Montana

The Digital Likeness and Voice Rights Act gives a Montana resident, or a person domiciled in Montana at death, a property right in their own name, voice, and visual likeness, freely transferable and descendible, that does not expire on death and continues for 20 years afterward in the rights holder's executors, heirs, transferees, or devisees.

A person is liable for actual damages and any profits from the unauthorized use if, without the consent of the individual or the rights holder, the person distributes, transmits, or otherwise makes available an algorithm, software, tool, or other technology whose primary purpose, known to that person, is to produce an unauthorized digital voice or visual depiction of a particular, identified individual for commercial use, or if the person intentionally publishes or distributes such a depiction for commercial use knowing it is unauthorized.

A digital voice or visual depiction is one newly created or altered using digital technology so that it is nearly indistinguishable from the individual's actual voice or likeness and a reasonable person would believe it genuine. A person who held an objectively reasonable belief that the material did not qualify as an unauthorized depiction is not liable for damages.

The action may be brought by the individual or by an assignee, transferee, or exclusive licensee of the rights, within 4 years of discovery of the violation, and does not apply to a provider of broadband internet access service.

Exemptions, to the extent the use is protected by the First Amendment and the Montana Constitution's free expression clause, cover news-gathering, public affairs and sports reporting, comment, criticism, scholarship, satire and parody, and an individual's authentic self-representation in an audiovisual work. The act took effect January 1, 2026 under its own effective-date clause. It directs its own codification as part of Title 30, chapter 14.

A 2025 amendment (HB 514) added digitally fabricated images to the privacy in communications statute's existing ban on nonconsensual intimate images: a person may not publish, distribute, or disclose a real or digitally fabricated image or video of an identifiable person showing genitals or an exposed female breast, or the person depicted engaged in a real or simulated sexual act, without that person's consent, with the purpose to terrify, intimidate, threaten, harass, or injure the person or to obtain money or other valuable consideration; nor may a person possess and threaten to disclose such an image or video with the purpose to obtain money or other valuable consideration from the person depicted.

'Digitally fabricated' means using a technical means, such as artificial intelligence, to create media that realistically misrepresents an identifiable individual as engaging in conduct in which the individual did not engage. A first offense under these provisions is a misdemeanor punishable by a fine up to $500 or up to 6 months in county jail, or both; a second or subsequent offense is a felony punishable by up to 5 years imprisonment or a fine up to $25,000, or both.

The section does not impose liability on an interactive computer service for content another person provided. House Bill 514 (Chapter 686, Laws of Montana 2025) carries no effective-date clause of its own, so it takes effect under Montana's general rule, Mont. Code Ann. 1-2-201, on the first day of October following its passage and approval.

The sexual abuse of children statute makes it an offense to knowingly possess, process, develop, print, publish, transport, distribute, sell, exhibit, or advertise a visual or print medium in which a child is engaged in actual or simulated sexual conduct, and its possession offense expressly reaches computer-generated child pornography.

That term covers a depiction of an actual minor created, adapted, or modified to portray the minor engaged in prohibited sexual conduct, a depiction of an actual adult altered to portray the adult as a minor engaged in such conduct, or a depiction that is virtually indistinguishable from an actual minor engaged in such conduct, so an entirely synthetic, AI-generated image falls within the offense on the same terms as a photograph.

A general conviction carries life imprisonment or up to 100 years and a fine up to $10,000; a conviction resting solely on possession of the prohibited material carries a fine up to $10,000 or up to 10 years imprisonment, or both; and where the victim is 12 years of age or younger and the offender is 18 or older, the offender faces a mandatory 100-year term, with the first 25 years neither suspendable nor parole-eligible, a fine up to $50,000, and lifetime supervision after release.

The computer-generated child pornography language, including the clause reaching an image indistinguishable from an actual minor created by artificial intelligence, was added by Chapter 102, Laws of Montana 2025 (House Bill 82), effective July 1, 2025 under that Act's own effective-date section; the surrounding offense itself dates to 1979.

The Right to Compute Act declares that the rights to acquire, possess, and protect property and the freedom of expression under the Montana Constitution embody a fundamental right to own and make use of computational resources, including artificial intelligence systems, and that a government action restricting that use must be limited to what is demonstrably necessary and narrowly tailored to a compelling government interest.

The Act's one affirmative duty on a private actor falls on a deployer, an individual, company, or other organization that utilizes an artificial intelligence system. That duty applies when the deployer's system is a critical artificial intelligence system, one designed and deployed to make or be a substantial factor in making a consequential decision, and that system controls a critical infrastructure facility in whole or in part.

That deployer must develop, after deploying the system, a risk management policy that considers the National Institute of Standards and Technology's AI risk management framework, the ISO/IEC 4200 artificial intelligence standard, or another nationally or internationally recognized framework, and a plan already prepared to meet a federal requirement satisfies this duty. The Act preserves existing intellectual property remedies. It states that nothing in it preempts federal law.

It took effect on passage and approval under its own effective-date clause; the Governor approved the Act on April 16, 2025, the day it also took effect.

Within 60 days of the start of voting in an election where a candidate appears on the ballot, a person, corporation, committee, political party, or other entity working in an official election capacity may not pay for or sponsor an election or electioneering communication it knew or should have known is a deepfake of a candidate or political party, unless the communication carries a prescribed disclosure that it has been significantly edited by artificial intelligence and depicts speech or conduct that falsely appears to be authentic or truthful.

The disclosure must meet format rules by medium (minimum font size, screen height, or audio duration and placement), and the prohibition exempts bona fide news coverage with an AI-use disclaimer, satire or parody, certain broadcaster and distribution platform conduct, and an interactive computer service for content another party provided.

A candidate or political party depicted may seek injunctive relief and, on proof of a violation by clear and convincing evidence, recover actual damages, up to $10,000 in punitive damages, and attorney fees and costs.

A first sufficiency finding by the commissioner of political practices draws a civil penalty; a second draws misdemeanor prosecution (fine up to $500 or up to 6 months in county jail, or both); a third draws felony prosecution (fine up to $5,000 or up to 2 years in state prison, or both).

A First Amendment challenge to this scheme, brought over mailers depicting two primary candidates, produced an order on September 16, 2026 in which the United States District Court for the District of Montana granted a preliminary injunction against reviewing, investigating, prosecuting, adjudicating, or enforcing the Act against the named plaintiffs; the order names only those plaintiffs, and the statute otherwise remains in force.

The Deepfake Regulation Act (Chapter 541, Laws of Montana 2025) carries no effective-date clause of its own, so it takes effect under Montana's general rule, Mont. Code Ann. 1-2-201, on the first day of October following its passage and approval; the Legislature's own bill-history record lists Chapter 541's effective date as October 1, 2025.

A licensee or insurance-support organization that conducts business in Montana and owns or licenses computerized data that includes personal information must notify any individual whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person.

A person to whom personal information is disclosed in order to perform an insurance function and who maintains computerized data that includes it must notify the licensee or insurance-support organization immediately following discovery of a breach of the system. A licensee or insurance-support organization that must issue a notification must simultaneously submit an electronic copy of the notification and a statement of its date and method of distribution to the commissioner.

A licensee that is a Health Insurance Portability and Accountability Act (HIPAA) covered entity exempt under section 33-19-105(1) shall comply with section 33-19-321. A person who violates chapter 19 is subject to the civil penalty provided in section 33-1-317. Section 33-1-317 lets the commissioner, after a hearing, impose a fine not to exceed $25,000 on a person found to have violated a provision of the insurance code, except that the fine on insurance producers or adjusters may not exceed $5,000 per violation.

Section 33-19-321 took effect on March 1, 2006. The history note of section 33-19-321 records that it was enacted by section 9 of chapter 518, Laws of 2005, and amended by section 4 of chapter 180, Laws of 2007 and section 4 of chapter 62, Laws of 2015.

A person or business required to notify Montana residents of a breach of security must simultaneously submit an electronic copy of the notification to the Attorney General's consumer protection office; notice must be made without unreasonable delay, consistent with law-enforcement needs and the measures necessary to determine the breach's scope. The provisions this entry describes came into force on different days.

MCDPA requires a controller to conduct and document a data protection assessment for each of its processing activities that presents a heightened risk of harm to a consumer, which includes targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, and the processing of sensitive data.

Each assessment must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer, as mitigated by safeguards, and the controller must factor in the use of de-identified data, the reasonable expectations of consumers, the context of the processing and the relationship between the controller and the consumer.

The attorney general may require a controller to disclose any assessment relevant to an investigation, the controller must make it available to the attorney general, and the attorney general may evaluate it for compliance with the part. Assessments are confidential and exempt from disclosure under the federal Freedom of Information Act, and disclosure to the attorney general does not waive attorney-client privilege or work product protection.

The assessment requirements apply to processing activities created or generated after January 1, 2025, and are not retroactive.

MCDPA governs private-sector processing of Montana consumers' personal data. Originally enacted as Senate Bill 384 (2023 session), chapter 681 of the 2023 Laws of Montana. It took effect on October 1, 2024. Substantially amended by S.B. 297 (2025 session), 2025 Mont. Laws ch. 567, signed May 8, 2025, effective October 1, 2025, which lowered applicability thresholds, added minors' privacy provisions, and added privacy-notice content requirements.

General applicability is set at section 30-14-2803, controller duties at section 30-14-2811 and processor duties at section 30-14-2813.

Chapter 19 of Title 33 may be cited as the Insurance Information and Privacy Protection Act. For life, health or disability insurance, the Act binds insurance institutions, insurance producers and insurance-support organizations that, on or after July 1, 1982, collect, receive or maintain information in connection with insurance transactions that pertains to Montana residents, or engage in insurance transactions with Montana residents.

For property or casualty insurance, the Act binds insurance institutions, insurance producers and insurance-support organizations that, on or after July 1, 1982, collect, receive or maintain information in connection with insurance transactions involving policies delivered, issued for delivery or renewed in Montana, or engage in such transactions.

A licensee that is a Health Insurance Portability and Accountability Act (HIPAA) covered entity is exempt from the chapter as to uses and disclosures covered by the HIPAA privacy and security regulations, except for the notice, authorization, adverse underwriting decision and underwriting disclosure provisions the section lists.

An insurance institution, insurance producer or insurance-support organization may not use or authorize the use of pretext interviews to obtain information in connection with an insurance transaction, except as the section provides. A licensee must provide a clear and conspicuous notice of information practices that accurately reflects its privacy policies and practices to individuals about whom personal information is collected and disclosed in connection with insurance transactions.

An insurance institution or insurance producer shall clearly specify the questions that are designed to obtain information from an individual in connection with an insurance transaction solely for marketing or research purposes.

On a written request after proper identification, an insurance institution, insurance producer or insurance-support organization must within 30 business days inform the individual of the nature and substance of the recorded personal information and let the individual see and copy it or obtain a copy by mail.

Within 30 business days of a written request to correct, amend or delete recorded personal information, the holder must correct, amend or delete the disputed portion or notify the individual of its refusal and the reasons. If an adverse underwriting decision is made, the insurance institution or insurance producer responsible must provide the specific reasons in writing or advise that they may be requested in writing, and provide a summary of the individual's rights.

Except as the section provides, a licensee may not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction. Except as the section permits, a licensee may not use or disclose personal information for a marketing purpose. Section 33-19-307 was enacted by section 8 of chapter 341, Laws of 2001, and amended by section 6 of chapter 385, Laws of 2003.

Part 3 of the chapter lists section 33-19-321, titled Computer security breach. Section 33-19-321 (computer security breach) falls within this range and is described separately. A person who violates the chapter is subject to the civil penalty provided in section 33-1-317.

Section 33-1-317 lets the commissioner, after a hearing, impose a fine not to exceed $25,000 on a person found to have violated a provision of the insurance code, except that the fine on insurance producers or adjusters may not exceed $5,000 per violation.

An insurance institution, insurance producer or insurance-support organization that discloses information in violation of section 33-19-306 or 33-19-307 is liable for damages sustained by the individual to whom the information relates, up to the actual damages sustained.

Any person who knowingly and willfully obtains information about an individual from an insurance institution, insurance producer or insurance-support organization under false pretenses shall be fined not more than $10,000 or imprisoned for not more than 1 year, or both.

MCDPA gives a Montana consumer the right to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and qualifying profiling. A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available, and must decide an appeal of a refusal within 60 days.

Montana's unlawful use of a computer section provides that a person may not restrict access to personal data by any means, or restrict access to a product or service because the consumer did not authorize the use or collection of data. Except as provided in subsections (5) and (7), a person may enforce the terms of a legal contract between the persons.

Subsection (2) sets the penalties for a person convicted of the offense of unlawful use of a computer, graded by the value of the property involved.

The Montana Attorney General has exclusive authority to enforce MCDPA; the chapter creates no private right of action. Civil penalties run up to $7,500 per violation.

As currently codified, section 30-14-2817 (Enforcement) contains no notice-and-cure text in its five subsections following the S.B. 297 amendment, yet section 30-14-2820(2) cross-references a '30-day period described in 30-14-2817 (3)', which as read describes the Attorney General's civil-investigative-demand authority rather than a cure mechanism.

That cross-reference is an open citation-accuracy question rather than a resolved one; the operative, secondary-corroborated finding is that no mandatory pre-action cure right survives as of October 1, 2025, so a first violation can lead directly to a penalty.

An entity under the Genetic Information Privacy Act is a partnership, corporation, association, or public or private organization of any character that offers consumer genetic testing products or services directly to a consumer or collects, uses, or analyzes genetic data.

Neurotechnology data is information captured by neurotechnologies, generated by measuring the activity of an individual's central or peripheral nervous system, or associated with neural activity, and does not include nonneural information.

The part does not apply to protected health information collected by a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate that obtains separate informed consent and follows the policies in section 30-23-104(6)(a) through (6)(d), to scientific or clinical research under the federal human-subjects rules, to uses by a governmental agency, or to certain deidentified genetic data.

An entity must obtain initial express consent from a consumer, parent, guardian or power of attorney for the collection, use or disclosure of the consumer's genetic or neurotechnology data. An entity must obtain a consumer's separate express consent for the transfer or disclosure of genetic or neurotechnology data or a biological sample to any third party other than its processors.

An entity must develop, implement and maintain a comprehensive security program to protect a consumer's genetic or neurotechnology data against unauthorized access, use or disclosure. An entity must provide a process for a consumer to access, delete and revoke consent for the consumer's genetic or neurotechnology data and to request destruction of the consumer's biological sample.

Genetic or neurotechnology data and biometric samples of Montana residents collected in the state may not be stored within the territorial boundaries of any country sanctioned by the United States Office of Foreign Assets Control or designated as a foreign adversary. An entity may not disclose a consumer's genetic or neurotechnology data to any entity offering health insurance, life insurance or long-term care insurance, or to any employer of the consumer, without the consumer's express consent.

The attorney general has the sole authority to enforce the part. In an action to enforce the part, the attorney general may recover actual damages to the consumer, costs, reasonable attorney fees and $2,500 for each violation of section 30-23-104. The history note of section 30-23-104 records that the section was enacted by section 4 of chapter 768, Laws of 2023, and amended by section 4 of chapter 345, Laws of 2025.

The 2025 amendment revised the Genetic Information Privacy Act to include neurotechnology data in its scope. The provisions this entry describes came into force on different days.

MCDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, the processing of genetic or biometric data to uniquely identify an individual, a known child's data, and precise geolocation data as sensitive data.

'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, such as a fingerprint or voiceprint, and the raw recording is excluded, but data generated from it is covered once generated to identify a specific individual, matching the Connecticut, Oregon, Delaware, and Nebraska structure.

An operator is the operator of a K-12 online application who knows or reasonably should know that the application is used primarily for K-12 school purposes. Protected information is personally identifiable information or materials, in any media or format, that describes or identifies a pupil and is created or provided by a pupil or parent, created or provided by a school district employee or agent, or gathered by an operator through its K-12 online application.

An operator may not knowingly engage in targeted advertising on its K-12 online application, or target advertising elsewhere based on information acquired because of the use of the application. An operator may not use information created or gathered by its K-12 online application to amass a profile about a pupil, except in furtherance of K-12 school purposes. An operator may not sell a pupil's information, including protected information.

An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the protected information and delete a pupil's protected information if the school or district requests deletion of data under its control. The section does not apply to general audience internet websites, online services, online applications or mobile applications, even if login credentials created for an operator's K-12 online application may be used to access them.

An operator who violates section 20-7-1325 is guilty of a misdemeanor and, if convicted, shall be fined not less than $200 or more than $500. Section 20-7-1324 was enacted by section 2 of chapter 369, Laws of 2019, and amended by chapter 329 and chapter 567, Laws of 2025. House Bill 631 of 2025, an act revising laws related to student data privacy to remove barriers to postsecondary opportunities, amended section 20-7-1324 to revise a definition.

Senate Bill 297 of 2025, an act generally revising privacy laws, also amended section 20-7-1324. The definition of K-12 school purposes does not include courses provided for the purpose of postsecondary credit or work-based learning courses provided by a work-based learning partner under section 20-7-1510. The provisions this entry describes came into force on different days.

Genetic information is information derived from genetic testing or medical evaluation to determine the presence or absence of variations or mutations in an individual's genetic material that are scientifically or medically believed to cause a disease, disorder or syndrome or are associated with a statistically increased risk of developing one that is asymptomatic at the time of testing.

An insurer, health service corporation, health maintenance organization, fraternal benefit society or other issuer of an individual or group policy or certificate of insurance may not require an individual to obtain a genetic test unless the test is otherwise required by law.

An issuer of coverage may not, on the basis of a person's genetic traits, refuse an application, refuse to issue, cancel or refuse to renew a policy or certificate, charge a higher rate or premium, or offer different terms, conditions or benefits or place a limitation on coverage. An issuer of coverage may not underwrite or condition coverage on a requirement or agreement that the individual undergo genetic testing or on genetic information about a member of the individual's family.

An issuer of coverage may not seek genetic information about an individual for a purpose that is unrelated to assessing or managing the individual's current health, inappropriate in an asymptomatic individual, or unrelated to research in which a subject is not personally identifiable. Section 33-18-903 does not apply to transactions of life, disability income, or long-term care insurance.

Section 33-1-317 lets the commissioner, after a hearing, impose a fine not to exceed $25,000 on a person found to have violated a provision of the insurance code, except that the fine on insurance producers or adjusters may not exceed $5,000 per violation. The history note of section 33-18-901 records that it was enacted by section 3 of chapter 334, Laws of 1999. Chapter 334, Laws of 1999, took effect on October 1, 1999, for all sections.

The part applies only to a health care provider that is not subject to the privacy provisions of Health Insurance Portability and Accountability Act (HIPAA) and administrative rules adopted in connection with HIPAA. A health care provider is a person licensed, certified, or otherwise authorized by the laws of Montana to provide health care in the ordinary course of business or practice of a profession.

A person includes an individual, corporation, business trust, estate, trust, partnership, association, joint venture, government, governmental subdivision or agency, or other legal or commercial entity. A health care provider, an individual who assists in the delivery of health care, or an agent or employee of a provider may not disclose health care information about a patient to any other person without the patient's written authorization, except as the part allows.

A health care provider must maintain with a patient's recorded health care information a record of each person who received or examined it during the preceding 3 years. A health care provider shall effect reasonable safeguards for the security of all health care information it maintains.

Upon receipt of a written request from a patient to examine or copy recorded health care information, a health care provider must act as promptly as required and no later than 10 days after receiving the request. A mental health digital service is subject to the disclosure and confidentiality provisions of the part when handling health care information on behalf of an individual. Section 50-16-546 was added by section 1 of chapter 273, Laws of 2025.

The attorney general or appropriate county attorney may maintain a civil action to enforce the part. If a court determines that there is a violation of the part, the aggrieved person is entitled to recover damages for pecuniary losses and, if the violation results from willful or grossly negligent conduct, may recover not in excess of $5,000 in addition, exclusive of any pecuniary loss.

A person who by bribery, theft, or misrepresentation of identity, purpose of use, or entitlement examines or obtains health care information maintained by a provider in violation of the part is guilty of a misdemeanor punishable by a fine not exceeding $10,000 or imprisonment not exceeding 1 year, or both. The provisions this entry describes came into force on different days.

Under Title 45 (Crimes), Chapter 6 (Offenses Against Property), Part 3 (Theft and Related Offenses), a person commits the offense of unlawful use of a computer when, knowingly or purposely and without authorization, the person obtains the use or access of any computer, computer system, or computer network without consent of the owner, among other prohibited acts such as destroying or rendering data inoperable, introducing a computer contaminant, disclosing or taking trade secrets or confidential data, or using another person's computer credentials without permission.

The offense sits among the property crimes and is graded by value: subsection (2) sets a fine of up to $1,500 or up to 6 months in the county jail, or both, for loss of property not exceeding $1,500 or when no loss can be articulated, and a fine of up to 2 1/2 times the value of the property or up to 10 years in state prison, or both, for loss above $1,500, so the offense reaches access that causes no measurable loss and the value of the property only grades the penalty.

The section was enacted in 1981 and amended in 1983, 1993, 1999, 2009 and 2023, and no legislative record located states the day on which the 1981 act came into force. Subsection (1)(c) reaches a person who, knowingly or purposely and without authorization, introduces a computer contaminant that deletes, modifies, or renders unavailable data, programs, or supporting documentation residing or existing internal or external to a computer, computer system, computer network, or electronic device.

Subsection (1)(f) reaches a person who, knowingly or purposely and without authorization, introduces a computer contaminant to gain access to data, programs, supporting documentation, computer systems, including peripheral devices, or computer networks in order to delete, encrypt, modify, append, or otherwise render them unavailable.

Subsection (1)(h) reaches a person who, knowingly or purposely and without authorization, uses another person's computer or computer credentials to track that person's movements or monitor that person's communications without that person's consent.

Subsection (5) provides that a person may not encrypt or modify another person's computer, computer system, or electronic device, restrict access to personal data by any means, or restrict access to a product or service because the consumer did not authorize the use or collection of data. Subsection (4) provides that the section does not apply to an individual who modifies, accesses, or destroys the individual's personal computer, computer network, computer system, or electronic device.

Section 30-14-2802(19)(b) excludes de-identified data and publicly available information from personal data, and subsection (26) defines publicly available information as information that is lawfully made available through federal, state, or municipal government records or widely distributed media, or that a controller has a reasonable basis to believe a consumer has lawfully made available to the public. The definition carries no exception for biometric data.

The Act was enacted as Senate Bill 384 (2023 Regular Session), Chapter 681, Laws of 2023, and section 30-14-2802 was amended by Chapter 567, Laws of 2025 (Senate Bill 297). The Act does not apply to any body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of this state.

Each department head is responsible for ensuring an adequate level of security for all data within that department. A department head must develop and maintain written internal policies and procedures to ensure security of data. A department head must designate an information security manager to administer the department's security program for data. A department head must implement appropriate cost-effective safeguards to reduce, eliminate, or recover from identified threats to data.

A department head must ensure that internal evaluations of the security program for data are conducted. No record stating the day on which the section came into force has been located.

Licensees, insurance-support organizations, and persons to whom personal information is disclosed pursuant to that part must develop and maintain an information security policy for the safeguarding of personal information and security breach notice procedures that provide expedient notice to individuals.

A licensee is an insurance institution, insurance producer, or other person who is licensed or required to be licensed, authorized or required to be authorized, or registered or required to be registered pursuant to Title 33, or a surplus lines insurer. An insurance-support organization is a person who assembles or collects information about natural persons for the purpose of providing the information to an insurance institution or insurance producer for insurance transactions. Subsection (4) took effect on March 1, 2006, with the rest of section 33-19-321.

Each state agency that maintains the personal information of an individual must develop procedures to protect the personal information while enabling the state agency to use the personal information as necessary for the performance of its duties under federal or state law.

The procedures must include measures to eliminate the unnecessary use of personal information, identify who may have access to it, restrict access by unauthorized persons or state agencies, identify when redaction is appropriate, dispose of documents consistently with record retention requirements, eliminate unnecessary storage on portable devices, and protect data containing personal information on a portable device.

All state agencies and third parties to whom personal information is disclosed by a state agency must develop and maintain an information security policy designed to safeguard personal information. A third party is a person with a contractual obligation to perform a function for a state agency, or a state agency with a contractual or other obligation to perform a function for another state agency. The sections this entry groups came into force on different days.

A business must take all reasonable steps to destroy, or arrange for the destruction of, a customer's records within its custody or control containing personal information that is no longer necessary to be retained by the business, by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or undecipherable.

Business includes a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit, and an entity that destroys records, but does not include industries regulated under Title 33 of the Montana Code. A violation of the duty is a violation of the Consumer Protection Act's unlawful-practices section, 30-14-103, and the penalties are as provided in 30-14-142.

In an action under 30-14-111, if the court finds a willful violation, the state may recover a civil fine of not more than $10,000 for each violation. A consumer who suffers an ascertainable loss of money or property from a practice declared unlawful by 30-14-103 may bring an individual action, but not a class action, to recover the greater of that loss or $500.

On discovery or notification of a security incident, a state agency must provide immediate notification without unreasonable delay to the chief information security officer.

A security incident is an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information the system processes, stores, or transmits, or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies. The chief information security officer is an employee at the department of administration designated by the chief information officer.

A state agency is an agency, authority, board, bureau, college, commission, committee, council, department, hospital, institution, office, university, or other instrumentality of the legislative or executive branch of state government, and the term does not include an entity of the judicial branch. The history note of section 2-6-1504 records that it was enacted by section 1 of chapter 227, Laws of 2023. Chapter 227, Laws of 2023 (Senate Bill 50), took effect on October 1, 2023, for all sections.

Montana bars any person, not only a law enforcement officer, from installing or using a pen register or a trap and trace device without a court order, and bars using a pen register or trap and trace device that has the ability to record conversations.

The court-order requirement does not apply to a provider of a wire or electronic communication service using such a device to operate, maintain or test the service, to protect its rights and property or a user from abuse or unlawful use, to record that a communication was initiated or completed to guard against fraud, or with the consent of each person whose originating or transmitted number is recorded or decoded.

A knowing violation is a criminal offense punishable by up to 6 months in jail and a fine of up to $500; the statute gives no civil action of its own.

Montana makes it an offense to knowingly or purposely record, or cause to be recorded, a conversation by a hidden electronic or mechanical device that reproduces a human conversation without the knowledge of all parties to it.

The recording offense does not reach a public official or employee recording in the performance of official duty, a person speaking at a public meeting, a health care facility's or health agency's recording of an emergency telephone call, or persons given warning of the recording; once one person gives that warning, either party may record.

Montana separately makes it an offense to purposely intercept an electronic communication, any transfer of signs, signals, writing, images, sounds or data by wire, radio or a similar system, except by a public official or employee in the performance of official duty or where the persons were given warning of the interception. A conviction of either offense is punishable by a fine of up to $500 or up to six months in the county jail, or both, and the section gives no civil action of its own.

The section may not be construed to impose liability on an interactive computer service for content provided by another person. The provisions this entry describes came into force on different days.

The Montana Telemarketing Registration and Fraud Prevention Act requires a seller or telemarketer to register annually with the Department of Justice, with a $50,000 surety bond or an equal certificate of deposit, cash or government bond, before telemarketing, a campaign by telephone to induce a purchase that involves more than one call to a consumer.

Registration does not apply to, among others, a business-to-business sale, a person soliciting consumers who have an existing business relationship with or have previously purchased from the business, a religious, charitable, political, educational or other noncommercial solicitation, or a licensed securities, insurance or real estate professional or supervised financial organization; the sale of goods or services by an unregistered seller or telemarketer that must register is void.

When contacting a consumer, the caller must promptly and clearly disclose its identity, that the purpose of the call is to sell goods or services, the nature of the goods or services, and that no purchase or payment is necessary to win a prize or enter a prize promotion.

It is an abusive practice to engage in telemarketing to a residence outside 8 a.m. to 9 p.m. local time, to call someone who has said they do not wish to receive solicitation calls from that seller or telemarketer, to use threatening, intimidating, profane or obscene language or otherwise harass the called party, or to intentionally block caller identification, though substituting an accurate name and a working number is allowed.

A person harmed by an unfair, deceptive or prohibited practice may recover actual damages or $500, whichever is greater, plus attorney fees and court costs, and may obtain injunctive or declaratory relief for an abusive practice; the same conduct is also an absolute-liability criminal offense, punishable by a fine of up to $500 or six months in jail on a first conviction and up to $50,000 or five years in prison on a later one.

The Act separately imposes pre-payment disclosure duties (total cost, material restrictions, prize odds) and a cancellation right on the underlying sale. The provisions this entry describes came into force on different days.

Montana runs a no-call database of residential subscribers who object to telephone solicitations and bars a person or entity from making a telephone solicitation to a listed subscriber's line. A telephone solicitation is a voice communication over a telephone line from a live operator, an automatic dialing-announcing device or other means to encourage the purchase, rental of or investment in property, goods or services.

The term does not include a call made with the subscriber's prior express invitation or permission, a call by a person the subscriber has had a business contact with in the past 180 days or has a current business or personal relationship with, a fundraising call for a 501(c)(1) to (c)(6) organization made by a bona fide member, a call by an entity a federal agency requires to keep its own no-call list, a call by a natural person responding to a referral or working from their primary residence, or a licensed professional setting an appointment within that license.

A caller must state its identity at the start of every solicitation call to a residential subscriber and may not knowingly block or circumvent caller identification.

The department or a county attorney may seek an injunction and a civil penalty of up to $5,000 per knowing violation, and a residential subscriber who receives more than one violating solicitation within 12 months from the same caller may sue to enjoin it and recover the greater of actual loss from a knowing violation or $5,000 for each knowing violation, within 2 years, unless the caller shows it had implemented reasonable practices to prevent the violation.

Montana bars using an automated telephone system, device, or facsimile machine to select and dial numbers and play a recorded message that offers goods or services for sale, conveys information soliciting a purchase, solicits information, gathers data or statistics, or promotes a political campaign.

The prohibition does not reach a message informing a purchaser about the receipt, delivery or status of goods or services already purchased, a message responding to an inquiry the person initiated, other pertinent information where there is a preexisting business relationship, or a recorded message played after a live operator has obtained the called party's permission. A violation is punishable by a fine of not more than $2,500; the section creates no private civil action. No day on which the section came into force has been located.

Montana bars using a telephone facsimile machine, computer, or other device to send an unsolicited advertisement, material advertising the commercial availability or quality of property, goods, or a service, sent without the recipient's prior express invitation or permission, to a fax machine, except a public safety notice sent by a law enforcement or public safety entity. A violation is a violation of the Consumer Protection Act.

A consumer harmed by it may bring an individual, non-class action for actual damages or $500, whichever is greater, with up to treble damages when actual loss is under $100,000, plus attorney fees, alongside the Department of Justice's own enforcement.

Requires commercial entities that knowingly publish or distribute material harmful to minors, where a substantial portion of the site is such material, to use reasonable age verification methods before granting access, and bars retention of identifying information after verification.

Amends Montana's consumer privacy law to require a controller that knows or willfully disregards that a consumer is a minor under 18 to use reasonable care to avoid a heightened risk of harm from an online service, product, or feature, and to complete a data protection assessment for offerings that pose such risk to minors.