State student privacy laws

FERPA regulates schools. COPPA regulates services for young children. Neither directly says what an edtech company may do with student data it collects across all ages. States filled that gap. Since 2014 most states have passed at least one student privacy law, and many of them regulate vendors directly, with their own definitions, prohibitions and contract requirements.

For a vendor, the state laws are often the stricter and more specific rules. They are also the ones district contract reviewers quote, because their state's law is the one they know best. A product that sells in several states needs to meet the strictest combination of them.

California's Student Online Personal Information Protection Act (Business and Professions Code section 22584) took effect in 2016 and became the template for many other states. It applies to operators of websites, online services and apps that know they are used primarily for K-12 school purposes and were designed and marketed for those purposes. It applies whether or not the operator has a contract with the school.

SOPIPA prohibits four things. An operator may not use student information to target advertising to students or families. It may not use information gathered through the service to build a profile of a student except for K-12 school purposes. It may not sell student information. And it may not disclose covered information except in specific allowed cases, such as to further school purposes, to comply with law, or to service providers bound by the same restrictions.

SOPIPA also requires operators to maintain reasonable security procedures appropriate to the nature of the information, and to delete a student's information when the school or district requests it. It permits operators to use de-identified information to improve their products and to demonstrate effectiveness, and it does not stop them from offering general-audience services or adaptive learning that is used for school purposes.

Many states copied SOPIPA's core prohibitions and then added their own requirements. The differences that cause the most work tend to fall into a few categories: whether the law requires a written contract with specific terms; whether the district must publish a list of its vendors and contracts; how fast the vendor must notify the district after a breach; whether parents gain new rights to inspect or delete data; and whether the law names a specific security standard.

A few examples show the range. California also has Education Code section 49073.1, which lists terms that must appear in contracts between local education agencies and third parties handling pupil records. New York's Education Law 2-d requires a parents' bill of rights for data privacy and security, and its regulations point vendors to the NIST Cybersecurity Framework. Illinois's Student Online Personal Protection Act (SOPPA) requires written agreements, public posting of vendor lists and contracts, and breach notification within set time frames. Treat these summaries as starting points and read the current text of each law before relying on it.

The fastest way to see the landscape is the state law tracker maintained by Student Privacy Compass, which lists laws by state and year. State legislatures amend these laws regularly, so check the date on anything you rely on.

A newer group of state laws and guidance documents addresses AI in schools directly, through requirements for AI use policies, restrictions on automated decision making about students, and disclosure duties when students interact with AI. This area is moving quickly and varies a lot from state to state.

The SOPIPA-style prohibitions already constrain AI features. Using student information to build a profile for anything other than K-12 school purposes is prohibited, which limits how a vendor can use student data to train or personalize models for purposes beyond the school's. Disclosure to a model provider has to fit one of the allowed cases, typically as a service provider bound by the same restrictions.

The matrix is the main output of this module and something a vendor reuses in every sales conversation. Rows are the states you sell in. Columns are the questions district reviewers ask: covered entities and scope, prohibited uses, required contract terms, breach notification timeline, deletion requirements, security standard, parent rights, AI-specific rules and the citation.

Keep it short, cite the statute for every cell, and record the date you checked. A matrix that is accurate for five states is more useful than a summary of fifty that nobody trusts.