B2B website visitor identification under Montana's privacy law

Yes, and that is the defining feature of this statute. The MCDPA applies to a business that controls or processes personal data of 50,000 or more Montana consumers, excluding data processed solely to complete a payment transaction, or 25,000 or more consumers while deriving over 25% of gross revenue from selling personal data. Most comparable state laws set the bar at 100,000 consumers or higher, so Montana catches meaningfully smaller companies, including many with no office or employees in the state at all, simply because they have enough Montana website visitors, customers or app users to cross this lower line. A company that has confirmed it falls outside California's or Texas's thresholds should not assume the same holds for Montana; the calculation needs to be run separately for each state's numbers. This is a factual scoping exercise, not legal advice, and a company close to either threshold should have counsel review its actual data volumes before concluding it is out of scope.

Generally, no. The MCDPA defines a covered consumer as a Montana resident acting only in an individual or household context, and it explicitly excludes a person acting in a commercial or employment context. That means a work email address, job title or business phone number collected through a sales, vendor or partnership relationship typically falls outside the statute's consumer rights provisions, even though the same information would ordinarily be considered personal data. This differs from California, where the CCPA/CPRA's temporary B2B and employee exemptions expired on 1 January 2023, bringing business contact data into scope there. Because exclusions like this depend on the specific facts of how data was collected and used, a company relying on the B2B carve-out for a particular dataset should confirm that reliance with its own counsel rather than assuming the exclusion applies automatically to every business contact record it holds.

lead.box resolves the organisation behind a website visit — a company name, industry and approximate size — from network-level signals, without identifying a named individual, without cookies, and without building a profile that follows a person across unrelated sites. The MCDPA's rights and obligations are built around personal data tied to an identified or identifiable Montana resident acting in an individual or household context, which is a different fact pattern than resolving which organisation a visit came from. Whether a given data flow on your site involves personal data covered by the MCDPA at all, separate from any visitor identification tool, is a question about your own broader data practices. lead.box acts as a processor under a data processing agreement for the data it does handle and leaves the scoping question of whether the MCDPA applies to your business to the controller, supported by your own legal counsel rather than by lead.box's own assessment.

Enforcement authority sits exclusively with the Montana Attorney General, acting under the Montana Unfair Trade Practices Act; there is no private right of action, so individual Montana consumers cannot sue a business directly for an alleged MCDPA violation. A 60-day cure period initially gave businesses a chance to fix an identified violation before the Attorney General pursued formal enforcement, but that cure period sunset on 1 April 2026, meaning the Attorney General can now proceed to enforcement without first offering that remedy window. For a business evaluating its exposure, this shifts the practical incentive toward getting scoping, disclosures and vendor documentation right upfront rather than assuming a violation can simply be corrected after the fact once flagged. None of this constitutes legal advice, and a business with genuine uncertainty about its MCDPA obligations should raise it with its own counsel rather than relying on this summary.

From 1 January 2025, the MCDPA requires controllers to recognize universal opt-out mechanisms — browser extensions, device settings or other technical signals that communicate a consumer's choice to opt out of the processing of their personal data for targeted advertising or sale, without requiring the consumer to submit a separate request to each website. This applies to personal data within the MCDPA's scope, meaning data tied to an individual or household consumer as the statute defines that term. It does not, by itself, change the analysis for company-level visitor identification, since that activity resolves an organisation rather than processing an individual consumer's personal data for the advertising or sale purposes the opt-out mechanism addresses. Whether your broader advertising and analytics stack needs to honor these signals is a separate operational question your team should work through with counsel, given how many other tools a typical marketing site runs alongside any visitor identification service.

Yes, potentially, and this is one of the more counterintuitive aspects of Montana's law. The MCDPA applies based on how much personal data of Montana consumers a business controls or processes, not on where the business itself is headquartered or incorporated. Because the applicability thresholds are the lowest of any state — 50,000 consumers, or 25,000 with heavy reliance on selling personal data — an out-of-state company with a modest but real base of Montana customers, subscribers or website visitors can cross that line well before it would trigger a larger state's threshold. This catches some businesses by surprise, since they may have already concluded they are out of scope everywhere based on California's or Virginia's higher numbers. Running the Montana-specific calculation separately, with input from counsel, is the only reliable way to know where a given company actually stands.

Bozeman and Missoula's technology companies and Montana's established energy and agriculture sectors both tend to run longer procurement cycles than the state's overall size might suggest, particularly where legal review is handled by out-of-state headquarters counsel for a parent company or investor group rather than locally. Given the MCDPA's unusually low thresholds, these reviewers often specifically ask whether a vendor itself might be a covered controller or processor, not just whether the vendor complies with the MCDPA on the buyer's behalf. Standard requests include a signed data processing agreement, a current sub-processor list, and a clear, specific description of what data is collected, whether personal data of an identifiable individual is involved at all, and where it is stored and processed. Company-level visitor identification tends to answer these questions cleanly, since it does not involve the kind of individual-level personal data the MCDPA's consumer provisions are built around, but the documentation should still be provided rather than assumed.

The MCDPA's definition of 'sale' centers on the exchange of personal data for monetary or other valuable consideration, applied to data about an identified or identifiable Montana consumer acting in an individual or household context. lead.box does not transmit visitor-level personal information to advertising networks, does not exchange data for consideration in the sense this definition describes, and resolves a visiting organisation rather than a named person, which is a different fact pattern from the data flows the sale provisions were written to address. That said, whether any of your other Montana-facing data flows meet the MCDPA's definition of sale is a separate question about your broader business practices, unrelated to visitor identification specifically. This response is general information rather than a compliance determination, and a business with a genuine question about whether it is selling personal data under Montana law should have its own counsel review the specific arrangement.