18.

Do I have to honor the GPC in Montana?

Yes, if the law applies to your site. Since January 1, 2025, the opt-out of sale and targeted advertising sent by a preference signal must be honored.

Do I still have 60 days to fix things after a notice?

No. The amendment removed the attorney general's obligation to offer a cure period. He can act directly.

My site is not for children. Do the minor rules affect me?

They can if you know, or willfully disregard, that a visitor is a minor. For teenagers aged 13 to 15, targeted advertising and sale require consent. The minor rules apply with no volume threshold.

Does Google read the Montana section in the GPP?

Google's list of accepted sections does not include Montana. To take the opt-out to Google, use the US National section, Google's state regulations message or RDP in the tag.

Does ConsentMode make my site compliant?

ConsentMode is not a CMP or a law firm. The audit shows what the site actually does with the opt-out, the GPC, the GPP and the privacy page, so you can fix it with your vendor and your lawyer.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See whether your site is ready for Montana's new law

The audit opens the site as a US visitor, with and without GPC, and shows what to fix, without changing anything.

Start the audit