Are Nonprofits Exempt From Montana's Consumer Data Privacy Act?

Only in a narrow, insurance-specific case. Montana's Consumer Data Privacy Act (MCDPA) originally gave nonprofit organizations a broad exemption when it took effect October 1, 2024, but SB 297's amendments, effective October 1, 2025, narrowed that exemption to apply only to nonprofits established to detect and prevent insurance fraud — leaving most other nonprofits operating in Montana without the blanket carve-out they used to have.

What the Original Exemption Looked Like

When the MCDPA first took effect, it followed a pattern several other state privacy laws use: nonprofit organizations as a category sat outside the law's coverage, regardless of what kind of data processing they did. That gave charitable, advocacy, and membership organizations a full year of operating without MCDPA compliance obligations at all.

What SB 297 Changed

SB 297 rewrote that exemption to be far narrower, restricting it to nonprofit organizations organized specifically to detect and prevent fraudulent acts in connection with insurance. A nonprofit's broader mission or 501(c)(3) status alone no longer qualifies it for the carve-out — only that specific insurance-fraud-prevention purpose does. Practically, that moves most nonprofits — including those running donor outreach, membership marketing, or advocacy campaigns — into the same compliance posture as for-profit businesses.

The Threshold Also Dropped

Alongside narrowing the nonprofit exemption, SB 297 lowered the MCDPA's consumer-count applicability threshold from 50,000 Montana consumers to 25,000. The law still has no revenue-based threshold of its own, so the test remains purely about how many Montana residents' personal data an organization controls or processes, or — for a lower 25,000-consumer tier — whether it also derives revenue from selling personal data.

What This Means for Nonprofits Running Marketing Programs

A Montana-facing nonprofit that uses donor data for targeted fundraising appeals, works with ad platforms for digital outreach, or shares supporter lists with partner organizations needs to re-check its MCDPA status under the post-SB 297 rules rather than relying on the "nonprofits are exempt" assumption that held through the law's first year. Crossing the new 25,000-consumer threshold is also easier than it was under the old 50,000-consumer line, so organizations that were comfortably below the old threshold may not be below the new one.

SB 297 Also Removed the Automatic Cure Period

Narrowing the nonprofit exemption wasn't the only enforcement-relevant change. Before SB 297, the Montana Attorney General had to issue a notice of violation and give a business 60 days to cure it before filing an enforcement action. SB 297 eliminated that guaranteed cure period as of the same October 1, 2025 effective date, so the Attorney General can now pursue enforcement, including against a newly-covered nonprofit, without first offering a fix-it window. Civil penalties remain capped at $7,500 per violation, and there's still no private right of action.

Bottom Line

Don't assume nonprofit status alone keeps your organization out of Montana's privacy law anymore — since October 1, 2025, only insurance-fraud-prevention nonprofits keep the blanket exemption, and the consumer-count threshold that catches everyone else dropped to 25,000.

Sources: Benesch Law's analysis of SB 297's amendments narrowing the MCDPA's nonprofit exemption and lowering the applicability threshold, True Vault's May 2025 summary of Montana's updated privacy law, and Bass Berry & Sims' coverage of SB 297 eliminating the MCDPA's 60-day cure period effective October 1, 2025.