Montana is the sleeper in the state privacy stack: a Connecticut-grade law, GPC mandate included, sized so that ordinary national traffic triggers coverage, then upgraded in 2025 with minors’ duties that only a handful of states match. Companies that scoped their programs by state population rather than statutory thresholds routinely miss it, which is exactly the gap coordinated AG sweeps are built to find.
| Law | MTCDPA, Mont. Code Ann. 30-14-2801 et seq. |
|---|---|
| Effective | October 1, 2024 (GPC Jan 1, 2025; amendments Oct 1, 2025) |
| Thresholds | 50,000 consumers, or 25,000 + 25% sale revenue |
| Max penalty | Up to $10,000 per violation (MCPA) |
| Regulator | Montana DOJ |
| Statute | SB 384 (2023) |
Slotting Montana into a multistate program
Coverage math first. Estimate Montana consumers in your data (analytics geography is adequate evidence either way) against the 50,000 bar. Payment-transaction-only data is excluded from the count, but marketing, account, and tracking data all accrue.
Inherit from Connecticut. Rights handling with appeals, sensitive-data consent, assessments, processor contracts, and GPC recognition are all satisfied by a CTDPA-grade build; Montana adds no unique machinery, only the obligation to include its residents in it.
Take the minors’ amendments seriously. The under-18 duty of care, default protections, and targeted-advertising restrictions align Montana with Connecticut and the design-code trend; services with teen audiences should fold Montana into their children’s privacy matrix as of October 2025.
Position for the strict tier. With the amendments, Montana joins Oregon and Connecticut in the tier where exemptions are narrow and defaults favor consumers; the state comparison tracks the placement, and the multi-state strategy guide shows how the strict-tier spec covers the rest.
Confirm the visible pieces, opt-out links, GPC handling, notice accuracy, in one pass with a free scan.