LexLint

The law for AI, agents, crawlers, and personal data

Law note · Montana

Montana Consumer Data Privacy Act (MCDPA), publicly available information exemption

cite Mont. Code Ann. ยง 30-14-2802(26) stage RECENT in force 11 months effective 2025-10-01 kind Personal data binds private bodies reviewed 2026-08-29

What it asks of an app

  • Personal data that is lawfully made available through a government record or widely distributed media, or that a controller reasonably believes a consumer lawfully made public, falls outside the MCDPA's definition of personal data.
  • Check the Act's current, lower thresholds (25,000 consumers, or 15,000 with more than 25% of revenue from data sales) as amended by SB 297 in 2025; the original 2023 thresholds were roughly double these and no longer apply.
  • Cite this Act's origin as Senate Bill 384 (2023), Chapter 681, never House Bill 351, which is an unrelated, unenacted marijuana bill.

When LexLint raises it

  • crawls_web
  • trains_models
  • processes_biometrics

What we found

Section 30-14-2802(26) excludes de-identified data and publicly available information from personal data, defined as information lawfully made available through government records or widely distributed media, or that a controller has a reasonable basis to believe a consumer lawfully made public. This is the ordinary, unqualified exemption, with no biometric carve-back of the kind Maryland's MODPA carries.

The Act was originally enacted as Senate Bill 384 (2023 Regular Session), Chapter 681, Laws of 2023, confirmed directly against Montana's own official Senate-Bill-to-Chapter-Number-2023 record and cross-checked against every codified section's own History line; a corpus candidate names the enacting bill as original HB 351, but no HB 351 was ever enacted into Montana law that session (Montana's companion House-Bill-to-Chapter-Number-2023 record skips directly from HB 348 to HB 352), and HB 351 was in fact an unrelated marijuana bill that died in committee, so SB 384 is the correct citation.

Section 30-14-2803, as amended by Senate Bill 297 (2025 Regular Session, Chapter 567), lowered the Act's applicability thresholds to a person controlling or processing personal data of at least 25,000 consumers, or 15,000 consumers while deriving more than 25% of gross revenue from selling personal data, roughly half the original 50,000 and 25,000 thresholds, and eliminated the prior notice-and-cure period for enforcement.

The 2023 Act's October 1, 2024 effective date and SB 297's October 1, 2025 effective date for its amendments are reported consistently across multiple secondary trackers but were not independently confirmed against a primary session-law text in this research: Montana's legacy per-bill document archive for the 2023 session appears to have been taken down or reorganized in a site redesign, and every attempted path to the enrolled bill or chapter session-law text returned a 404 on both the compliant and stealth-browser fetch tiers. Enforcement is by the Montana Attorney General; there is no private right of action.

Primary source

official code text, Montana Code Annotated (mca.legmt.gov)
the enacting and amending bill numbers are confirmed against Montana's own Senate-Bill-to-Chapter-Number-2023.pdf and House-Bill-to-Chapter-Number-2023.pdf (archive.legmt.gov); the effective dates rest on secondary trackers, not an independently confirmed primary session-law text

← Back to the example  ·  Lint your app →