Montana Consumer Data Privacy Act (MCDPA) Compliance: Handle Data Subject Requests on the 45-Day Deadline
The Montana Consumer Data Privacy Act gives Montana residents the right to access, correct, delete, and port their personal data, opt out of its sale and targeted advertising, and appeal a denial. The 2025 amendments cut the threshold to 25,000 consumers and stripped out the cure period, so far more companies are now exposed. Obtainer finds where a person's data lives across your systems, compiles one reviewable manifest, drafts the response, and tracks the 45-day clock.
found
scanned
Assembling the cover letter from the template...
Helps you comply, not legal advice
In short
The Montana Consumer Data Privacy Act (MCDPA) took effect on October 1, 2024, and Senate Bill 297 amended it effective October 1, 2025. Under the amended thresholds, the law applies to a controller that conducts business in Montana or targets Montana residents and, in a calendar year, controls or processes the personal data of 25,000 or more consumers (down from 50,000), excluding data processed solely to complete a payment transaction, or controls or processes the data of 15,000 or more consumers (down from 25,000) while deriving more than 25 percent of gross revenue from selling personal data. Montana has one of the lowest population bases of any state with a privacy law, so a 25,000-consumer trigger reaches a large share of businesses serving the state. Montana consumers can access, correct, delete, and obtain a portable copy of their personal data, opt out of the sale of their data, targeted advertising, and certain profiling, and appeal if you deny a request. You generally must respond within 45 days, extendable once by another 45 days with notice. Since January 1, 2025, controllers must honor universal opt-out signals such as Global Privacy Control. The Montana Attorney General enforces the law under the Montana Unfair Trade Practices Act with civil penalties of up to $7,500 per violation, and the 60-day right to cure is gone: the 2025 amendments removed it and the original statutory sunset date was April 1, 2026. There is no private right of action. Obtainer handles the operational side of an MCDPA request: it intakes the request, discovers where the person's data lives across your systems, compiles a source-system manifest, drafts a deadline-safe response, and tracks the 45-day clock. Nothing is disclosed automatically; a human reviews, redacts, and approves. Obtainer helps you comply. It is not legal advice, so scope and exemption calls stay with your team. Self-serve from $49/mo.
Why it fits
Montana businesses, plus out-of-state SaaS, ecommerce, adtech, and B2B firms that serve Montana residents at the lowered MCDPA thresholds, that want discovery, drafting, appeal handling, and 45-day deadline tracking for a data subject request in one place.
The lowest thresholds in the country
Montana now triggers at 25,000 consumers, or 15,000 if you make more than a quarter of your revenue selling data. Against a state population near 1.1 million, that is a small fraction of Montana residents. If you sell to consumers nationally, assume Montana counts you in even when the bigger states do not.
No cure period, higher penalties
The 2025 amendments raised civil penalties to $7,500 per violation and removed the 60-day right to cure that businesses relied on. The Montana Attorney General can now act on an alleged violation without a warning shot. Missing a 45-day deadline is a live exposure, not a paperwork problem you can fix after notice.
Discovery across your stack, priced for you
One consumer's data sits in your production database, warehouse, Stripe, help desk, and email. Obtainer surfaces where it lives, compiles one manifest, tracks the response and any appeal, and captures universal opt-out signals in the intake. Self-serve from $49/mo, with no five-figure floor before you answer your first request.
More use cases
Related features
Questions
Common questions about this
Who must comply with the Montana Consumer Data Privacy Act in 2026?
A controller doing business in Montana or targeting its residents that, in a calendar year, processes the personal data of 25,000 or more consumers, excluding data used solely to complete a payment transaction, or processes the data of 15,000 or more consumers while deriving more than 25 percent of gross revenue from selling personal data. Senate Bill 297 lowered both thresholds effective October 1, 2025. HIPAA and GLBA regulated data and certain nonprofits are exempt.
What changed in the Montana privacy law in 2025?
Senate Bill 297 took effect October 1, 2025. It lowered the applicability thresholds from 50,000 to 25,000 consumers and from 25,000 to 15,000 for data sellers, raised civil penalties to up to $7,500 per violation, removed the right to cure, added privacy notice and opt-out disclosure requirements, and strengthened protections for the data of minors.
How long do I have to respond to a Montana data subject request?
Forty-five days from receipt of a verified request, extendable once by another 45 days when reasonably necessary, provided you notify the consumer of the extension and the reason within the original window. That matches the 45-day standard used by eighteen of the twenty state laws; Iowa allows 90 days and Florida caps its extension at 15. If you deny the request you must explain why and give the consumer a way to appeal, and respond to the appeal within 60 days.
Does Montana require honoring Global Privacy Control?
Yes. Since January 1, 2025, controllers must recognize a universal opt-out mechanism such as Global Privacy Control as a valid opt-out of the sale of personal data and targeted advertising. The consumer does not need to create an account or submit a separate form, so your site and intake process have to detect the browser signal and act on it.
Run a data subject access request end to end
Obtainer finds where a person's data lives across your systems, compiles it into one manifest, drafts the deadline-safe response, and tracks the GDPR and CCPA clock. You review, redact, and approve what gets disclosed. Helps you comply; not legal advice.