Instruments
Each one links to its
LexLint note, which carries what it requires and what it flags on.
Adult content age verification (AV)
Requires commercial entities that knowingly publish or distribute material harmful to minors, where a substantial portion of the site is such material, to use reasonable age verification methods before granting access, and bars retention of identifying information after verification.
Note and primary source →
Age-appropriate design code
Amends Montana's consumer privacy law to require a controller that knows or willfully disregards that a consumer is a minor under 18 to use reasonable care to avoid a heightened risk of harm from an online service, product, or feature, and to complete a data protection assessment for offerings that pose such risk to minors.
Note and primary source →
Breach notification
cite Mont. Code Ann. § 30-14-1704
stage IMMINENT commencement not set
source official Montana statute text, Mont. Code Ann. Title 30, Chapter 14, Part 17
A person or business required to notify Montana residents of a breach of security must simultaneously submit an electronic copy of the notification to the Attorney General's consumer protection office; notice must be made without unreasonable delay, consistent with law-enforcement needs and the measures necessary to determine the breach's scope.
This provision is in force under the current codified text; the underlying research did not establish a dated original commencement, so no effective_date is recorded here.
What it asks of an app →
Comprehensive regime
MCDPA governs private-sector processing of Montana consumers' personal data. Originally enacted as H.B. 351 (2023 session), 2023 Mont. Laws ch. 681, effective October 1, 2024. Substantially amended by S.B. 297 (2025 session), 2025 Mont. Laws ch. 567, signed May 8, 2025, effective October 1, 2025, which lowered applicability thresholds, added minors' privacy provisions, and added privacy-notice content requirements.
General applicability is set at section 30-14-2803, controller duties at section 30-14-2811 and processor duties at section 30-14-2813.
What it asks of an app →
Data subject rights
cite Mont. Code Ann. § 30-14-2808
stage IN FORCE in force since 2024-10-01
source official Montana statute text, Mont. Code Ann. Title 30, Chapter 14, Part 28
MCDPA gives a Montana consumer the right to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and qualifying profiling. A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available, and must decide an appeal of a refusal within 60 days.
What it asks of an app →
Enforcement supervision
The Montana Attorney General has exclusive authority to enforce MCDPA; the chapter creates no private right of action. Civil penalties run up to $7,500 per violation.
As currently codified, section 30-14-2817 (Enforcement) contains no notice-and-cure text in its five subsections following the S.B. 297 amendment, yet section 30-14-2820(2) cross-references a 'thirty-day period described in 30-14-2817(3),' which as read describes the Attorney General's civil-investigative-demand authority rather than a cure mechanism.
This document reports that cross-reference as an open citation-accuracy question rather than resolving it; the operative, secondary-corroborated finding is that no mandatory pre-action cure right survives as of October 1, 2025, so a first violation can lead directly to a penalty.
What it asks of an app →
Sensitive categories
MCDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, the processing of genetic or biometric data to uniquely identify an individual, a known child's data, and precise geolocation data as sensitive data.
'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, such as a fingerprint or voiceprint, and the raw recording is excluded, but data generated from it is covered once generated to identify a specific individual, matching the Connecticut, Oregon, Delaware, and Nebraska structure.
What it asks of an app →
