Montana Pupil Online Personal Information Protection Act
MT Pupil Online Privacy Act
Students · Children
Montana's student privacy law bars edtech operators from targeted advertising, profiling pupils for non-school purposes, selling pupil information, and most disclosures of protected student information, and requires reasonable security and deletion on school request. It also sets mandatory terms for school-district contracts with vendors that store or use pupil records.
- Where
- Montana
- Citation
- Mont. Code Ann. 20-7-1323 to 20-7-1326
- Status
- In force
- Last amended
- 2025-10-01
- Enforced by
- County attorneys (criminal misdemeanor); contract voidness between parties
- People can sue
- No
- Penalties
- Operator violations are misdemeanors punishable by a fine of $200 to $500 (20-7-1325(8)); noncompliant district-vendor contracts are void if not cured after notice (20-7-1326(3)).
- Applies to
- Operators of K-12 online applications who know or should know the application is used primarily for K-12 school purposes (20-7-1324(4), 20-7-1325)
- School districts contracting with third parties for pupil-record storage or digital educational software, and those third parties (20-7-1326)
- Does not apply to general-audience websites, services or apps (20-7-1325(7))
Practices it requires
- Do not target advertising on the K-12 application, or elsewhere using information gained through it; do not build pupil profiles except for K-12 school purposes; do not sell pupil information.Mont. Code Ann. 20-7-1325(1)(a)-(c)
- Disclose protected information only for K-12 school purposes, legal compliance, judicial process, safety or security, or to contractually restricted service providers.Mont. Code Ann. 20-7-1325(1)(d), (3)
- District-vendor contracts must state that records remain district property, bar non-contract uses and targeted advertising, provide review and correction procedures, describe security measures, and require deletion at contract end.Mont. Code Ann. 20-7-1326(2)(a), (c)-(e), (g), (i) · Only if: School district contracts with a third party for pupil records or digital educational software
Security duties
- Implement reasonable security procedures appropriate to protected information, and delete a pupil's protected information when the school or district requests.Mont. Code Ann. 20-7-1325(2)
Breach duties
- District-vendor contracts must describe procedures for notifying the affected parent, guardian or adult pupil of an unauthorized disclosure of pupil records.Mont. Code Ann. 20-7-1326(2)(f)
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Enacted by Ch. 369, L. 2019; 20-7-1326(4) references contracts in effect before May 7, 2019, suggesting an effective-on-approval date around May 2019, but this was not confirmed so effective_date is null. | 20-7-1324 was amended by Ch. 329, L. 2025 and Ch. 567, L. 2025 (SB 297); the 2025-10-01 date assumes the default October 1 rule for both.
Research reference, not legal advice.