Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Montana Consumer Data Privacy Act (MCDPA)

Amended Montana · In force Oct 1, 2024 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

EnforcementOct 1, 2025 · 13 months ago · Source
SB 297 amendments take effect; cure period eliminatedLower thresholds (25,000 / 15,000 + 25%), minors' data protections, AG assessment demands; the 60-day cure period is removed.
Takes effectOct 1, 2024 · 2.1 years ago · Source
MCDPA takes effectConsumer rights, controller duties and opt-out preference signal support apply.

Summaries for reference, not legal advice. Check the official text.

What it does

Comprehensive privacy law with access, correction, deletion, portability and opt-out rights and mandatory recognition of opt-out preference signals. SB 297 (2025) lowered thresholds, removed the cure period, added minors' protections that apply regardless of size, and lets the AG demand data protection assessments in investigations.

Who it applies to
From Oct 1, 2025: persons doing business in Montana or targeting residents that control or process personal data of 25,000+ consumers (excluding payment-only data), or 15,000+ consumers and derive over 25% of gross revenue from selling personal data. Minors' provisions (30-14-2811, -2818, -2819) apply to anyone doing business in Montana or intentionally targeting products at residents regardless of volume. Original thresholds (Oct 1, 2024): 50,000 consumers, or 25,000 + over 25% revenue from sale.
Penalties
AG enforces using Montana Unfair Trade Practices and Consumer Protection Act powers (MCA Title 30, ch. 14, parts 1-2); no private right of action. SB 297 eliminated the 60-day cure period.
Enforced by
Montana Attorney General (exclusive)
Official name
Montana Consumer Data Privacy Act (SB 384, 2023), Mont. Code Ann. 30-14-2801 et seq., as amended by SB 297 (2025)
Citation
SB 384 (2023 Mont. Laws ch. 681); SB 297 (2025 Mont. Laws ch. 567); MCA 30-14-2801 to 30-14-2819
Topics
Privacy, Children
Verified 2026-09-22 archive.legmt.gov hunton.com
Research notes

The original act's 60-day cure period was scheduled to expire April 1, 2026; SB 297 removed it effective Oct 1, 2025 (per Hunton; MCA 30-14-2817 as amended by ch. 567 L. 2025 no longer contains a cure provision). The Oct 1, 2025 effective date of SB 297 is from secondary sources and the task brief, not the session law text. Hunton reports penalties up to $7,500 per violation under SB 297, but the codified enforcement section (30-14-2817) contains no dollar figure; penalties flow from the Montana Consumer Protection Act, so no exact per-violation figure is asserted here.

Related

EnactedAlabama
Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months
In forceArkansas
Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026
AmendedCalifornia
CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months
In forceCalifornia
California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026
In forceCalifornia
California Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 months
EnactedCalifornia
California Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 months
In forceCalifornia
California SB 243 (companion chatbots)Operators of companion chatbot platforms must clearly disclose that the chatbot is AI where a user could reasonably think they are talking to a human. They must keep and publish protocols that prevent suicidal-ideation and self-harm content and refer users to crisis services. For known minors, operators must disclose AI use, remind them every three hours to take a break, and block sexually explicit content. Annual reports to the Office of Suicide Prevention begin July 1, 2027.Next: Jul 1, 2027 First annual report to Office of Suicide Prevention · in 8 months
In forceCalifornia
California SB 976 addictive feedsBars addictive, personalized feeds for known minors without verifiable parental consent, and limits notifications to minors at night and during school hours. From 2027 operators must reasonably determine a user is not a minor before serving an addictive feed. The Attorney General must adopt age assurance and parental consent rules.Next: Jan 1, 2027 Age assurance duty and AG rules · in 2 months
Questions about Montana Consumer Data Privacy Act (MCDPA)
What are the Montana Consumer Data Privacy Act (MCDPA) compliance deadlines?
Oct 1, 2024: MCDPA takes effect. Oct 1, 2025: SB 297 amendments take effect; cure period eliminated.
When does Montana Consumer Data Privacy Act (MCDPA) take effect?
Montana Consumer Data Privacy Act (MCDPA) took effect on Oct 1, 2024.
Who does Montana Consumer Data Privacy Act (MCDPA) apply to?
From Oct 1, 2025: persons doing business in Montana or targeting residents that control or process personal data of 25,000+ consumers (excluding payment-only data), or 15,000+ consumers and derive over 25% of gross revenue from selling personal data. Minors' provisions (30-14-2811, -2818, -2819) apply to anyone doing business in Montana or intentionally targeting products at residents regardless of volume. Original thresholds (Oct 1, 2024): 50,000 consumers, or 25,000 + over 25% revenue from sale.
What are the penalties under Montana Consumer Data Privacy Act (MCDPA)?
AG enforces using Montana Unfair Trade Practices and Consumer Protection Act powers (MCA Title 30, ch. 14, parts 1-2); no private right of action. SB 297 eliminated the 60-day cure period.