In a surprising flurry of legislation, Montana—along with Indiana and Tennessee—has joined the growing roster of U.S. states that have passed their own comprehensive privacy laws. The Montana Consumer Data Privacy Act (MCDPA) borrows much of its language and structure from Virginia’s privacy law, but it’s not quite identical.

Here’s a quick rundown on the most important aspects of the Montana privacy law.

When Does It Go Into Effect?

Montana’s privacy law will go into effect on October 1, 2024.

What Businesses Must Comply?

For-profit businesses must comply with the Montana law if they do business in the state (or target Montana residents for their products/services), and meet at least one of the following conditions:

1. Control or process the personal data of at least 50,000 Montana residents per year, OR
2. Control or process the personal data of at least 25,000 Montana residents AND derive more than 25% of gross revenue from the sale of personal data

What Rights Do Consumers Have Under the Montana Law?

Montana consumers now have the following privacy rights:

• Right to Know - Consumers have the right to confirm whether a business is processing their personal data and, if so, to access that data.
• Right to Correct - Consumers can request that a business correct any inaccurate personal information it holds about a consumer.
• Right to Delete - Upon request, businesses must delete personal data about the consumer.
• Right to Portability - Upon request, businesses must provide a copy of the consumer’s personal data in a readily portable format so that it can be transmitted to another controller.
• Right to Opt Out - Consumers can opt out of:
  • Targeted advertising
  • The sale of their personal data
  • Profiling in furtherance of automated decision-making that produces legal or similarly significant for the consume

What Is “Personal Data”?

Montana’s definition of personal data mirrors that of other privacy laws, and includes all information that is “linked or reasonably linkable to an identified or identifiable individual.” This covers everything from IP addresses to shopping habits.Personal data does not include de-identified data or publicly available information.Are Data Protection Impact Assessments Required?As is the case with several other states, the Montana Consumer Privacy Act requires businesses to perform data protection impact assessments for certain types of processing activities. A DPIA is required for:

• Targeted advertising
• Sale of personal data
• Profiling of consumers, where it presents a foreseeable risk of harm
• Processing of sensitive personal data
• Any other processing activity that presents a heightened risk of harm to consumers

How Much Do Violations Cost?

Montana’s privacy law does not specify a maximum fine for violations.

Can Businesses Be Sued by Consumers?

The MCDPA does not grant a private right of action to consumers, meaning they cannot sue a business over alleged violations.