Law / United States / 
Montana
Genetic Information Privacy Act
Officially Genetic Information Privacy Act: direct-to-consumer genetic and neurotechnology data
Mont. Code Ann. §§ 30-23-101 to 30-23-106
In force.
A sensitive categories rule binding public and private bodies.
- Enforcement body
- The attorney general, who has the sole authority to enforce the part.
- Obligation class
- Consent, Disclosure, Security, Data subject rights, Transfer
As of .
What it requires
- If you are an entity that offers consumer genetic testing products or services directly to a consumer, or that collects, uses or analyzes genetic data, make available a high-level privacy policy overview and a prominent, publicly available privacy notice covering your collection, consent, use, access, disclosure, transfer, security, retention and deletion practices for genetic or neurotechnology data.
- Obtain initial express consent from a consumer, parent, guardian or power of attorney for the collection, use or disclosure of the consumer's genetic or neurotechnology data, describing your uses of the data, the categories of individuals within the entity with access to test results, and how you may share the data.
- Obtain separate express consent, naming the third party, for each transfer or disclosure to a third party other than your processors; separate express consent for each use beyond the primary purpose and for retaining a biological sample after the initial testing; informed express consent for transfer to third parties for research; and express consent for marketing based on the data and for sale or other valuable consideration of the data.
- Comply with section 44-6-104, which requires a valid legal process for disclosing genetic or neurotechnology data to law enforcement or any other government agency without the consumer's express consent.
- Develop, implement and maintain a comprehensive security program to protect a consumer's genetic or neurotechnology data against unauthorized access, use or disclosure.
- Provide a process for a consumer to access and delete the consumer's genetic or neurotechnology data, revoke any consent, and request and obtain destruction of the consumer's biological sample, subject to the clinical research and laboratory waivers in section 30-23-104(7) and (8).
- Do not disclose a consumer's genetic or neurotechnology data to any entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's express consent.
- Do not store genetic or neurotechnology data or biometric samples of Montana residents collected in the state within a country sanctioned by the United States Office of Foreign Assets Control or designated a foreign adversary, and transfer or store such data outside the United States only with the resident's consent.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 30-23-106(3) lets the attorney general recover actual damages to the consumer, costs, reasonable attorney fees and $2,500 for each violation of section 30-23-104.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 2,500
What this law does
An entity under the Genetic Information Privacy Act is a partnership, corporation, association, or public or private organization of any character that offers consumer genetic testing products or services directly to a consumer or collects, uses, or analyzes genetic data.
Neurotechnology data is information captured by neurotechnologies, generated by measuring the activity of an individual's central or peripheral nervous system, or associated with neural activity, and does not include nonneural information.
The part does not apply to protected health information collected by a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate that obtains separate informed consent and follows the policies in section 30-23-104(6)(a) through (6)(d), to scientific or clinical research under the federal human-subjects rules, to uses by a governmental agency, or to certain deidentified genetic data.
An entity must obtain initial express consent from a consumer, parent, guardian or power of attorney for the collection, use or disclosure of the consumer's genetic or neurotechnology data. An entity must obtain a consumer's separate express consent for the transfer or disclosure of genetic or neurotechnology data or a biological sample to any third party other than its processors.
An entity must develop, implement and maintain a comprehensive security program to protect a consumer's genetic or neurotechnology data against unauthorized access, use or disclosure. An entity must provide a process for a consumer to access, delete and revoke consent for the consumer's genetic or neurotechnology data and to request destruction of the consumer's biological sample.
Genetic or neurotechnology data and biometric samples of Montana residents collected in the state may not be stored within the territorial boundaries of any country sanctioned by the United States Office of Foreign Assets Control or designated as a foreign adversary. An entity may not disclose a consumer's genetic or neurotechnology data to any entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's express consent.
The attorney general has the sole authority to enforce the part. In an action to enforce the part, the attorney general may recover actual damages to the consumer, costs, reasonable attorney fees and $2,500 for each violation of section 30-23-104. The history note of section 30-23-104 records that the section was enacted by section 4 of chapter 768, Laws of 2023, and amended by section 4 of chapter 345, Laws of 2025. The 2025 amendment revised the Genetic Information Privacy Act to include neurotechnology data in its scope.
When LexLint raises it
When your app profile says your app processes biometric data or trains models.