Montana CDPA

Montana's law took effect October 1, 2024 with unusually low thresholds for a state its size, and the 2025 amendments (SB 297), effective October 1, 2025, lowered them further: 25,000 consumers, or 15,000 where more than a quarter of revenue comes from selling personal data. The same amendments removed the 60-day cure period, so the Attorney General can now bring an action without notice. Controllers must honor universal opt-out mechanisms, obtain consent before processing sensitive data, and follow added protections for minors, including data protection assessments for processing that creates heightened risk to minors. Penalties come from the state consumer protection act, up to $10,000 per willful violation. Because Montana consumers are a small share of most companies' traffic, the exposure here tends to be discovered by accident: the geo-targeting logic that scopes consent handling to California and Colorado and forgets everyone else.