The Student Online Personal Information Protection Act (SOPIPA) comes into force today in California, placing direct obligations on operators of online services used for school purposes.
Key points
- Operators may not use student data for targeted advertising or build profiles for non-educational purposes.
- Selling student information is prohibited.
- Operators must implement reasonable security procedures and practices.
- Student data must be deleted at the request of a school or district.
SOPIPA became a model for student-data privacy laws in many other US states. UK edtech providers serving US schools should expect these requirements alongside FERPA obligations in their contracts.
Source: SB 1177 – SOPIPA (California Legislative Information)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
