SB 1177, the Student Online Privacy Protection Act was recently introduced in the California legislature. This is a bad bill for the private educational industry, and ultimately for parents and students. It would drastically expand the privacy protections of the Federal Educational Rights and Privacy Act (FERPA), and state equivalents, which impose reasonable limits on schools on disclosure of student information, which schools then impose on their licensors (such as educational online services the school pays for and provides to students). A CA Senate Committee Report summarizes FERPA and its exceptions, and other children’s and student privacy laws, and quotes the sponsor’s intent to “close loopholes” to capture also services that are merely “marketed to teachers” or “marketed for school purposes”. This bill would seem to effectively preclude data collection and use for commercial purposes (other than site operation) by K – 12 educational sites and services, even if not licensed by schools. While, the intent seems to be arguably more narrow, “designed and marketed for K-12 School purposes”, that term is vague and undefined and every educational site or service could potentially be caught up in that, even if they never license to a school or intentionally promote it to schools or educators. It also applies to secondary services like social media plug-ins. It further  bans ads. In addition, there is not even an ability for parents to consent. The ultimate result could be less, or at least more expensive, educational content available for parents and their children to supplement what online services schools can afford to license themselves. This will have a disproportional effect on public school students and middle class and low income families. Presumably, that is not the goal of the author.

CA passed a minors’ privacy bill last year, also introduced by this bill’s author, President Pro Tem Steinberg, which prohibits knowingly advertising age restricted products to minors and giving minors the right to have their own social media posts removed upon request. That law goes into effect January 1, 2015. So, there is real risk that this could get passed. Hopefully, if it cannot be killed, there can be a parental consent exception and that consent can be a condition of use where schools are not the parties licensing the service. BakerHostetler represents companies that provide educational online services to children and students, both through schools and independently to parents, and is working with industry to respond to this bill.