EdLaw nat/us/state/mt/consumer-data-privacy/README.md

language: en · status: in-force · last checked: 2026-09-19

Montana Consumer Data Privacy Act

Montana's comprehensive consumer-privacy act — Title 30, chapter 14, part 28 of the Montana Code Annotated, enacted by Ch. 681, L. 2023 (Senate Bill 384, whose Section 14 provides that "[This act] is effective October 1, 2024") and substantially amended by Ch. 567, L. 2025. Structurally it is one of the familiar controller/processor acts: consumer rights of access, correction, deletion and portability, opt-outs from sale, targeted advertising and profiling, controller duties of minimisation and security, mandatory processor contract terms, data protection assessments, and Attorney-General-only enforcement.

What makes it worth carrying rather than treating as one more state act is the minors layer, which Montana wired to a different applicability test from everything else in the part.

Applicability to EdTech

School districts are out; we are in. §30-14-2804(1)(a) exempts any "body, authority, board, bureau, commission, district, or agency of this state or any political subdivision", and (1)(c) exempts institutions of higher education. A Montana school district is therefore not a controller under this part — a vendor selling into it is. This is the same split as Texas TDPSA.

The minors sections have no thresholds at all. §30-14-2803 sets the usual volume tests — 25,000 consumers, or 15,000 plus 25% of revenue from selling personal data — and then excludes §§30-14-2811, 30-14-2818 and 30-14-2819 from them. Those three sections instead bind any person who "conduct[s] business in this state or deliver[s] commercial products or services that are intentionally targeted to residents of this state" (§30-14-2803(2)). A vendor with a handful of Montana users is outside the general act and inside the minors duties.

There is an express educational carve-out, and it is narrow. §30-14-2811(4) disapplies only (2)(a) and (2)(b) — the targeted-advertising and sale prohibitions — to "a service or application that is used by and under the direction of an educational entity, including a learning management system or a student engagement program". Read what survives: the duty of reasonable care in (1), the collection-minimisation and precise-geolocation rules in (2)(c), the consent regime in (3) and the dark-patterns and direct-messaging safeguards in (3)(b) all continue to apply to an LMS. The same statute also carves a service "used by and under the direction of a ski area operator" out of the geolocation signal requirement — a reminder that these carve-outs are enumerated, not general.

The FERPA exemption is at the level of the data, not the entity. §30-14-2804(2)(m) exempts "personal data regulated by the Family Educational Rights and Privacy Act of 1974". Student data handled as education records falls out; teacher accounts, consumer users, marketing contacts and telemetry not covered by FERPA do not. As in Texas, this is the join to watch — "we are an EdTech company" does not answer the act.

COPPA compliance substitutes for parental consent. §30-14-2804(3) deems a controller or processor that meets COPPA's verifiable-parental-consent requirements compliant with any parental-consent obligation under the part, and §30-14-2811(3)(a)(ii) says the same for the minors regime.

Biometric data. §30-14-2802(4) defines it as data generated by automatic measurements of biological characteristics — fingerprint, voiceprint, eye retinas, irises or other unique biological patterns used to identify a specific individual — and excludes photographs, audio and video recordings and data generated from them "unless that data is generated to identify a specific individual". That trailing clause is where a face- or voice-matching feature built on ordinary camera or microphone capture lands back inside the definition. Biometric data processed for the purpose of uniquely identifying an individual is sensitive data (§30-14-2802(28)(b)), as is any personal data collected from a known child ((28)(c)) and precise geolocation ((28)(d)).

Sensitive data requires consent — and for a known child, processing in accordance with COPPA instead (§30-14-2812(2)(b)) — and triggers a mandatory data protection assessment (§30-14-2814(1)(d)).

Key obligations at a glance

Enforcement

The Attorney General has exclusive authority (§30-14-2817(1)) and no private right of action is created (§30-14-2817(5)). A violation of the part is a violation of the Montana Unfair Trade Practices and Consumer Protection Act, and the civil penalty is up to $7,500 per violation (§30-14-2820), with attorney fees and investigation costs recoverable.

Note the dangling cross-reference. §30-14-2820(2) makes the penalty payable by a person who violates the part "following the 30-day period described in 30-14-2817(3)" — but 30-14-2817(3) as it now stands is the civil-investigative-demand provision and describes no period, and no cure period appears anywhere else in the part. The cure right was in the 2023 text; the 2025 amendment (Ch. 567) rewrote §30-14-2817 without conforming §30-14-2820(2). What that leaves is a question for Montana counsel, not for this corpus; what is recorded here is that the text says what it says.

Contents

Document Covers
CONSUMER-DATA-PRIVACY.md MCA Title 30, ch. 14, part 28 in full — §§30-14-2801 to 30-14-2820: short title, definitions, applicability, exemptions, consumer rights and appeals, authorized agent, controller duties and the minors duty of care, processing limitations, processor duties and contract terms, data protection assessments, de-identified data, compliance, enforcement, responsibility by role and minors' data, minors' assessments, and civil penalty

The two reserved placeholders in the part (30-14-2805 through 30-14-2807, and 30-14-2810) hold no law and are not reproduced.

Licence

The reproduced text is MCA 30-14-2801 to 30-14-2820, enacted by the Montana Legislature and published by the Montana Legislative Services Division on mca.legmt.gov. No copyright subsists in this text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It went on: "judges—and, we now confirm, legislators—may not be considered the 'authors' of the works they produce in the course of their official duties as judges and legislators. That rule applies regardless of whether a given material carries the force of law." (slip opinion, pp. 1 and 5–6, read 2026-10-01.)

Each section page carries only this notice: "Disclaimer: The Internet version of the Montana Code Annotated is provided as a research tool to users of the Code. In case of inconsistencies resulting from omissions or other errors, the printed version will prevail." (read 2026-10-01). It asserts no copyright. The History credits the corpus keeps are compiled by the Legislature's own staff, which the holding above also covers.

Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup and anchors only). Nothing here suggests that the Montana Legislature endorses the corpus.

Sources