California · statute
SOPIPA: what it requires, and the records to keep
SOPIPA bars K-12 ed-tech operators from targeted advertising, building profiles of students for non-school purposes, selling student information, and most disclosures. It also requires reasonable security and deletion on request, and it governs how AI tutoring and learning tools can use student data.
01 / What it requires
What SOPIPA requires
Operators of websites, online services, apps and cloud services that know their service is used primarily for K-12 school purposes and was designed and marketed for those purposes.
- 01Do not use student information for targeted advertising, on the service or elsewhere.
- 02Do not amass a profile of a K-12 student except in furtherance of K-12 school purposes.
- 03Do not sell student information; disclose covered information only for listed purposes, with service providers contractually bound.
- 04Implement and maintain reasonable security procedures appropriate to the covered information.
- 05Delete a student's covered information when the school or district requests it; honor eligible parent or former-pupil deletion requests.
02 / AI work
Where it touches AI work
AI tutors and adaptive tools may use student data for adaptive or customized learning and to maintain and improve the operator's own service. Deidentified data may be used to improve educational products, but covered information cannot feed advertising or non-school profiling.
03 / Dates
The dates that matter
SB 1177 enacted
SOPIPA took effect
Attorney General issues ed-tech student privacy recommendations
ELPIPA extends similar rules to preschool ed-tech
04 / Enforcement
Who enforces it
The section has no express penalty or private right of action; the California Attorney General can enforce, for example through the Unfair Competition Law.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Service-provider contracts limiting use, onward disclosure and requiring security
- 02Deletion request log with completion dates
- 03Written security program covering student data
- 04Data-use inventory showing no ad targeting or non-school profiling
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
Does SOPIPA stop our ed-tech vendor from training AI on student data?+
Not outright, but it limits it. SOPIPA bars K-12 ed-tech operators from targeted advertising, building student profiles for non-school purposes, selling student information and most disclosures. It allows operators to use information to maintain, develop and improve their own service, to use deidentified data to improve educational products, and to use pupil data for adaptive or customized learning. Sharing data with an outside AI provider is allowed only under a contract that bars it from using the data for anything else. Training a general-purpose model goes beyond those carve-outs. Read the full answer
Which states have SOPIPA-style student-data-privacy laws?+
California's SOPIPA became a model for student data privacy laws in many other states, but those laws differ in scope, definitions and enforcement. There is no single official list, and the counts in published roundups vary with how a SOPIPA-style law is defined. To know what applies, read the statute in each state where your schools are, and check the data privacy agreement the district requires, which often adds duties beyond the statute. Read the full answer
SOURCES
Go back to the source
California Legislative Information
California.Public.Law
California Department of Justice, Office of the Attorney General
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: SOPIPA for education AI workflows · FSMB AI / state boards · State Bar AI Opinions · NYC Local Law 144 · Colorado AI Act · Texas TRAIGA · Utah AI Policy Act