Privacy Law Library

Montana Pupil Online Personal Information Protection Act

MT Pupil Online Privacy Act

Students · Children

Montana's student privacy law bars edtech operators from targeted advertising, profiling pupils for non-school purposes, selling pupil information, and most disclosures of protected student information, and requires reasonable security and deletion on school request. It also sets mandatory terms for school-district contracts with vendors that store or use pupil records.

Where
Montana
Citation
Mont. Code Ann. 20-7-1323 to 20-7-1326
Status
In force
Last amended
2025-10-01
Enforced by
County attorneys (criminal misdemeanor); contract voidness between parties
People can sue
No
Penalties
Operator violations are misdemeanors punishable by a fine of $200 to $500 (20-7-1325(8)); noncompliant district-vendor contracts are void if not cured after notice (20-7-1326(3)).
Applies to
  • Operators of K-12 online applications who know or should know the application is used primarily for K-12 school purposes (20-7-1324(4), 20-7-1325)
  • School districts contracting with third parties for pupil-record storage or digital educational software, and those third parties (20-7-1326)
  • Does not apply to general-audience websites, services or apps (20-7-1325(7))

Practices it requires

  • Do not target advertising on the K-12 application, or elsewhere using information gained through it; do not build pupil profiles except for K-12 school purposes; do not sell pupil information.Mont. Code Ann. 20-7-1325(1)(a)-(c)
  • Disclose protected information only for K-12 school purposes, legal compliance, judicial process, safety or security, or to contractually restricted service providers.Mont. Code Ann. 20-7-1325(1)(d), (3)
  • District-vendor contracts must state that records remain district property, bar non-contract uses and targeted advertising, provide review and correction procedures, describe security measures, and require deletion at contract end.Mont. Code Ann. 20-7-1326(2)(a), (c)-(e), (g), (i) · Only if: School district contracts with a third party for pupil records or digital educational software

Security duties

  • Implement reasonable security procedures appropriate to protected information, and delete a pupil's protected information when the school or district requests.Mont. Code Ann. 20-7-1325(2)

Breach duties

  • District-vendor contracts must describe procedures for notifying the affected parent, guardian or adult pupil of an unauthorized disclosure of pupil records.Mont. Code Ann. 20-7-1326(2)(f)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Enacted by Ch. 369, L. 2019; 20-7-1326(4) references contracts in effect before May 7, 2019, suggesting an effective-on-approval date around May 2019, but this was not confirmed so effective_date is null. | 20-7-1324 was amended by Ch. 329, L. 2025 and Ch. 567, L. 2025 (SB 297); the 2025-10-01 date assumes the default October 1 rule for both.

Research reference, not legal advice.