Across the country, school districts use technology to facilitate learning and assist in classroom management. From tracking grades and communicating with parents to monitoring bathroom breaks, technology is everywhere in our schools. But as technology becomes more prevalent in the classroom, what does that mean for student data privacy?

Federal Laws Governing Student Data Privacy

There are several federal laws that govern student data privacy. The Family Educational Rights and Privacy Act (FERPA) protects student educational records and requires the consent of parents or students age 18 or older to consent to the release of education records. The Protection of Pupil Rights Amendment (PPRA) requires parental consent for any federally funded student survey or evaluation that requires the student to provide sensitive information. Lastly, the Children’s Online Privacy Protection Act (COPPA) regulates companies collecting data about kids under the age of thirteen. Under the law, educational products may not require parental consent, and instead, schools can consent on behalf of parents. Importantly, the Federal Trade Commission (FTC) is considering updating COPPA’s regulations. The FTC requested comments on the rule in July and held a workshop in October.

Legislative Activity on the State Level

While these federal laws play an important role in regulating student data privacy, most of the legislative activity is happening on the state level. Since 2014, 40 states and Washington, D.C. have enacted legislation related to student data privacy. Generally, student data privacy laws establish safeguards for protecting student data, provide transparency to parents and students on the data being collected and how it is being used and protected, and prohibit technology providers and third party vendors from selling or profiting from that data or using it to advertise.

The latter continues to be a focus for many state legislatures. For example, in 2019, Montana passed the Montana Pupil Online Personal Information Protect Act. Among other things, the act prohibits third party vendors from engaging in targeted advertising, selling students’ information, and using the information gathered “except in furtherance of K-12 school purposes.” Similarly, Nevada passed a bill in 2019 that revises its prohibition on targeted advertising by a school service provider. The law prohibits the provider from targeted advertising if it is based on information gathered from its school service.

While New York banned the sale of student information and its use for marketing purposes in 2014, a bill introduced in October in both chambers aims to prohibit the disclosure of personally identifiable student information for any commercial or for-profit activity or use. Additionally, there is a bill in Pennsylvania that prohibits the use of student data for the purposes of targeted marketing unless it is “absolutely necessary for education progression.”

As technology is rapidly improving and expanding, state legislatures are working to update student privacy laws. As state legislatures convene in 2020, we can expect to see more bills regulating student data privacy.

Industry Impact

"Data privacy has been and continues to be an issue assessment providers like ACT are engaged in every year across state legislatures. The confidential and complex nature of assessing student achievement requires the careful maintenance and use of longitudinal student information for internal research to ensure that we are able to develop valid, reliable, and fair measures of student performance. Our goal across states has been to educate them on how student data is protected, safely used, and that it ultimately benefits the students and families that put their trust in us."

- Chris Kratzer, Vice President for Policy, Advocacy, and Government Relations, ACT, Inc.