Law / United States / 
Montana
Online protections for pupils: operators of K-12 online applications
Mont. Code Ann. §§ 20-7-1324, 20-7-1325
In force.
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Security, Retention
As of .
What it requires
- If you are an operator of a K-12 online application, that is, one used primarily for K-12 school purposes and designed and marketed for them, do not engage in targeted advertising on the application, or target advertising on any other site, service or application based on information acquired because of its use.
- Do not use information created or gathered by the K-12 online application to amass a profile about a pupil, except in furtherance of K-12 school purposes.
- Do not sell a pupil's information, including protected information; a purchase, merger or other acquisition of the operator is not a sale if the successor remains subject to the section.
- Do not disclose protected information except in furtherance of the K-12 school purposes of the application, to ensure legal and regulatory compliance, to respond to or participate in the judicial process, to protect the safety of users or the security of the site, or to a service provider you bind by contract to use it only for the contracted service, not to disclose it further and to maintain reasonable security.
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the protected information, and delete a pupil's protected information if the school or district requests deletion of data under its control.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 20-7-1325(8) makes an operator who violates the section guilty of a misdemeanor, punishable on conviction by a fine of not less than $200 or more than $500.
What this law does
An operator is the operator of a K-12 online application who knows or reasonably should know that the application is used primarily for K-12 school purposes. Protected information is personally identifiable information or materials, in any media or format, that describes or identifies a pupil and is created or provided by a pupil or parent, created or provided by a school district employee or agent, or gathered by an operator through its K-12 online application.
An operator may not knowingly engage in targeted advertising on its K-12 online application, or target advertising elsewhere based on information acquired because of the use of the application. An operator may not use information created or gathered by its K-12 online application to amass a profile about a pupil, except in furtherance of K-12 school purposes. An operator may not sell a pupil's information, including protected information.
An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the protected information and delete a pupil's protected information if the school or district requests deletion of data under its control. The section does not apply to general audience internet websites, online services, online applications or mobile applications, even if login credentials created for an operator's K-12 online application may be used to access them.
An operator who violates section 20-7-1325 is guilty of a misdemeanor and, if convicted, shall be fined not less than $200 or more than $500. Section 20-7-1324 was enacted by section 2 of chapter 369, Laws of 2019, and amended by chapter 329 and chapter 567, Laws of 2025. House Bill 631 of 2025, an act revising laws related to student data privacy to remove barriers to postsecondary opportunities, amended section 20-7-1324 to revise a definition.
Senate Bill 297 of 2025, an act generally revising privacy laws, also amended section 20-7-1324. The definition of K-12 school purposes does not include courses provided for the purpose of postsecondary credit or work-based learning courses provided by a work-based learning partner under section 20-7-1510.
When LexLint raises it
When your app profile says your app serves under-18s.