Montana Dealers Must Now Comply before the Deadline
Montana passed its Consumer Data Privacy Act (MCDPA) in 2023. The requirements of the MCDPA can be found here. Importantly, Montana recently amended the MCDPA, effective October 1, 2025, broadening its applicability. Of particular interest to dealers are changes to applicability thresholds, the elimination of the financial institution exemptions under the Gramm-Leach-Bliley Act (GLBA), removal of the right to cure period for violations, requirements for more specific opt-out mechanisms for consumers, and additional enforcement authority for the Attorney General.
The result of these changes is that most, if not all, dealers in Montana are likely now subject to the law’s now more stringent requirements. If you have not already taken steps to comply, you should do so today, before the October 1 deadline.
Eliminates the Financial Institution Exemption
The biggest change for dealers is that the entity-level exemption for financial institutions and their affiliates subject to the GLBA was removed, making GLBA entities such as dealers now clearly subject to the MCDPA. While the entity-level exemption was removed, the exemption for GLBA data remains—but the scope of that exemption remains unclear at best. The bottom line is that with the exemption removed entirely, any argument that dealers are exempt from the MCDPA is now gone—dealers must comply with the law.
Reduced Thresholds
In addition, the MCDPA will now apply to more businesses by lowering the thresholds. Going forward, the law will apply to dealers that process personal data of at least 25,000 Montana consumers (previously 50,000). This means many smaller dealers who may have previously been outside the size threshold will now also be subject to the law.
New Opt-Out Mechanism
The amendment includes other substantive changes. For example, dealers must provide a clear and conspicuous link outside of the privacy notice to allow consumers to opt out of data sales or targeted advertising, with labels such as “your opt-out rights” or “your privacy rights” that will directly effectuate the opt-out request or go to a web page to enable the consumer to make the request.
Enforcement
The amendment increases the Attorney General’s investigatory and enforcement powers. The Attorney General can now issue civil investigation demands and the 60-day cure period for violations has been removed. Civil penalties for violations remain at $7,500 per violation.
ComplyAuto Makes Compliance Simple
Montana dealers need to take steps to comply with the MCDPA today. The MCDPA is complicated and can present tremendous challenges if you try to “do it yourself.”
ComplyAuto has done the hard work for you, and our software is ready to keep you compliant with MCDPA and other state privacy laws. If you have questions about MCDPA or want to learn more about how you can simplify your compliance, ComplyAuto will be presenting a webinar on this topic in the near future. Reach out to info@complyauto.com for more information.
ComplyAuto is your trusted partner, and our software makes compliance straightforward and efficient—keeping you ahead of complex legal requirements. Partnering with ComplyAuto is the smart choice for dealers. Contact us today to learn more.