montana-mtdpa

name	montana-mtdpa
title	Montana Consumer Data Privacy Act (MTDPA)
description	Montana Consumer Data Privacy Act (MTDPA) compliance. Lowest consumer threshold at 50,000 consumers. Covers sensitive data consent, universal opt-out recognition, consumer rights, controller obligations, 60-day cure period, and AG enforcement. Effective October 1, 2024.
author	mukul975
author_url	https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/montana-mtdpa
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	us
practice	data-protection
language	en

Montana Consumer Data Privacy Act (MTDPA)

Overview

The Montana Consumer Data Privacy Act (MTDPA), codified as MCA §30-14-2801 through §30-14-2817, was signed into law on May 19, 2023 (SB 384), and became effective October 1, 2024. Montana is notable for having the lowest consumer count threshold of any comprehensive state privacy law at 50,000 consumers, making it applicable to smaller organizations operating in or targeting Montana residents.

Applicability (§30-14-2803)

The MTDPA applies to persons that conduct business in Montana or produce products or services targeted to Montana residents AND during a calendar year:

1. Control or process personal data of at least 50,000 Montana consumers (excluding data processed solely for payment transactions); OR
2. Control or process personal data of at least 25,000 Montana consumers AND derive more than 25% of gross revenue from the sale of personal data.

Lowest threshold: The 50,000 consumer threshold is the lowest among comprehensive state privacy laws (most states use 100,000).

Exemptions (§30-14-2803(3)):

• State and local government entities
• GLBA-covered financial institutions (entity-level)
• HIPAA covered entities and business associates (entity-level)
• Nonprofit organizations
• Institutions of higher education
• Air carriers

Liberty Commerce Inc. Assessment: Liberty Commerce Inc. processes personal data of approximately 28,000 Montana consumers. It does not meet either threshold but maintains compliance as part of its multi-state program.

Consumer Rights (§30-14-2808)

Five Consumer Rights

1. Right to Access (§30-14-2808(1)(a)): Confirm processing and access personal data
2. Right to Correct (§30-14-2808(1)(b)): Correct inaccuracies
3. Right to Delete (§30-14-2808(1)(c)): Delete personal data
4. Right to Portability (§30-14-2808(1)(d)): Obtain data in portable, readily usable format
5. Right to Opt Out (§30-14-2808(1)(e)):
   • Targeted advertising
   • Sale of personal data
   • Profiling in furtherance of decisions producing legal or similarly significant effects

Response Requirements (§30-14-2810)

• Respond within 45 days
• Extension: up to 15 additional days (total 60 days) with notice — shorter extension than most states
• At least one free response per 12 months per right
• Appeal: controller must respond within 60 days