Montana Consumer Data Privacy Act
The Montana Consumer Data Privacy Act (MCDPA), effective October 1, 2024, grants Montana residents rights to access, correct, delete, and port their data, plus opt-outs of targeted advertising, sale, and profiling. It closely follows the Virginia template but sets comparatively low applicability thresholds, reflecting Montana's smaller population. Universal opt-out signal recognition is required. Ad-linked analytics is the main contact point. This is educational, not legal advice.
What this means
The MCDPA applies to persons that conduct business in Montana or target Montana residents and meet its thresholds. It adopts the Virginia-style framework: controller and processor roles, consumer rights to access, correct, delete, and obtain a copy, and opt-outs of targeted advertising, sale of personal data, and profiling that produces significant effects, with prior consent required to process sensitive data.
Low thresholds and signal recognition
What stands out is the threshold: because Montana's population is small, its numeric trigger for the volume of consumers processed is set lower than in larger states, so businesses that would escape coverage elsewhere can fall in scope. The MCDPA also requires recognising universal opt-out preference signals. For analytics, the practical line remains whether identifiers flow into targeted advertising or sale; first-party measurement that stays in-house keeps you clear of those triggers.
- Virginia-style rights and opt-out structure
- Comparatively low applicability thresholds
- Must honour universal opt-out signals
How it appears in analytics and logs
If analytics shares Montana residents' data for targeted advertising, sale, or profiling, the MCDPA's opt-out rights apply to that processing.
Diagnostic use case
Check whether analytics feeds targeted advertising or sale of Montana residents' data, noting the MCDPA's low applicability thresholds may catch smaller operators.
What WebmasterID can help detect
WebmasterID is first-party and does not share identifiers for targeted advertising or sale, the activities the MCDPA's opt-out rights focus on.
Common mistakes
- Assuming low traffic keeps you under Montana's threshold.
- Ignoring the duty to honour universal opt-out signals.
- Overlooking sensitive-data consent requirements.
Privacy and accuracy notes
This page is educational, not legal advice. First-party, non-shared analytics keeps you away from the MCDPA's targeted-advertising and sale opt-outs.
Related pages
- US state privacy laws overview
In the absence of a single federal privacy statute, several US states have enacted comprehensive consumer privacy laws with overlapping but non-identical rules. Most grant access, deletion, and correction rights and require opt-outs for targeted advertising and 'sale'. This page gives an educational overview of the common pattern and how it touches analytics.
- Virginia VCDPA and analytics
Virginia's Consumer Data Protection Act (VCDPA) was an early comprehensive US state privacy law and a template many others followed. It uses controller and processor roles, grants access/deletion/correction/portability rights, and requires opt-outs for targeted advertising, sale, and certain profiling. This page explains, educationally, how it intersects with analytics.
- Oregon Consumer Privacy Act (OCPA)
The Oregon Consumer Privacy Act (OCPA), effective July 1, 2024, gives Oregon residents rights to access, correct, delete, and obtain a copy of their data, plus opt-outs of targeted advertising, sale, and profiling. It stands out for letting consumers request a list of the specific third parties to which a controller disclosed their personal data — a stronger transparency right than most peers. Ad-linked analytics is the main contact point. This is educational, not legal advice.
- Privacy-first analytics
First-party measurement avoids targeted-ad and sale triggers.
Sources and verification notes
- Montana Legislature — Consumer Data Privacy Act (SB 384)Official bill text. Educational, not legal advice.
Last reviewed 2026-06-24. Facts are checked against primary/official sources where available; uncertain specifics are marked “Data not yet verified” rather than guessed.