Montana's Genetic Information Privacy Act: SB 351, the 2025 Amendments and Who It Reaches

How SB 351 Became Law in 2023

The act is codified as Title 30, chapter 23, part 1 of the Montana Code Annotated. Section 30-23-101 supplies the short title, "Genetic Information Privacy Act," and each of the six sections carries the history note "En. Sec. [number], Ch. 768, L. 2023." Sections 101 through 105 add "amd. ... Ch. 345, L. 2025"; the enforcement section, 30-23-106, has not been amended.

Chapter 768 was Senate Bill 351, sponsored by Sen. Daniel Zolnikov. A September 2023 history of the bill prepared for the Economic Affairs Interim Committee records its path. It passed the Senate 50 to 0 in March 2023 and the House with amendments, after which the Senate refused to concur and a free conference committee met on May 1. Both chambers adopted the committee's report on May 2, 2023, "the same day the Legislature adjourned," and the Governor signed the bill on June 7, 2023. The memo describes SB 351 as revising laws related to biometric privacy as well as creating the Act.

The free conference committee rewrote the bill. According to the memo, its amendments replaced the defined term "company" with "entity" and added a definition of governmental agency, turned a limitations section into an exceptions section, let a parent, guardian or power of attorney consent for a consumer, required that the third party's name be disclosed in transfer consents, "expands the restriction on where biometric data may be stored," and gave the attorney general sole enforcement authority. A second, conceptual amendment struck a definition of deidentified data and added definitions of processor and third party.

The memo also records that six stakeholders asked the Governor for a veto. Their letter, as the memo summarizes it, argued that the bill applied to any organization handling genetic data, made no exception for deidentified data or for HIPAA-regulated entities such as hospitals and universities, and would burden research by requiring the name of each third-party recipient. Stakeholders asked the interim committee to review the free conference amendments, which the memo says "were not noticed to the public in time for testimony."

An Act That Reaches Beyond Testing Companies

The House committee's version of SB 351, quoted in the memo, would have defined a "company" as an entity offering consumer genetic testing directly, or one handling data "that resulted from a direct-to-consumer genetic testing product or service." The enacted definition dropped that link. Under 30-23-102(4), an "entity" is a partnership, corporation, association, "or public or private organization of any character" that either offers consumer genetic testing directly to a consumer or "collects, uses, or analyzes genetic data."

The protected person is narrower than the regulated one. A "consumer" is "an individual who is a resident of this state." Genetic data means data "concerning a consumer's genetic characteristics," including raw sequence data, genotypic and phenotypic information derived from it, and self-reported health information the entity uses for research or product development and analyzes with the sequence data. Genetic testing includes "an interpretation of a consumer's genetic data," not only a laboratory test.

Section 30-23-103 answers part of the veto letter. As amended by SB 163 of 2025, it now excepts protected health information held by HIPAA covered entities and business associates (on conditions), research conducted under the federal Common Rule, ICH good clinical practice or FDA human-subject rules, uses by a governmental agency, and deidentified genetic data obtained from a third party for internal, medical or scientific research. The site's explainer on state direct-to-consumer genetic testing laws compares those exceptions, and the 2025 extension to neurotechnology data, with four other states.

Consent Requirements

"Express consent" is defined as "a consumer's affirmative response to a clear, meaningful, and prominent notice" about collection, use or disclosure "for a specific purpose." Section 30-23-104 then sets tiers. An initial express consent, which a parent, guardian or power of attorney may give, must describe the entity's uses, specify the categories of people inside the entity with access to test results, and specify how data may be shared. Separate express consent is needed for a transfer to a third party other than a processor, "including the name of the third party"; for uses beyond the primary purpose "and inherent contextual uses"; and for keeping a biological sample after the initial test.

Two further consents follow: informed express consent for transfers to third parties for research, and express consent for marketing based on the data, third-party marketing based on a test purchase, and "sale or other valuable consideration" of the data. The marketing clause excludes customized content or offers on the entity's own websites and applications where it has the first-party relationship.

Access, Deletion and Security

Subsection (6) requires a process for a consumer to access the data, delete it, revoke any consent and "request and obtain the destruction" of a biological sample. Subsection (5) requires the entity to "develop, implement, and maintain a comprehensive security program" against unauthorized access, use or disclosure, and subsection (1) requires both a high-level privacy policy overview and a prominent, publicly available privacy notice. Subsections (7) and (8) waive the access and destruction rights for clinical research participants and, temporarily, for certain clinical laboratories; subsection (9) states that the clinical-trial consent requirements "supersede all exceptions to, and waivers of, informed consent" in the federal Common Rule at 45 CFR part 46.

Disclosure to Law Enforcement

Subsection (4) of 30-23-104 requires compliance with 44-6-104 "requiring a valid legal process" before disclosing genetic or neurotechnology data to law enforcement or any other government agency without express consent. Section 44-6-104 predates the Act; its history note begins "En. Sec. 1, Ch. 413, L. 2021." It bars a government entity from obtaining search results from a consumer DNA database, defined as one "maintained by a private entity that provides direct-to-consumer genetic testing services," without a search warrant or investigative subpoena issued by a court on probable cause, unless the consumer previously waived privacy in the information. Familial searches and partial-match searches require the warrant or subpoena with no waiver alternative. SB 163 extended the section to neurotechnology databases.

Section 30-23-103(2) adds a parallel rule for agencies themselves: any collection, storage, use or dissemination of genetic or neurotechnology data by a governmental agency must follow "a specific state law" or be executed through a warrant or investigative subpoena under 46-4-301. The interim memo states that the 2023 act excepted governmental agencies "until June 1, 2025"; the 2025 enrolled text shows subsection (2) revised to drop that start date, and the codified subsection now opens without it.

Insurers, Employers and Foreign Storage

Section 30-23-105(2) provides that, "Notwithstanding any other provisions in 30-23-104," an entity may not disclose genetic or neurotechnology data to a health, life or long-term care insurer, "or to any employer of the consumer," without the consumer's express consent.

Subsection (10) of 30-23-104 is a data-location rule. Genetic or neurotechnology data and "biometric samples" of Montana residents collected in the state may not be stored in any country "currently sanctioned in any way" by the federal Office of Foreign Assets Control or "designated as a foreign adversary under 15 CFR 7.4(a)." The same subsection permits transfer or storage outside the United States only "with the consent of the resident." The memo shows the House committee version had instead required storage "within the territorial boundaries of the United States." Part 1 does not define "biometric".

Enforcement

Section 30-23-106 gives the attorney general "the sole authority to enforce this part" through a civil enforcement action. In such an action the attorney general may recover actual damages to the consumer, costs, reasonable attorney fees "and $2,500 for each violation of 30-23-104." The per-violation amount is tied to section 104 alone. For a violation of the insurer and employer rule in 30-23-105, the listed recoveries are actual damages, costs and fees. Because that authority is "sole," the part's text leaves no room for a private action.

No enforcement action under the Act was located. The Montana Department of Justice website refused automated requests for this post, so its press releases could not be read, and web searches returned no complaint, settlement or court decision applying chapter 23. That describes what could be retrieved, not a finding that none exists.

Frequently Asked Questions