Montana

The Digital Likeness and Voice Rights Act gives a Montana resident, or a person domiciled in Montana at death, a property right in their own name, voice, and visual likeness, freely transferable and descendible, that does not expire on death and continues for 20 years afterward in the rights holder's executors, heirs, transferees, or devisees.

A person is liable for actual damages and any profits from the unauthorized use if, without the consent of the individual or the rights holder, the person distributes, transmits, or otherwise makes available an algorithm, software, tool, or other technology whose primary purpose, known to that person, is to produce an unauthorized digital voice or visual depiction of a particular, identified individual for commercial use, or if the person intentionally publishes or distributes such a depiction for commercial use knowing it is unauthorized.

A digital voice or visual depiction is one newly created or altered using digital technology so that it is nearly indistinguishable from the individual's actual voice or likeness and a reasonable person would believe it genuine. A person who held an objectively reasonable belief that the material did not qualify as an unauthorized depiction is not liable for damages.

The action may be brought by the individual or by an assignee, transferee, or exclusive licensee of the rights, within 4 years of discovery of the violation, and does not apply to a provider of broadband internet access service.

Exemptions, to the extent the use is protected by the First Amendment and the Montana Constitution's free expression clause, cover news-gathering, public affairs and sports reporting, comment, criticism, scholarship, satire and parody, and an individual's authentic self-representation in an audiovisual work. The act took effect January 1, 2026 under its own effective-date clause. It directs its own codification as part of Title 30, chapter 14.

A 2025 amendment (HB 514) added digitally fabricated images to the privacy in communications statute's existing ban on nonconsensual intimate images: a person may not publish, distribute, or disclose a real or digitally fabricated image or video of an identifiable person showing genitals or an exposed female breast, or the person depicted engaged in a real or simulated sexual act, without that person's consent, with the purpose to terrify, intimidate, threaten, harass, or injure the person or to obtain money or other valuable consideration; nor may a person possess and threaten to disclose such an image or video with the purpose to obtain money or other valuable consideration from the person depicted.

'Digitally fabricated' means using a technical means, such as artificial intelligence, to create media that realistically misrepresents an identifiable individual as engaging in conduct in which the individual did not engage. A first offense under these provisions is a misdemeanor punishable by a fine up to $500 or up to 6 months in county jail, or both; a second or subsequent offense is a felony punishable by up to 5 years imprisonment or a fine up to $25,000, or both. The section does not impose liability on an interactive computer service for content another person provided.

The sexual abuse of children statute makes it an offense to knowingly possess, process, develop, print, publish, transport, distribute, sell, exhibit, or advertise a visual or print medium in which a child is engaged in actual or simulated sexual conduct, and its possession offense expressly reaches computer-generated child pornography.

That term covers a depiction of an actual minor created, adapted, or modified to portray the minor engaged in prohibited sexual conduct, a depiction of an actual adult altered to portray the adult as a minor engaged in such conduct, or a depiction that is virtually indistinguishable from an actual minor engaged in such conduct, so an entirely synthetic, AI-generated image falls within the offense on the same terms as a photograph.

A general conviction carries life imprisonment or up to 100 years and a fine up to $10,000; a conviction resting solely on possession of the prohibited material carries a fine up to $10,000 or up to 10 years imprisonment, or both; and where the victim is 12 years of age or younger and the offender is 18 or older, the offender faces a mandatory 100-year term, with the first 25 years neither suspendable nor parole-eligible, a fine up to $50,000, and lifetime supervision after release.

The Right to Compute Act declares that the rights to acquire, possess, and protect property and the freedom of expression under the Montana Constitution embody a fundamental right to own and make use of computational resources, including artificial intelligence systems, and that a government action restricting that use must be limited to what is demonstrably necessary and narrowly tailored to a compelling government interest.

The Act's one affirmative duty on a private actor falls on a deployer, an individual, company, or other organization that utilizes an artificial intelligence system. That duty applies when the deployer's system is a critical artificial intelligence system, one designed and deployed to make or be a substantial factor in making a consequential decision, and that system controls a critical infrastructure facility in whole or in part.

That deployer must develop, after deploying the system, a risk management policy that considers the National Institute of Standards and Technology's AI risk management framework, the ISO/IEC 4200 artificial intelligence standard, or another nationally or internationally recognized framework, and a plan already prepared to meet a federal requirement satisfies this duty. The Act preserves existing intellectual property remedies. It states that nothing in it preempts federal law.

It took effect on passage and approval under its own effective-date clause, though the enrolled act text does not print the specific day of approval.

Within 60 days of the start of voting in an election where a candidate appears on the ballot, a person, corporation, committee, political party, or other entity working in an official election capacity may not pay for or sponsor an election or electioneering communication it knew or should have known is a deepfake of a candidate or political party, unless the communication carries a prescribed disclosure that it has been significantly edited by artificial intelligence and depicts speech or conduct that falsely appears to be authentic or truthful.

The disclosure must meet format rules by medium (minimum font size, screen height, or audio duration and placement), and the prohibition exempts bona fide news coverage with an AI-use disclaimer, satire or parody, certain broadcaster and distribution platform conduct, and an interactive computer service for content another party provided.

A candidate or political party depicted may seek injunctive relief and, on proof of a violation by clear and convincing evidence, recover actual damages, up to $10,000 in punitive damages, and attorney fees and costs.

A first sufficiency finding by the commissioner of political practices draws a civil penalty; a second draws misdemeanor prosecution (fine up to $500 or up to 6 months in county jail, or both); a third draws felony prosecution (fine up to $5,000 or up to 2 years in state prison, or both).

A First Amendment challenge to this scheme, brought over mailers depicting two primary candidates, was argued before the United States District Court for the District of Montana in August 2026, and a ruling remained pending as of the date shown; the law remains in force and enforced pending that ruling.

A person or business required to notify Montana residents of a breach of security must simultaneously submit an electronic copy of the notification to the Attorney General's consumer protection office; notice must be made without unreasonable delay, consistent with law-enforcement needs and the measures necessary to determine the breach's scope. This provision is in force under the current codified text; no dated original commencement is established, so no effective date is recorded here.

MCDPA governs private-sector processing of Montana consumers' personal data. Originally enacted as H.B. 351 (2023 session), 2023 Mont. Laws ch. 681, effective October 1, 2024. Substantially amended by S.B. 297 (2025 session), 2025 Mont. Laws ch. 567, signed May 8, 2025, effective October 1, 2025, which lowered applicability thresholds, added minors' privacy provisions, and added privacy-notice content requirements.

General applicability is set at section 30-14-2803, controller duties at section 30-14-2811 and processor duties at section 30-14-2813.

MCDPA gives a Montana consumer the right to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and qualifying profiling. A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available, and must decide an appeal of a refusal within 60 days.

The Montana Attorney General has exclusive authority to enforce MCDPA; the chapter creates no private right of action. Civil penalties run up to $7,500 per violation.

As currently codified, section 30-14-2817 (Enforcement) contains no notice-and-cure text in its five subsections following the S.B. 297 amendment, yet section 30-14-2820(2) cross-references a 'thirty-day period described in 30-14-2817(3),' which as read describes the Attorney General's civil-investigative-demand authority rather than a cure mechanism.

That cross-reference is an open citation-accuracy question rather than a resolved one; the operative, secondary-corroborated finding is that no mandatory pre-action cure right survives as of October 1, 2025, so a first violation can lead directly to a penalty.

MCDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, the processing of genetic or biometric data to uniquely identify an individual, a known child's data, and precise geolocation data as sensitive data.

'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, such as a fingerprint or voiceprint, and the raw recording is excluded, but data generated from it is covered once generated to identify a specific individual, matching the Connecticut, Oregon, Delaware, and Nebraska structure.

Under Title 45 (Crimes), Chapter 6 (Offenses Against Property), Part 3 (Theft and Related Offenses), a person commits the offense of unlawful use of a computer when, knowingly or purposely and without authorization, they obtain the use or access of any computer, computer system, or computer network without consent of the owner, among other prohibited acts such as destroying or rendering data inoperable, introducing a computer contaminant, or misusing another person's credentials to track their movements or monitor communications without consent.

The offense is framed and graded as a property crime, with penalties tied to the dollar value of property affected, so a scraper causing no measurable loss sits awkwardly within the statute's own penalty structure even where the access element is otherwise met. No reported Montana case applies this section to scraping or public-page access.

Section 30-14-2802(26) excludes de-identified data and publicly available information from personal data, defined as information lawfully made available through government records or widely distributed media, or that a controller has a reasonable basis to believe a consumer lawfully made public. This is the ordinary, unqualified exemption, with no biometric carve-back of the kind Maryland's MODPA carries.

The Act was enacted as Senate Bill 384 (2023 Regular Session), Chapter 681, Laws of 2023, per Montana's Senate-Bill-to-Chapter-Number-2023 record and every codified section's History line.

Section 30-14-2803, as amended by Senate Bill 297 (2025 Regular Session, Chapter 567), lowered the Act's applicability thresholds to a person controlling or processing personal data of at least 25,000 consumers, or 15,000 consumers while deriving more than 25% of gross revenue from selling personal data, roughly half the original 50,000 and 25,000 thresholds, and eliminated the prior notice-and-cure period for enforcement.

The 2023 Act's October 1, 2024 effective date and SB 297's October 1, 2025 effective date for its amendments are as reported consistently by secondary trackers; the enrolled session-law texts have not been located. Enforcement is by the Montana Attorney General; there is no private right of action.

Requires commercial entities that knowingly publish or distribute material harmful to minors, where a substantial portion of the site is such material, to use reasonable age verification methods before granting access, and bars retention of identifying information after verification.

Amends Montana's consumer privacy law to require a controller that knows or willfully disregards that a consumer is a minor under 18 to use reasonable care to avoid a heightened risk of harm from an online service, product, or feature, and to complete a data protection assessment for offerings that pose such risk to minors.