California Enacts Landmark Law Protecting the Privacy of Student Data

• By Christopher Piehler
• 09/30/14

Yesterday, California Governor Jerry Brown signed into law Senate Bill 1177, the Student Online Personal Information Protection Act (SOPIPA). The new law prohibits companies from using personal information gathered from students through online education technologies for any purpose other than the purpose for which it was originally collected.

Authored by Senate President pro Tempore Darrell Steinberg (D – Sacramento), SOPIPA prevents ed tech services from creating a profile of a student unless that profile is used for clear educational purposes. Companies cannot use any information gained from the use of their K-12 site to target advertising on any other site, service or application. The bill also prevents companies from selling student data, limits disclosure of students’ personal information, and ends targeted advertising on K-12 websites, services and applications.

According to Steinberg (pictured), SOPIPA fills a major void in privacy law. While the federal Family Educational Rights and Privacy Act (FERPA) protects students’ personal information from disclosure by educational agencies, the growing use of new technologies has made federal law deficient. He said the new law proves that “privacy and online innovation can be complimentary partners.”

James Steyer, CEO and founder of Common Sense Media, added, “SOPIPA is a true landmark in the efforts to safeguard the privacy of children and teens who are using technology to enhance and personalize their learning … schools can now benefit from the vast potential of educational technology, while keeping students' sensitive information safe from commercial exploitation."

Bradley Shear, a lawyer who specializes in digital privacy and technology law, said that while "15-25 other states have enacted similar legislation, California is a leader in privacy areas, and it wouldn't surprise me if other states looked to California to strengthen their own laws." What makes SOPIPA different, he said, is that "not only does it ban the use of student data for advertising purposes, but also bans the creation of profiles of K-12 students based on their schoolwork that might be used for non-educational purposes."

Shear offered this practical advice to ed tech leaders preparing for when the new law goes into effect on Jan. 1, 2016: "Read the privacy policies of the companies that you're contracting with, and see specifically what they state. If there are any clauses that you believe may violate this new law, you need to be proactive and fix them."