Privacy Law Library

Genetic Information Privacy Act (including 2025 neurotechnology data amendments)

MT GIPA

Genetic · Health · Biometric

Montana's direct-to-consumer genetic privacy law requires consent, notice, security and consumer control over genetic data and biological samples. A 2025 amendment (SB 163) extended every protection to neurotechnology (neural) data, making Montana one of the first states to regulate neural data this way. It also bars storing covered data in sanctioned or foreign-adversary countries and requires consent to store it outside the United States.

Where
Montana
Citation
Mont. Code Ann. 30-23-101 to 30-23-106
Status
In force
In force since
2023-10-01
Last amended
2025-10-01
Enforced by
Montana Attorney General (sole authority; 30-23-106(1))
People can sue
No
Penalties
Attorney General may recover actual damages to the consumer, costs, reasonable attorney fees, and $2,500 per violation of 30-23-104 (30-23-106(3)).
Applies to
  • Entities that offer consumer genetic testing products or services directly to consumers, or that collect, use, or analyze genetic data (30-23-102(4))
  • Since SB 163 (Ch. 345, L. 2025), the same duties cover neurotechnology data, meaning information captured by devices that record, interpret or alter nervous-system activity, excluding downstream 'nonneural' information such as pupil dilation or breathing rate (30-23-102(9)-(10))
  • Montana residents' data (30-23-102(2))
  • Excludes HIPAA PHI handled with separate informed consent, IRB/FDA-governed research with express consent, government agency uses (which must follow specific law or warrant/subpoena), and de-identified data used for research (30-23-103)

What a privacy notice must say

  • Provide a high-level privacy policy overview and a prominent, publicly available privacy notice covering collection, consent, use, access, disclosure, transfer, security, retention and deletion of genetic or neurotechnology data.Mont. Code Ann. 30-23-104(1)

Rights it gives people

  • Provide a process for consumers to access and delete their data, revoke consent, and have their biological sample destroyed (with limited waivers for clinical research and CLIA lab retention).Mont. Code Ann. 30-23-104(6)-(8)

Practices it requires

  • Obtain initial express consent describing uses, who in the entity can see results, and how data may be shared.Mont. Code Ann. 30-23-104(2)
  • Obtain separate express consent for third-party transfers (naming the recipient), secondary uses, and retention of biological samples; informed express consent for research transfers; and express consent for genetic-based marketing and for any sale of the data.Mont. Code Ann. 30-23-104(3)
  • Disclose data to law enforcement or other government agencies without consent only under valid legal process per 44-6-104.Mont. Code Ann. 30-23-104(4)
  • Do not disclose genetic or neurotechnology data to health, life or long-term care insurers or to the consumer's employer without express consent.Mont. Code Ann. 30-23-105(2)
  • Do not store covered data or samples in OFAC-sanctioned or foreign-adversary countries; transfer or store them outside the U.S. only with the resident's consent.Mont. Code Ann. 30-23-104(10)

Security duties

  • Develop, implement and maintain a comprehensive security program protecting genetic or neurotechnology data against unauthorized access, use or disclosure.Mont. Code Ann. 30-23-104(5)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Effective dates rest on Montana's default October 1 rule (1-2-201): SB 351 (Ch. 768, L. 2023) was signed in 2023 per secondary sources, and the SB 163 enrolled text (fetched) has no effective-date section. The 2023 enrolled bill text itself could not be fetched (leg.mt.gov bill PDF returned 404). | Heading of the part says 'biometric samples' and 'biometric data' only in 30-23-104(10); the Act does not otherwise regulate biometric identifiers.

Research reference, not legal advice.