Since March, at least 10 states—Arizona, Connecticut, Colorado, Hawaii, Kansas, New Hampshire, Tennessee, Utah, Virginia, and West Virginia—have added laws to protect the privacy of students.

  • Arizona: On May 18, the Arizona governor approved H.B. 2088, which requires informed consent before children can be subjected to invasive surveys. The bill requires schools to obtain written informed consent from parents before administering any survey that solicits personal information from students. The bill became effective on August 6.
  • Connecticut: On June 9, the Connecticut governor signed into law H.B. 5469, which requires businesses that collect and maintain educational records to take steps to safeguard student data and to refrain from using it for targeted advertising purposes. The bill is specifically targeted at educational software and services contractors, as well as website, online services, and mobile applications operators. The bill becomes effective on October 1.
  • Colorado: On June 10, the Colorado governor signed H.B. 1423, which adds to the existing Colorado laws pertaining to student data security by adopting additional duties with which the state Board of Education, Department of Education, school districts, boards of cooperative services, and charter schools must comply to increase the transparency and security of student information. The bill became effective on August 10.
  • Hawaii: On May 2, the Hawaii governor signed S.B. 2607 into law, which limits the ways in which the operator of a website, online service, online application, or mobile application working with the Department of Education can use student data. The bill took effect upon its approval.
  • Kansas: On May 6, Kansas enacted H.B. 2008, which creates the Student Online Personal Protection Act. The bill prohibits an operator of an educational online product from knowingly engaging in targeted advertising on the operator's educational online product, using information to create a profile about the student, selling or renting student information to a third party, and disclosing student information, except as provided. The law became effective on July 1.
  • New Hampshire: On May 5, the New Hampshire governor signed H.B. 1497 into law, which requires school districts to destroy personal information of students following the completion and verification of certain tests and gives students taking college entrance exams the option to have all of their personal information destroyed by the testing entity following the completion and verification of the test. The bill became effective on July 4.
  • Tennessee: On April 12, the Tennessee governor signed H.B. 1931 into law, which prohibits an operator of an internet website, service, or application primarily used for K–12 school purposes from engaging in targeted advertising based on any information the operator acquired because of the website, service, or application, using information created or gathered by the operator's site, service, or application to create a profile about a student except in furtherance of K–12 school purposes, and selling or renting a student's information. The bill became effective on July 1.
  • Utah: On March 23, the Utah governor signed H.B. 358 into law, which enacts the Student Data Privacy Act, provides for student data protection governance at the state and local levels, enacts requirements for data protection and maintenance by state and local education entities and third-party contractors, provides for penalties, and enacts a requirement for notice given to a parent or guardian before a student is required to take a certain type of survey. The bill became effective on May 10.
  • Virginia: On March 11, the Virginia governor signed H.B. 749, which makes several changes to the provisions relating to the protection of student personal information by school service providers, including defining targeted advertising and clarifying that other provisions of law do not prohibit school service providers from performing certain acts, including disclosing student personal information to ensure legal or regulatory compliance. The bill became effective on July 1.
  • West Virginia: On March 25, the West Virginia governor signed H.B. 4261 into law, which prohibits the West Virginia Department of Education from transferring confidential student information or certain redacted data to any federal, state, or local agency or other person or entity (subject to certain exceptions); allows the ACT or the College Board to use certain information; requires written consent if information classified as confidential is necessary; and requires that the consent contain a detailed list of the confidential information required and the purpose of its requirement. The bill became effective in June.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.