AI Laws in Montana (MT)

What Consumer Data Privacy Act (AI provisions) requires

Montana has enacted Consumer Data Privacy Act (AI provisions). Montana's CDPA includes AI-driven profiling opt-out rights for consumers. This page explains what the law requires in plain language, who is in scope, the penalty for non-compliance, and what your business needs to do before the October 1, 2024 deadline.

Who is in scope

The law covers businesses that use AI to interact with consumers, make consumer-facing decisions (credit, pricing, recommendations, content delivery), or generate AI content that is presented to the public, and businesses that build consumer profiles, engage in targeted advertising, or use AI to draw inferences about individuals based on personal data collected in Montana. Company size does not determine whether you are in scope — a startup with ten employees using an off-the-shelf AI hiring tool has the same disclosure obligations as an enterprise running a custom-built model. What matters is whether the AI system makes or substantially informs a decision that affects a Montana resident in a consequential way. Notably, the obligation extends to vendors: if your company deploys an AI tool built by a third party, you — as the deployer — are responsible for ensuring it meets Montana's requirements, even if you did not build it.

Key compliance requirements

Montana's consumer AI transparency requirements focus on two baseline obligations: disclosure and opt-out. Businesses must inform consumers when an AI system is involved in a consequential decision — meaning a decision that meaningfully affects a consumer's access to services, pricing, credit, or opportunities. The opt-out requirement gives consumers a mechanism to request human review or to decline AI-driven processing entirely. Meeting this standard is not just a notice-posting exercise: companies need to map every consumer-facing AI touchpoint, verify that their disclosure language is accurate and readable, and build a functioning human-review pathway that responds to opt-out requests within a defined window.

Montana's privacy framework extends to AI-driven consumer profiling. Businesses using AI to build inferences about individuals — whether for targeted advertising, credit risk scoring, or behavioral segmentation — must provide clear disclosure of profiling activities and honor opt-out requests in a timely manner. Montana residents have the right to know what categories of data are being used, to access a summary of the profile built about them, and to request deletion. Companies that sell or license consumer profiles to third parties face additional obligations: they must contractually require downstream recipients to honor the same opt-out rights.

Penalties for non-compliance

The financial consequences of non-compliance under Consumer Data Privacy Act (AI provisions) are real and enforceable now. Montana sets a maximum civil penalty of Up to $7,500 per violation. Penalties accumulate per violation — meaning a company that has deployed an AI tool to thousands of consumers without required disclosures faces compounding exposure, not a single capped fine. Consumer AI violations in Montana may also attract federal coordination: the FTC's Operation AI Comply sweep (September 2024) demonstrated that state and federal enforcers share intelligence on companies with widespread AI disclosure failures.

What to do now

Build your AI inventory first. You cannot comply with Montana's requirements if you do not know which systems are in scope. Map every AI or automated decision system your company uses that touches Montana residents — including third-party vendor tools integrated into your product.

Draft accurate disclosure language. Work with legal counsel to produce disclosure statements that accurately describe what your AI does, what data it uses, and what the consumer can do if they want human review. Vague or boilerplate disclosures will not satisfy Montana's requirements.

Build the opt-out pathway. Implement a functioning process for consumers to request human review or opt out of AI-assisted processing. Test it before the deadline — regulators will look for live, working mechanisms, not documented promises.

Assign a compliance owner. Designate someone — legal counsel, a privacy officer, or a dedicated AI governance lead — to track regulatory developments, own the audit documentation, and respond if an enforcement inquiry arrives. The compliance deadline is October 1, 2024. Don't wait until the deadline to start.

Montana AI law in the broader regulatory landscape

Montana's law does not exist in isolation. The trend across the United States is toward more regulation, not less: at least 20 states enacted or proposed AI-specific legislation in 2025 alone, and federal enforcement agencies — the FTC, EEOC, CFPB, and HHS — have all issued guidance making clear that existing laws apply to AI systems even where no AI-specific statute exists. Companies doing business across state lines must track each state's requirements independently — there is no federal preemption that would allow a company to satisfy Montana's law and automatically comply with requirements in Illinois, Colorado, or New York.

The EU AI Act applies to any company serving EU customers, even if you're based in Montana. Penalties reach €35M or 7% of global revenue. Deadline: August 2, 2026.