Montana's Consumer Data Privacy Act was rewritten in 2025. SB 297 cut the coverage threshold from 50,000 Montana consumers a year to 25,000, and removed the 60-day window businesses used to have to fix a violation before facing fines of up to $7,500 each (Benesch Law, 2025). **Most single-location Montana shops still fall under that number — a growing multi-location business, or one sharing customer data with marketing partners, is where it's worth checking.**
What Is Montana's Consumer Data Privacy Act?
Montana's Consumer Data Privacy Act took effect October 1, 2024. It applies to any business that conducts business in Montana or intentionally markets to Montana residents and meets the law's consumer-count threshold. It gives Montana residents the right to access, correct, delete, and get a portable copy of their personal data, and requires businesses to post a clear privacy notice explaining what's collected and why (Termly, 2026). Before SB 297, the threshold was 50,000 Montana consumers a year — high enough that most small operators never gave it a second thought.
What Changed When SB 297 Took Effect on October 1, 2025?
SB 297 rewrote three numbers that matter. The general threshold dropped from 50,000 Montana consumers to 25,000. The lower threshold for businesses that derive revenue from selling personal data dropped from 25,000 consumers to 15,000. And the 60-day cure period — the window a business used to get to fix a violation before the Attorney General could fine it — is gone as of October 1, 2025 (Clym, 2026). The maximum penalty held at $7,500 per violation, but with no cure period, that fine can now attach to a first violation instead of a second one.
| MCDPA rule | Before SB 297 | After SB 297 (Oct 1, 2025+) |
|---|---|---|
| General consumer threshold | 50,000 MT consumers/year | 25,000 MT consumers/year |
| Data-sales threshold | 25,000 consumers + 25%+ revenue from data sales | 15,000 consumers + 25%+ revenue from data sales |
| Cure period before a fine | 60 days to fix it first | None — enforcement can start immediately |
| Maximum penalty | Up to $7,500 per violation | Up to $7,500 per violation, easier to trigger |
Does This Reach a Kalispell Contractor or a Whitefish Dental Office?
For most single-location Flathead Valley service businesses, no — not yet. A two-truck plumbing outfit, a single dental practice, or a small salon typically sees its customer count in the hundreds to low thousands a year, nowhere near 25,000 distinct Montana consumers. Where it starts to matter: a multi-location group — several dental offices or a regional property-management company operating under one entity — can cross that line just by adding locations together. So can any business, in any industry, that hits the 15,000-consumer mark while selling or sharing customer lists with marketing partners for a cut of the revenue.
Does Adding an AI Receptionist or CRM Change Whether You're Covered?
No — the AI system doesn't multiply your consumer count. What counts is how many distinct Montana residents' personal data your business processes in a year, whether that's captured by a front-desk clerk with a legal pad or an AI phone system logging every call. What does change is what falls inside the scope once a business is covered: an AI receptionist that transcribes names, phone numbers, and addresses into a CRM is processing exactly the personal data the law defines, so that call log becomes part of what a consumer can ask to see, correct, or delete — not just whatever sits in a spreadsheet downstream.
When Can You Safely Ignore This Law?
If your business runs out of one location, keeps its own customer list, and doesn't sell or license that list to anyone else, you very likely don't need a Montana privacy-compliance program today — the 25,000-consumer bar is still well above what a solo or small-crew operation processes in a year. Don't rewrite your intake process or buy a compliance product to solve a problem you don't have yet. The businesses that need to actually run the numbers are multi-location groups, anyone selling or licensing customer data, and any online or subscription business marketing intentionally to Montana residents at scale.
What Should You Do If You're Close to the Line or Growing?
- Get a rough count of how many distinct Montana customers your business — or your locations combined — touch in a year. That's the number that matters, not lead volume or website traffic.
- Ask any AI, CRM, or marketing vendor whether your data is portable and deletable on your request, or whether it's locked inside their platform. That answer matters regardless of whether the MCDPA applies to you yet.
- Add a plain-language privacy notice that says what you collect and how a customer can reach you about it — cheap to do now, and required once you're covered.
- Get an attorney's read on your specific numbers before assuming either way. This is a plain-language summary of a public law, not legal advice.