Montana Consumer Data Privacy Act (MTDPA) compliance. Lowest consumer threshold at 50,000 consumers. Covers sensitive data consent, universal opt-out recognition, consumer rights, controller obligations, 60-day cure period, and AG enforcement. Effective October 1, 2024.
The Montana Consumer Data Privacy Act (MTDPA), codified as MCA §30-14-2801 through §30-14-2817, was signed into law on May 19, 2023 (SB 384), and became effective October 1, 2024. Montana is notable for having the lowest consumer count threshold of any comprehensive state privacy law at 50,000 consumers, making it applicable to smaller organizations operating in or targeting Montana residents.
The MTDPA applies to persons that conduct business in Montana or produce products or services targeted to Montana residents AND during a calendar year:
Lowest threshold: The 50,000 consumer threshold is the lowest among comprehensive state privacy laws (most states use 100,000).
Exemptions (§30-14-2803(3)):
Liberty Commerce Inc. Assessment: Liberty Commerce Inc. processes personal data of approximately 28,000 Montana consumers. It does not meet either threshold but maintains compliance as part of its multi-state program.
Processing sensitive data requires opt-in consent before processing. Consent must be freely given, specific, informed, and unambiguous.
The MTDPA requires controllers to recognize universal opt-out mechanisms:
Effective date: October 1, 2025 (one year after MTDPA effective date)
Required for:
| State | Consumer Threshold (Option 1) | Consumer Threshold (Option 2) | Revenue % |
|---|---|---|---|
| Montana | 50,000 | 25,000 | 25% |
| Virginia | 100,000 | 25,000 | 50% |
| Colorado | 100,000 | 25,000 | Any |
| Connecticut | 100,000 | 25,000 | 25% |
| Oregon | 100,000 | 25,000 | 25% |
| Texas | N/A (non-SBA small business) | N/A | N/A |
| California | 100,000 households | N/A | 50% |