Does SOPIPA stop our ed-tech vendor from training AI on student data?

01 / The answer

The short answer

Not outright, but it limits it. SOPIPA bars K-12 ed-tech operators from targeted advertising, building student profiles for non-school purposes, selling student information and most disclosures. It allows operators to use information to maintain, develop and improve their own service, to use deidentified data to improve educational products, and to use pupil data for adaptive or customized learning. Sharing data with an outside AI provider is allowed only under a contract that bars it from using the data for anything else. Training a general-purpose model goes beyond those carve-outs.

02 / The rule

What SOPIPA requires

SOPIPA bars K-12 ed-tech operators from targeted advertising, building profiles of students for non-school purposes, selling student information, and most disclosures. It also requires reasonable security and deletion on request, and it governs how AI tutoring and learning tools can use student data.

1. 01Do not use student information for targeted advertising, on the service or elsewhere.
2. 02Do not amass a profile of a K-12 student except in furtherance of K-12 school purposes.
3. 03Do not sell student information; disclose covered information only for listed purposes, with service providers contractually bound.
4. 04Implement and maintain reasonable security procedures appropriate to the covered information.

03 / Records

Records to keep

1. 01Service-provider contracts limiting use, onward disclosure and requiring security
2. 02Deletion request log with completion dates
3. 03Written security program covering student data
4. 04Data-use inventory showing no ad targeting or non-school profiling

SOURCES

Go back to the source

RELATED

Related: SOPIPA: the full guide · Which states have SOPIPA-style student-data-privacy laws?