What is the Montana Consumer Data Privacy Act (MTCDPA)? | UpGuard

This article summarizes the Montana Consumer Data Privacy Act (MTCDPA), signed May 19, 2023 and effective October 1, 2024, detailing applicability thresholds for controllers and processors, exemptions (e.g., GLBA, HIPAA, government and nonprofit entities), definitions of personal and de-identified data, consumer rights (confirmation, access, correction, deletion, portability, opt-out), controller obligations (limited collection, security safeguards, consent for sensitive data, privacy notices, disclosures about sales/targeted advertising, universal opt-out effective Jan 1, 2025, data protection assessments, de-identification requirements, child data protections), processor duties to assist controllers and contractual requirements, and enforcement by the Montana Attorney General with a 60-day cure period (which expires April 1, 2026); the piece also offers compliance advice and advertises UpGuard’s third-party risk management solutions.