Governance, risk & compliance
Montana Consumer Data Privacy Act (MCDPA) MCA 30-14-2801 to 2820 (2023, amended 2025)
The Montana Consumer Data Privacy Act (MCA 30-14-2801 to 30-14-2820, Chapter 681 Laws of 2023 as amended by Chapter 567 Laws of 2025).
It applies to a person that does business in Montana or targets its residents and handles the data of at least 25,000 consumers, or at least 15,000 consumers while earning more than 25% of gross revenue from sale. The sections on minors (30-14-2811, 2818 and 2819) apply with no threshold: a duty of care to avoid heightened risk of harm to minors under 18, limits on design features that increase use, limits on precise geolocation and on targeted advertising, sale and profiling of minors without consent, and a minors data protection assessment for processing on or after 1 October 2025.
Controllers must honour opt-out preference signals (no later than 1 January 2025), honour consent revocation within 45 days, obtain consent for targeted advertising or sale for ages 13 to under 16, and assess targeted advertising, sale, risky profiling and sensitive data. The Attorney General alone enforces, with civil penalties up to $7,500 per violation; there is no private right.
Effective dates come from secondary sources and the cure period is unresolved in the text read. Not verified: (1) Effective dates (1 October 2024 and 1 October 2025) are from secondary sources and the text of 30-14-2819(1); the MCA pages do not state them.
(2) Cure period is unresolved (cross-reference to 30-14-2817(3), which has no cure text); a secondary source says SB 297 removed the right to cure. (3) Exemptions in 30-14-2804 were not individually confirmed.
General information for compliance work, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses Montana Consumer Data Privacy Act (MCDPA) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Controller | A person that, alone or jointly with others, determines the purpose and means of processing personal data and meets the applicability test in 30-14-2803 (25,000 consumers, or 15,000 with more than 25% of revenue from sale). Carries the notice, consumer rights, consent, security, assessment and enforcement duties. | — |
| Processor | A person that processes personal data on behalf of a controller (30-14-2813). Must follow the controller’s instructions, help with consumer requests and security, give assessment information, bind its people and subcontractors, and delete or return data at the end of the service. A processor that decides purposes and means is treated as a controller. | — |
How Lavawall® helps you get to Montana Consumer Data Privacy Act (MCDPA) compliance
Most of Montana Consumer Data Privacy Act (MCDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Montana Consumer Data Privacy Act (MCDPA), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Montana Consumer Data Privacy Act (MCDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports Montana Consumer Data Privacy Act (MCDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- Montana Consumer Data Privacy Act (MCDPA) MCA 30-14-2801 to 2820 (2023, amended 2025)
- Category
- Privacy
- Region
- USA - Montana
- Levels
- 2 assessment tiers
All Montana, United States frameworks and training →
Map this framework freeTalk to our team