Student personal information

The law extends privacy rules to higher education beginning July 1, 2027, while strengthening existing protections for K–12 and early-learning students. It creates a private right of action for students or families actually harmed by violations.

What the law does ​

• Covers education-focused websites, online services, apps, mobile apps, cloud services, and entities working for their operators.
• Bars targeted ads, noneducational student profiling, most sales and disclosures of student information, and use of covered data to train or develop AI systems.
• Bars collection, use, retention, or disclosure of data about reproductive or sexual health, immigration status, or sexual orientation or gender identity; higher-education protections also cover precise geolocation.
• Requires reasonable data security, purpose-based retention limits, written retention policies, and deletion when the school or institution requests it.
• Lets eligible former students, pupils, parents, guardians, and education-rights holders request access to and deletion of certain information after 60 days out of enrollment.
• Allows harmed students or pupils to seek at least $500 per violation, actual and punitive damages, injunctions, and attorney’s fees after giving the operator 60 days’ notice and an opportunity to cure.

Who it affects ​

• Providers of digital educational software, digital course materials, cloud services, testing services, and other education-focused online tools.
• Preschool, prekindergarten, K–12, vocational, postsecondary, and graduate students, along with their families and education-rights holders.
• Schools, local educational agencies, preschools, and higher education institutions that use or oversee covered services.

Context ​

Higher-education provisions become operative July 1, 2027.