Which states have SOPIPA-style student-data-privacy laws?

01 / The answer

The short answer

California's SOPIPA became a model for student data privacy laws in many other states, but those laws differ in scope, definitions and enforcement. There is no single official list, and the counts in published roundups vary with how a SOPIPA-style law is defined. To know what applies, read the statute in each state where your schools are, and check the data privacy agreement the district requires, which often adds duties beyond the statute.

02 / The rule

What SOPIPA requires

SOPIPA bars K-12 ed-tech operators from targeted advertising, building profiles of students for non-school purposes, selling student information, and most disclosures. It also requires reasonable security and deletion on request, and it governs how AI tutoring and learning tools can use student data.

1. 01Do not use student information for targeted advertising, on the service or elsewhere.
2. 02Do not amass a profile of a K-12 student except in furtherance of K-12 school purposes.
3. 03Do not sell student information; disclose covered information only for listed purposes, with service providers contractually bound.
4. 04Implement and maintain reasonable security procedures appropriate to the covered information.

03 / Records

Records to keep

1. 01Service-provider contracts limiting use, onward disclosure and requiring security
2. 02Deletion request log with completion dates
3. 03Written security program covering student data
4. 04Data-use inventory showing no ad targeting or non-school profiling

SOURCES

Go back to the source

RELATED

Related: SOPIPA: the full guide · Does SOPIPA stop our ed-tech vendor from training AI on student data?