On this page
Montana's privacy law mostly does not apply to HIPAA-regulated healthcare. The Montana Consumer Data Privacy Act (MCDPA) exempts HIPAA covered entities and their business associates, and it exempts protected health information. It can apply to health and wellness businesses outside HIPAA, such as consumer health apps, direct-to-consumer wellness and supplement brands, and med spas or cash-pay practices that are not covered entities, once they process personal data of 25,000 Montana residents. Agencies and ad-tech vendors that process data for those brands work under a contract the law spells out. For advertisers that do fall under it, Curve Compliance sends conversions to ad platforms server-side, with consent management, a fixed list of fields per platform and a BAA on every plan.
Is this legal advice? No. This page summarizes the statute and the Montana attorney general's guidance, with links to both. Talk to your counsel about how the law applies to your business.
For every state in one place, see the state health privacy laws reference table. Our guides to Indiana, Tennessee and Texas answer the same question, and managing overlapping state laws covers multi-state setups.
The Montana Consumer Data Privacy Act at a glance
| Question | Answer |
|---|---|
| Statute | Montana Code Annotated 30-14-2801 and following |
| In effect | October 1, 2024; Senate Bill 297 amendments since October 1, 2025 |
| Who must comply | Businesses in Montana, or targeting its residents, that process personal data of 25,000 or more consumers, or 15,000 or more while earning over 25% of gross revenue from selling personal data |
| Exempt in healthcare | HIPAA covered entities and business associates; protected health information |
| Nonprofits | Exempt only if they detect or prevent insurance fraud |
| Health data | Sensitive data; consent required |
| Targeted advertising | Opt-out right; opt-out preference signals since January 1, 2025 |
| Enforcement | Attorney general only; no private right of action |
| Penalty | Up to 7,500 dollars per violation |
| Cure period | Not in the current text |
Who is exempt
Section 30-14-2804 says the law does not apply to any "covered entity or business associate as defined in the privacy regulations of the federal Health Insurance Portability and Accountability Act of 1996, 45 CFR 160.103." Exempt data includes "protected health information under the privacy regulations" of HIPAA, substance use disorder patient records under 42 U.S.C. 290dd-2, and health information de-identified under HIPAA.
The exemption covers the whole organization, including its website and ad data. A covered entity is still inside HIPAA: HHS says covered entities "must comply with the Rules' requirements to protect the privacy and security of health information."
Nonprofits changed in 2025. The 2023 law exempted any "nonprofit organization." The Montana attorney general says Senate Bill 297 "limits the nonprofit exemption to nonprofit organizations that detect/prevent fraud in connection with insurance." A nonprofit health or wellness group that is not a covered entity, and meets the thresholds, is now in scope.
Which health and wellness businesses it can reach
Being in healthcare is not the test. Being a covered entity is. HHS says a health care provider is a covered entity "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard." If a business is neither a covered entity nor a business associate, "it does not have to comply with the HIPAA Rules." Businesses outside HIPAA that meet Montana's thresholds can include:
- Consumer health, fitness and cycle-tracking apps.
- Direct-to-consumer wellness, nutrition and supplement brands.
- Med spas, cash-pay clinics and subscription telehealth brands that are not covered entities.
- Marketing agencies, analytics companies and ad-tech vendors that process personal data for those brands. The law calls them processors. The attorney general says a processor "must adhere to the instructions of a controller," and section 30-14-2813 sets what their contract must say.
Section 30-14-2803 sets the bar at personal data of 25,000 Montana consumers, not counting data processed only to complete a payment, or 15,000 if more than 25% of gross revenue comes from selling personal data. Before SB 297, those numbers were 50,000 and 25,000. The attorney general's summary defines personal data as "any information that is linked or reasonably linkable to an identified or identifiable individual."
For telehealth, it depends on the business. A provider that meets HHS's covered entity definition is exempt; a cash-pay or subscription telehealth brand that does not is treated like any other business.
Health data is sensitive data, and sensitive data needs consent
Montana's definition in section 30-14-2802 includes data revealing "a mental or physical health condition or diagnosis" and "information about a person's sex life." It also covers genetic or biometric data used to identify a person, data from a known child, and precise geolocation, meaning location accurate "within a radius of 1,750 feet."
Section 30-14-2812 says a controller may not "process sensitive data concerning a consumer without obtaining the consumer's consent." Consent must be "a clear affirmative act." It does not include accepting broad terms of use, "hovering over, muting, pausing, or closing a given piece of content," or "an agreement obtained using dark patterns." Revoking consent must be "at least as easy" as giving it, and processing must stop within 45 days.
Montana's wording is broad. Indiana, Tennessee and Texas name a health "diagnosis"; Montana adds "condition." For a wellness brand, that can pull in events such as symptom quiz results. Which events count is a question for counsel. For a law written only for consumer health data, compare Washington's My Health My Data Act.
Targeted advertising: the opt-out and opt-out signals
Under section 30-14-2808, consumers can opt out of processing for "targeted advertising," "the sale of the consumer's personal data," and profiling with legal or similarly significant effects. Targeted advertising means ads selected from a consumer's activities "over time and across nonaffiliated internet websites or online applications." It excludes ads based on activity on your own sites, ads based on the current search or page, and "processing personal data solely to measure or report advertising frequency, performance, or reach."
If you sell personal data or use it for targeted advertising, section 30-14-2812 requires you to say so in your privacy notice and to offer a clear way to opt out outside the notice, such as a link labeled "your opt-out rights" or "your privacy rights." The privacy notice must be linked from your homepage using the word "privacy" and show the date it was last updated.
Since January 1, 2025, section 30-14-2809 has required that consumers be able to opt out through "an opt-out preference signal," set by a "browser setting, browser extension, or global device setting." The statute does not name a specific signal.
Book a call. Curve's team will go through what your site sends to ad platforms today and set up server-side conversions with consent rules for each state. Book a call with Curve.
Enforcement, penalties and the cure period
The attorney general "has exclusive authority" to enforce the law under section 30-14-2817 and can request a controller's data protection assessment during an investigation. Section 30-14-2814 requires those assessments for processing with a heightened risk of harm, including targeted advertising and the sale of personal data. The law gives consumers no private right of action.
SB 297 added section 30-14-2820: a civil penalty of up to 7,500 dollars for each violation, injunctions and attorney fees. A violation is also a violation of Montana's consumer protection laws in Title 30, chapter 14, parts 1 and 2.
The cure period is gone from the text. The 2023 version required the attorney general to send a notice of violation and allow 60 days to fix it, a step set to end April 1, 2026. The current section 30-14-2817 has no notice-and-cure step.
A working checklist for brands in scope
- Decide with counsel whether each business is a covered entity, a business associate or neither, and count Montana consumers.
- List what your pixels, tags and SDKs send, and flag events that could reveal a health condition or precise location.
- Collect consent before processing sensitive data, and make withdrawal just as easy.
- Add an opt-out link and honor opt-out preference signals.
- Sign processor contracts and document data protection assessments.
Where Curve Compliance fits
For brands in scope in Montana, Curve Compliance replaces browser ad pixels with one script and sends conversions from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives a fixed list of fields, and anything else is stripped. Page titles, free text and form answers are never sent, and contact identifiers are off by default and SHA-256 hashed when enabled.
Curve's consent management gives every US state its own opt-in or opt-out rule, records each decision in an audit log, and holds back tracking and ad forwarding for visitors who have not allowed it. Global Privacy Control is honored in every region as a decline of advertising. Curve also flags PHI-like patterns, such as condition names in URLs, before data reaches an ad platform. See what to configure in a consent banner, run the free compliance scanner to see which trackers your site loads, or read about conversion tracking.
Book a call. Curve signs a BAA on every plan, so the same setup serves covered entities and the brands these laws reach. Curve's team does the setup, typically live in about a week. Book a call with Curve.
Frequently Asked Questions
Does the Montana Consumer Data Privacy Act apply to HIPAA covered entities?
No. Section 30-14-2804 exempts covered entities and business associates as defined in 45 CFR 160.103, and it exempts protected health information. HIPAA still applies to them.
Does Montana's privacy law apply to nonprofits?
Since October 1, 2025, only nonprofits that detect or prevent insurance fraud are exempt, per the attorney general's summary of SB 297. Other nonprofits that meet the thresholds can be covered.
Is health data sensitive data under Montana law?
Yes. Data revealing "a mental or physical health condition or diagnosis" is sensitive data, and a controller needs the consumer's consent to process it.
Does Montana require businesses to honor Global Privacy Control?
Since January 1, 2025, the law has required honoring an opt-out preference signal sent through a browser setting, extension or global device setting. It does not name a specific signal.
Is there a cure period under the Montana Consumer Data Privacy Act?
Not in the current text. The original 60-day notice-and-cure step was set to end April 1, 2026, and the 2025 amendments removed it from the section.
What are the penalties under Montana's privacy law?
Up to 7,500 dollars per violation, plus injunctions and attorney fees, in an action by the attorney general. Consumers have no private right of action.