Defense · SOPIPA

SOPIPA for defense AI workflows

SOPIPA in defense AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Start free Open the Console

Legal forceBinding law

Applies from1 Jan 2016

SectorDefense

Checked21 Oct 2026

01 / The rule

What SOPIPA requires

Operators of websites, online services, apps and cloud services that know their service is used primarily for K-12 school purposes and was designed and marketed for those purposes.

01Do not use student information for targeted advertising, on the service or elsewhere.
02Do not amass a profile of a K-12 student except in furtherance of K-12 school purposes.
03Do not sell student information; disclose covered information only for listed purposes, with service providers contractually bound.
04Implement and maintain reasonable security procedures appropriate to the covered information.
05Delete a student's covered information when the school or district requests it; honor eligible parent or former-pupil deletion requests.

02 / In this sector

In a defense AI workflow

AI tutors and adaptive tools may use student data for adaptive or customized learning and to maintain and improve the operator's own service. Deidentified data may be used to improve educational products, but covered information cannot feed advertising or non-school profiling.

Usually asked by

Program office leads and ATO-package owners.

Named alongside

NIST AI RMF · DoW RAI · OMB M-25-21.

Sector pagePlanisphere for defense

03 / Records

Records to keep

01Service-provider contracts limiting use, onward disclosure and requiring security
02Deletion request log with completion dates
03Written security program covering student data
04Data-use inventory showing no ad targeting or non-school profiling

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES

Go back to the source

PRIMARY

Business and Professions Code section 22584

California Legislative Information

SECONDARY

California Business and Professions Code section 22584 (current text mirror)

California.Public.Law

GUIDANCE

Ready for School: Recommendations for the Ed Tech Industry to Protect the Privacy of Student Data

California Department of Justice, Office of the Attorney General