Existing law, The Student Online Personal Information Protection Act, restricts the use of information about elementary and secondary school students by operators of certain Internet Web sites and online services and applications by, among other things, prohibiting operators from engaging in targeted advertising, amassing student profiles except for K12 school purposes, or selling or disclosing student information, as specified. Existing law also requires an operator to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information to protect the information from unauthorized access, use, and disclosure.

Existing law also prohibits an operator of an Internet Web site or online service from knowingly using, disclosing, compiling, or allowing a 3rd party to use, disclose, or compile the personal information of a minor for the purpose of marketing or advertising specified types of products or services. Existing law also makes this prohibition applicable to an advertising service that is notified by an operator of an Internet Web site, online service, online application, or mobile application that the site, service, or application is directed to a minor.

This bill would, commencing on July 1, 2017, prohibit the operator of an Internet Web site, online service, online application, or mobile application that is used primarily for preschool or prekindergarten purposes, as defined, and was designed and marketed for preschool and prekindergarten purposes, to knowingly engage in specified activities with respect to their site, service, or application, including, among other things, engaging in targeted advertising, using specified information to amass a profile about a pupil except in furtherance of preschool or prekindergarten purposes, and selling or disclosing a pupils information, as specified. The bill would also require an operator to, among other things, implement and maintain reasonable security procedures and practices appropriate to the information to protect that information from unauthorized access, and to delete a pupils information at the request of a preschool, prekindergarten, or district, as specified. The bill would authorize the disclosure of a pupils information under specified circumstances. The bill would also provide that its provisions are severable.

Existing law, The Student Online Personal Information Protection Act, restricts the use of information about elementary and secondary school students by operators of certain Internet Web sites and online services and applications by, among other things, prohibiting operators from engaging in targeted advertising, amassing student profiles except for K12 school purposes, or selling or disclosing student information, as specified. Existing law also requires an operator to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information to protect the information from unauthorized access, use, and disclosure.

Existing law also prohibits an operator of an Internet Web site or online service from knowingly using, disclosing, compiling, or allowing a 3rd party to use, disclose, or compile the personal information of a minor for the purpose of marketing or advertising specified types of products or services. Existing law also makes this prohibition applicable to an advertising service that is notified by an operator of an Internet Web site, online service, online application, or mobile application that the site, service, or application is directed to a minor.

This bill would, commencing on July 1, 2017, prohibit the operator of an Internet Web site, online service, online application, or mobile application that is used primarily for preschool or prekindergarten purposes, as defined, and was designed and marketed for preschool and prekindergarten purposes, to knowingly engage in specified activities with respect to their site, service, or application, including, among other things, engaging in targeted advertising, using specified information to amass a profile about a pupil except in furtherance of preschool or prekindergarten purposes, and selling or disclosing a pupils information, as specified. The bill would also require an operator to, among other things, implement and maintain reasonable security procedures and practices appropriate to the information to protect that information from unauthorized access, and to delete a pupils information at the request of a preschool, prekindergarten, or district, as specified. The bill would authorize the disclosure of a pupils information under specified circumstances. The bill would also provide that its provisions are severable.

Existing law, The Student Online Personal Information Protection Act, restricts the use of information about elementary and secondary school students by operators of certain Internet Web sites and online services and applications by, among other things, prohibiting operators from engaging in targeted advertising, amassing student profiles except for K12 school purposes, or selling or disclosing student information, as specified. Existing law also requires an operator to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information to protect the information from unauthorized access, use, and disclosure.

Existing law also prohibits an operator of an Internet Web site or online service from knowingly using, disclosing, compiling, or allowing a 3rd party to use, disclose, or compile the personal information of a minor for the purpose of marketing or advertising specified types of products or services. Existing law also makes this prohibition applicable to an advertising service that is notified by an operator of an Internet Web site, online service, online application, or mobile application that the site, service, or application is directed to a minor.

This bill would, commencing on July 1, 2017, prohibit the operator of an Internet Web site, online service, online application, or mobile application that is used primarily for preschool or prekindergarten purposes, as defined, and was designed and marketed for preschool and prekindergarten purposes, to knowingly engage in specified activities with respect to their site, service, or application, including, among other things, engaging in targeted advertising, using specified information to amass a profile about a pupil except in furtherance of preschool or prekindergarten purposes, and selling or disclosing a pupils information, as specified. The bill would also require an operator to, among other things, implement and maintain reasonable security procedures and practices appropriate to the information to protect that information from unauthorized access, and to delete a pupils information at the request of a preschool, prekindergarten, or district, as specified. The bill would authorize the disclosure of a pupils information under specified circumstances. The bill would also provide that its provisions are severable.

Existing law, The Student Online Personal Information Protection Act, restricts the use of information about elementary and secondary school students by operators of certain Internet Web sites and online services and applications by, among other things, prohibiting operators from engaging in targeted advertising, amassing student profiles except for K12 school purposes, or selling or disclosing student information, as specified. Existing law also requires an operator to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information to protect the information from unauthorized access, use, and disclosure.

Existing law also prohibits an operator of an Internet Web site or online service from knowingly using, disclosing, compiling, or allowing a 3rd party to use, disclose, or compile the personal information of a minor for the purpose of marketing or advertising specified types of products or services. Existing law also makes this prohibition applicable to an advertising service that is notified by an operator of an Internet Web site, online service, online application, or mobile application that the site, service, or application is directed to a minor.

This bill would, commencing on July 1, 2017, prohibit the operator of an Internet Web site, online service, online application, or mobile application that is used primarily for preschool or prekindergarten purposes, as defined, and was designed and marketed for preschool and prekindergarten purposes, to knowingly engage in specified activities with respect to their site, service, or application, including, among other things, engaging in targeted advertising, using specified information to amass a profile about a child pupil except in furtherance of preschool or prekindergarten purposes, and selling or disclosing a childs pupils information, as specified. The bill would also require an operator to, among other things, implement and maintain reasonable security procedures and practices appropriate to the information to protect that information from unauthorized access, and to delete a childs pupils information at the request of a preschool or preschool, prekindergarten, or district, as specified. The bill would authorize the disclosure of a childs pupils information under specified circumstances. The bill would also provide that its provisions are severable.

Existing law, The Student Online Personal Information Protection Act, restricts the use of information about elementary and secondary school students by operators of certain Internet Web sites and online services and applications by, among other things, prohibiting operators from engaging in targeted advertising, amassing student profiles except for K12 school purposes, or selling or disclosing student information, as specified. Existing law also requires an operator to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information to protect the information from unauthorized access, use, and disclosure.

Existing law also prohibits an operator of an Internet Web site or online service from knowingly using, disclosing, compiling, or allowing a 3rd party to use, disclose, or compile the personal information of a minor for the purpose of marketing or advertising specified types of products or services. Existing law also makes this prohibition applicable to an advertising service that is notified by an operator of an Internet Web site, online service, online application, or mobile application that the site, service, or application is directed to a minor.

This bill would, commencing on July 1, 2017, prohibit the operator of an Internet Web site, online service, online application, or mobile application that is used primarily for preschool or prekindergarten purposes, as defined, and was designed and marketed for preschool and prekindergarten purposes, to knowingly engage in specified activities with respect to their site, service, or application, including, among other things, engaging in targeted advertising, using specified information to amass a profile about a child except in furtherance of preschool or prekindergarten purposes, and selling or disclosing a childs information, as specified. The bill would also require an operator to, among other things, implement and maintain reasonable security procedures and practices appropriate to the information to protect that information from unauthorized access, and to delete a childs information at the request of a preschool or prekindergarten, as specified. The bill would authorize the disclosure of a childs information under specified circumstances. The bill would also provide that its provisions are severable.

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 2799

Author:(Chau)

As Amended Ver:June 21, 2016

Majority vote

Original Committee Reference: P. & C.P.

SUMMARY: Prohibits operators of Internet Web sites, online services, and mobile apps that are designed, marketed and used primarily for prekindergarten and preschool pupils, from using data about those pupils for targeting, marketing or profiling, and prohibits selling or disclosing a pupil's information with limited exceptions.

The Senate amendments make technical and clarifying changes.

EXISTING LAW:

1. Establishes the Student Online Privacy Protection Act (SOPIPA), which prohibits an operator of a Web site, online service, online application, or mobile application from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a K-12 student, selling a student's information, or disclosing covered information, as provided. (Business and Professions Code Section (BPC) 22584-85)
2. Defines an "Operator" as the operator of a Web site, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K-12 school purposes. (BPC 22584(a))
3. Requires an Operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its Web site to conspicuously post its privacy policy. (BPC 22575)
4. Protects, pursuant to the federal Family Educational Rights and Privacy Act (FERPA), the confidentiality of educational records (and personally identifiable information contained therein) by prohibiting the funding of schools that permit the release of those records. It applies to all schools that receive funds under an applicable program of the United States (U.S.) Department of Education. Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record. FERPA's prohibition only applies to the school itself and contains various exemptions where the data may be released without the written consent of the parents. (20 United States Code Section (U.S.C.) 1232g(b)(1))
5. Prohibits, pursuant to the federal Children's Online Privacy Protection Act of 1998, an Operator of a Web site or online service directed to pupils under the age of 13 from collecting personal information from a pupil, including a pupil's first and last name, home or other physical address including street name and name of a city or town, e-mail address, telephone number, or Social Security number. (5 U.S.C. 6501-6505)

FISCAL EFFECT: None. This bill is keyed non-fiscal by the Legislative Counsel.

COMMENTS: In 2014, California became the national leader on student privacy protections with the unanimous passage of SB 1177 (Steinberg), Chapter 839, known as SOPIPA. SOPIPA went into effect on January 1, 2016, and mandates privacy and data security requirements on Web sites, online services, and mobile apps that are designed, marketed and used primarily for K-12 students.

SOPIPA was passed in response to the massive amounts of sensitive student data that online educational products and services were collecting about students, including academic performance, health records, and personal interests. However, SOPIPA only applies to K-12 students, leaving younger children in preschool and pre-kindergarten classrooms without the same privacy protections, despite the fact that many were using educational technology.

This bill, dubbed the "Early Learning Personal Information Protection Act," is modeled on SOPIPA and expands the same privacy and data security requirements that exist today for K-12 oriented Web sites, online services, and mobile apps to those designed primarily for prekindergarten and preschool pupils.

The major provisions of this bill would:

1. Prohibit using pupils' personal information for targeted advertising;
2. Prohibit using pupils' personal information for profiling (except for school purposes);
3. Prohibit selling pupils' personal information;
4. Prohibit disclosing pupils' personal information (with limited exceptions to permit site functionality or as required by law);
5. Require reasonable data security for the pupils' information; and
6. Require companies to delete pupils' information upon the school's request.

Analysis Prepared by: Jennie Bretschneider / P. & C.P. / (916) 319-2200 FN: 0003608

 THIRD READING 

Bill No: AB 2799

Author: Chau (D)

Amended: 6/21/16 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 7-0, 6/14/16

AYES: Jackson, Moorlach, Anderson, Hertzberg, Leno, Monning, Wieckowski

ASSEMBLY FLOOR: 78-0, 5/12/16 (Consent) - See last page for vote

SUBJECT: Privacy: personal information: preschool and prekindergarten purposes

SOURCE: Common Sense Kids Action

DIGEST: This bill creates the Early Learning Privacy Information Protection Act (ELPIPA) to extend all of the protections offered by the Student Online Personal Information Protection Act (SOPIPA) to pupils enrolled in preschools and pre-kindergarten. Provides that ELPIPA impose requirements directly on Web sites, online services, and mobile applications that are designed, marketed and used primarily by children enrolled in a preschool or prekindergarten course of instruction.

ANALYSIS:

Existing law:

1. Provides that, among other rights, all people have an inalienable right to pursue and obtain privacy.
2. Requires an operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its Web site to conspicuously post its privacy policy.
3. Specifies that SOPIPA provides privacy protections to K-12 students.
4. Defines “operator” as the operator of an Internet Web site, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes.
5. Defines “Covered information” as personally identifiable information or materials, in any media or format that meets any of the following:

• Is created or provided by a student, or the student’s parent or legal guardian, to an operator in the course of the student’s, parent’s, or legal guardian’s use of the operator’s site, service, or application for K-12 school purposes;
• Is created or provided by an employee or agent of the K-12 school, school district, local education agency, or county office of education, to an operator; or
• Is gathered by an operator through the operation of their site, service, or application and is descriptive of a student or otherwise identifies a student, including, but not limited to, information in the student’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocation information.

1. Specifies that:
   • “Online service” includes cloud computing services, and are within the scope of SOPIPA if they otherwise meet the definition of operator.
   • “K-12 school purposes” means purposes that customarily take place at the direction of the K-12 school, teacher, or school district or aid in the administration of school activities, including, but not limited to, instruction in the classroom or at home, administrative activities, and collaboration between students, school personnel, or parents, or are for the use and benefit of the school.
2. Provides that an operator shall not knowingly engage in any of the following activities with respect to their site, service, or application:
   • Engage in targeted advertising on the operator’s site, service, or application, or target advertising on any other site, service, or application when the targeting of the advertising is based upon any information, including covered information and persistent unique identifiers, that the operator has acquired because of the use of that operator’s site, service, or application where the operator had actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes;
   • Use information, including persistent unique identifiers, created or gathered by the operator’s site, service, or application, to amass a profile about a K–12 student except in furtherance of K-12 school purposes; or
   • Sell a student’s information, including covered information.
3. Provides that an operator shall not, with respect to their site, service, or application, knowingly disclose covered information unless the disclosure is made:

• In furtherance of the K-12 purpose of the site, service, or application, provided the recipient of the covered information disclosed shall not further disclose the information unless done to allow or improve operability and functionality within that student’s classroom or school and is legally required to comply with encryption, deletion, and security protocols;
• To ensure legal and regulatory compliance;
• To respond to or participate in judicial process;
• To protect the safety of users or others or security of the site; or
• To a service provider, provided the operator contractually prohibits the service provider from using any covered information for any purpose other than providing the contracted service to, or on behalf of, the operator, and prohibits the service provider from disclosing any covered information provided by the operator with subsequent third parties, and requires the service provider to implement and maintain reasonable security procedures and practices, as specified.

1. Provides that SOPIPA’s prohibitions shall not be construed to prohibit the operator’s use of information for maintaining, developing, supporting, improving, or diagnosing the operator’s site, service, or application.
2. Requires an operator to:

• Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure; and
• Delete a student’s covered information if the school or district requests deletion of data under the control of the school or district.

1. Allows for disclosure of covered information of a student, as specified, and under the following circumstances:

• If other provisions of federal or state law require the operator to disclose the information, and the operator complies with the requirements of federal and state law in protecting and disclosing that information;
• For legitimate research purposes as required by state or federal law and subject to the restrictions under applicable state and federal law or as allowed by state or federal law and under the direction of a school, school district, or state department of education, if no covered information is used for any purpose in furtherance of advertising or to amass a profile on the student for purposes other than K-12 school purposes; or
• To a state or local educational agency, including schools and school districts, for K-12 school purposes, as permitted by state or federal law.

1. Specifies that SOPIPA:

• Does not prohibit an operator from using deidentified student covered information within the operator’s site, service, or application or other sites, services, or applications owned by the operator to improve educational products or to demonstrate the effectiveness of the operator’s products or services, including in their marketing; and
• Does not prohibit an operator from sharing aggregated deidentified student covered information for the development and improvement of educational sites, services, or applications.
• Shall not be construed to limit the authority of a law enforcement agency to obtain any content or information from an operator as authorized by law or pursuant to an order of a court of competent jurisdiction;
• Does not limit the ability of an operator to use student data, including covered information, for adaptive learning or customized student learning purposes;
• Does not apply to general audience Internet Web sites, general audience online services, general audience online applications, or general audience mobile applications, even if login credentials created for an operator’s site, service, or application may be used to access those general audience sites, services, or applications;
• Does not limit Internet service providers from providing Internet connectivity to schools or students and their families;
• Does not prohibit an operator of an Internet Web site, online service, online application, or mobile application from marketing educational products directly to parents so long as the marketing did not result from the use of covered information obtained by the operator through the provision of services covered under this section;
• Does not impose a duty upon a provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software or applications to review or enforce compliance of this section on those applications or software;
• Does not impose a duty upon a provider of an interactive computer service, as defined in Section 230 of Title 47 of the United States Code, to review or enforce compliance with this section by third-party content providers; and
• Does not impede the ability of students to download, export, or otherwise save or maintain their own student created data or documents. (Bus. & Prof. Code Sec. 22584 (k)-(r).)

This bill creates ELPIPA providing pre-kindergarten and pre-school students with the exact protections afforded to K-12 students by SOPIPA (detailed above). ELPIPA protects early learners’ privacy by:

1. Prohibiting the sale of early learners’ personal information by operators of early learning online sites;
2. Prohibiting targeted advertising on early learning online sites;
3. Prohibiting operators of early learning online sites from using information they obtain on the early learning site to target advertising on other sites;
4. Prohibiting operators from amassing a profile about an early learning student except in furtherance of early learning school purposes;
5. Prohibiting disclosure of early learner personal information unless the disclosure is made in furtherance of the early learning purpose; and
6. Requiring early learning online operators to keep the early learner personal information safe and secure.

Background

The Federal Educational Rights and Privacy Act (FERPA) generally seeks to protect the confidentiality of educational records (and personally identifiable information contained therein) by prohibiting the funding of schools that permit the release of those records in violation of the Act. (20 U.S.C. Sec. 1232g(b)(1).) FERPA’s prohibition only applies to the school itself and contains various exemptions where the data may be released without the written consent of the parents.

Since the enactment of FERPA in 1974, educational institutions have undergone dramatic changes in the way that students are taught, including the increased use of technology. With respect to the use of technology and learning, the Department of Education observes that:

Schools can use digital resources in a variety of ways to support teaching and learning. Electronic grade books, digital portfolios, learning games, and real-time feedback on teacher and student performance, are a few ways that technology can be utilized to power learning. (U.S. Department of Education, Use of Technology in Teaching and Learning <http://www.ed.gov/oii-news/use-technology-teaching-and-learning [as of June 8, 2016].)

In response to the increased use of technology in the classroom, the Legislature unanimously passed SOPIPA in 2014. (SB 1177, Steinberg, Chapter 839, Statutes of 2014).) SOPIPA was enacted to protect student personal information by closing loopholes that allowed online companies in the education technology space to profit from student personal information obtained through student, parent, teacher, and administrator use of K-12 online sites. Although preschools and pre-kindergartens increasingly integrate tablets in the classroom and use cloud-computing services to enrich student education and improve academic operations, early learners are outside of the scope and not protected by SOPIPA.

This bill creates ELPIPA to extend all of the protections offered by SOPIPA to pupils enrolled in preschools and pre-kindergarten. ELPIPA imposes requirements directly on Web sites, online services, and mobile applications that are designed, marketed and used primarily by children enrolled in a preschool or prekindergarten course of instruction.  ELPIPA protects early learners’ privacy in this digital age by (1) prohibiting the sale of early learners’ personal information by operators of early learning online sites; (2) prohibiting targeted advertising on early learning sites; (3) prohibiting operators of early learning online sites from using information they obtain on the early learning site to target advertising on other sites; (4) prohibiting operators from amassing a profile about an early learning student except in furtherance of early learning school purposes; (5) prohibiting disclosure of early learner personal information unless the disclosure is made in furtherance of the early learning purpose; and (6) requiring these early learning online operators to keep the early learner personal information safe and secure.

Comments

The author writes:

Technology is an integral part of learning for today’s kids, even the youngest among them. Preschools and pre-kindergartens increasingly integrate tablets in the classroom and use cloud-computing services to enrich student education and improve academic operations.  In a recent survey, 65% of preschool educators report using digital devices and materials in their classrooms.

While young children can benefit from guided early online learning, more needs to be done to ensure the safety of their private information. Online services, websites, apps, and digital platforms collect a wealth of personal data that is vulnerable to exploitation.  The recent Vtech data breach, which exposed the personal information of nearly 6.4 million children, is just one example that shows the necessity of protecting kids’ private information as they engage with education technology.

California became the national leader on student privacy protections with the unanimous passage of SB 1177 (Steinberg), known as the Student Online Personal Information Protection Act (SOPIPA), in 2014.  This law, which went into effect on January 1, 2016, ensures the privacy and security of personal and academic data in 21st century K-12 classrooms.

SOPIPA was passed in response to the massive amounts of sensitive student data that online services could collect - including academic performance, health records, and more – without clearly limiting the use of that data for educational purposes. 

Preschools and pre-kindergartens should be safe-havens for learning and benefit from the same privacy protections for children as California’s K-12 schools.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 6/14/16)

Common Sense Kids Action (source)

California State PTA

California School Boards Association

Los Angeles Unified School District

Privacy Rights Clearinghouse

OPPOSITION: (Verified 6/22/16)

None received

ASSEMBLY FLOOR: 78-0, 5/12/16

AYES: Achadjian, Alejo, Travis Allen, Arambula, Atkins, Baker, Bigelow, Bloom, Bonilla, Bonta, Brough, Brown, Calderon, Campos, Chang, Chau, Chávez, Chiu, Chu, Cooley, Cooper, Dababneh, Dahle, Daly, Dodd, Eggman, Frazier, Beth Gaines, Gallagher, Cristina Garcia, Eduardo Garcia, Gatto, Gipson, Gomez, Gonzalez, Gordon, Gray, Grove, Hadley, Harper, Roger Hernández, Holden, Irwin, Jones, Kim, Lackey, Levine, Linder, Lopez, Low, Maienschein, Mathis, Mayes, McCarty, Medina, Melendez, Mullin, Nazarian, Obernolte, O'Donnell, Olsen, Patterson, Quirk, Ridley-Thomas, Rodriguez, Salas, Santiago, Steinorth, Mark Stone, Thurmond, Ting, Wagner, Waldron, Weber, Wilk, Williams, Wood, Rendon

NO VOTE RECORDED: Burke, Jones-Sawyer

Prepared by: Margie Estrada / JUD. / (916) 651-4113

8/15/16 10:07:45

**** END ****

SENATE JUDICIARY COMMITTEE

Senator Hannah-Beth Jackson, Chair

2015-2016 Regular Session

Bill No: AB 2799 (Author:Chau)

Version: April 7, 2016

Hearing Date: June 14, 2016

Fiscal: No

Urgency: No

Consultant: ME

SUBJECT

Privacy: personal information: preschool and prekindergarten purposes

DESCRIPTION

This bill creates the Early Learning Privacy Information Protection Act (ELPIPA) to extend all of the protections offered by the Student Online Personal Information Protection Act (SOPIPA) to pupils enrolled in preschools and pre-kindergarten.  ELPIPA imposes requirements directly on Websites, online services, and mobile applications that are designed, marketed and used primarily by children enrolled in a preschool or prekindergarten course of instruction.  ELPIPA would protect early learners’ privacy by:

• prohibiting the sale of early learners’ personal information by operators of early learning online sites;
• prohibiting targeted advertising on early learning online sites;
• prohibiting operators of early learning online sites from using information they obtain on the early learning site to target advertising on other sites;
• prohibiting operators from amassing a profile about an early learning student except in furtherance of early learning school purposes;
• prohibiting disclosure of early learner personal information unless the disclosure is made in furtherance of the early learning purpose; and
• requiring early learning online operators to keep the early learner personal information safe and secure.

BACKGROUND

The Federal Educational Rights and Privacy Act (FERPA) generally seeks to protect the confidentiality of educational records (and personally identifiable information contained therein) by prohibiting the funding of schools that permit the release of those records in violation of the Act. (20 U.S.C. Sec. 1232g(b)(1).) FERPA’s prohibition only applies to the school itself and contains various exemptions where the data may be released without the written consent of the parents.

Since the enactment of FERPA in 1974, educational institutions have undergone dramatic changes in the way that students are taught, including the increased use of technology. With respect to the use of technology and learning, the Department of Education observes that:

Schools can use digital resources in a variety of ways to support teaching and learning. Electronic grade books, digital portfolios, learning games, and real-time feedback on teacher and student performance, are a few ways that technology can be utilized to power learning. (U.S. Department of Education, Use of Technology in Teaching and Learning <http://www.ed.gov/oii-news/use-technology-teaching-and-learning> [as of June 8, 2016].)

In response to the increased use of technology in the classroom, the Legislature unanimously passed the Student Online Personal Information Protection Act (SOPIPA) in 2014. (SB 1177 (Steinberg, Ch. 839, Stats. 2014).) SOPIPA was enacted to protect student personal information by closing loopholes that allowed online companies in the education technology space to profit from student personal information obtained through student, parent, teacher, and administrator use of K-12 online sites. Although preschools and pre-kindergartens increasingly integrate tablets in the classroom and use cloud-computing services to enrich student education and improve academic operations, early learners are outside of the scope and not protected by SOPIPA.

This bill creates the Early Learning Privacy Information Protection Act (ELPIPA) to extend all of the protections offered by SOPIPA to pupils enrolled in preschools and pre-kindergarten.  ELPIPA imposes requirements directly on Websites, online services, and mobile applications that are designed, marketed and used primarily by children enrolled in a preschool or prekindergarten course of instruction.  ELPIPA would protect early learners’ privacy in this digital age by:

• prohibiting the sale of early learners’ personal information by operators of early learning online sites;
• prohibiting targeted advertising on early learning sites;
• prohibiting operators of early learning online sites from using information they obtain on the early learning site to target advertising on other sites;
• prohibiting operators from amassing a profile about an early learning student except in furtherance of early learning school purposes;
• prohibiting disclosure of early learner personal information unless the disclosure is made in furtherance of the early learning purpose; and
• requiring these early learning online operators to keep the early learner personal information safe and secure.

CHANGES TO EXISTING LAW

Existing law provides that, among other rights, all people have an inalienable right to pursue and obtain privacy. (Cal. Const., art. I, Sec. 1.)

Existing law requires an operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its Web site to conspicuously post its privacy policy. (Online Privacy Protection Act of 2003, Bus. & Prof. Code Sec. 22575.)

Existing law, the Student Online Personal Information Protection Act (SOPIPA) provides privacy protections to K-12 students. (Bus. & Prof. Code Sec. 22584.)

Existing law, defines “operator” as the operator of an Internet Web site, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes. (Bus. & Prof. Code Sec. 22584(a).)

Existing law defines “Covered information” as personally identifiable information or materials, in any media or format that meets any of the following:

• is created or provided by a student, or the student’s parent or legal guardian, to an operator in the course of the student’s, parent’s, or legal guardian’s use of the operator’s site, service, or application for K–12 school purposes;
• is created or provided by an employee or agent of the K–12 school, school district, local education agency, or county office of education, to an operator; or
• is gathered by an operator through the operation of their site, service, or application and is descriptive of a student or otherwise identifies a student, including, but not limited to, information in the student’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocation information. (Bus. & Prof. Code Sec. 22584(i) (1)-(3).)

Existing law specifies that:

• “Online service” includes cloud computing services, and are within the scope of SOPIPA if they otherwise meet the definition of operator. (Bus. & Prof. Code Sec. 22584(h).)
• “K–12 school purposes” means purposes that customarily take place at the direction of the K–12 school, teacher, or school district or aid in the administration of school activities, including, but not limited to, instruction in the classroom or at home, administrative activities, and collaboration between students, school personnel, or parents, or are for the use and benefit of the school. (Bus. & Prof. Code Sec. 22584(j).)

Existing law provides that an operator shall not knowingly engage in any of the following activities with respect to their site, service, or application:

• engage in targeted advertising on the operator’s site, service, or application, or target advertising on any other site, service, or application when the targeting of the advertising is based upon any information, including covered information and persistent unique identifiers, that the operator has acquired because of the use of that operator’s site, service, or application where the operator had actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes;
• use information, including persistent unique identifiers, created or gathered by the operator’s site, service, or application, to amass a profile about a K–12 student except in furtherance of K–12 school purposes; or
• sell a student’s information, including covered information. (Bus. & Prof. Code Sec. 22584(b) (1)-(3).)

Existing law provides that an operator shall not, with respect to their site, service, or application, knowingly disclose covered information unless the disclosure is made:

• in furtherance of the K–12 purpose of the site, service, or application, provided the recipient of the covered information disclosed shall not further disclose the information unless done to allow or improve operability and functionality within that student’s classroom or school and is legally required to comply with encryption, deletion, and security protocols;
• to ensure legal and regulatory compliance;
• to respond to or participate in judicial process;
• to protect the safety of users or others or security of the site; or
• to a service provider, provided the operator contractually prohibits the service provider from using any covered information for any purpose other than providing the contracted service to, or on behalf of, the operator, and prohibits the service provider from disclosing any covered information provided by the operator with subsequent third parties, and requires the service provider to implement and maintain reasonable security procedures and practices as specified. (Bus. & Prof. Code Sec. 22584(b)(4)).

Existing law provides that SOPIPA’s prohibitions shall not be construed to prohibit the operator’s use of information for maintaining, developing, supporting, improving, or diagnosing the operator’s site, service, or application. (Bus. & Prof. Code Sec. 22584(c).)

Existing law requires an operator to:

• implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure; and
• delete a student’s covered information if the school or district requests deletion of data under the control of the school or district. (Bus. & Prof. Code Sec. 22584(d) (1)-(2).)

Existing law allows for disclosure of covered information of a student, as specified, and under the following circumstances:

• if other provisions of federal or state law require the operator to disclose the information, and the operator complies with the requirements of federal and state law in protecting and disclosing that information;
• for legitimate research purposes as required by state or federal law and subject to the restrictions under applicable state and federal law or as allowed by state or federal law and under the direction of a school, school district, or state department of education, if no covered information is used for any purpose in furtherance of advertising or to amass a profile on the student for purposes other than K–12 school purposes; or
• to a state or local educational agency, including schools and school districts, for K–12 school purposes, as permitted by state or federal law. (Bus. & Prof. Code Sec. 22584(e)).

Existing law specifies that SOPIPA

• does not prohibit an operator from using deidentified student covered information within the operator’s site, service, or application or other sites, services, or applications owned by the operator to improve educational products or to demonstrate the effectiveness of the operator’s products or services, including in their marketing; and
• does not prohibit an operator from sharing aggregated deidentified student covered information for the development and improvement of educational sites, services, or applications. (Bus. & Prof. Code Sec. 22584(f) & (g).)

Existing law specifies that SOPIPA:

• shall not be construed to limit the authority of a law enforcement agency to obtain any content or information from an operator as authorized by law or pursuant to an order of a court of competent jurisdiction;
• does not limit the ability of an operator to use student data, including covered information, for adaptive learning or customized student learning purposes;
• does not apply to general audience Internet Web sites, general audience online services, general audience online applications, or general audience mobile applications, even if login credentials created for an operator’s site, service, or application may be used to access those general audience sites, services, or applications;
• does not limit Internet service providers from providing Internet connectivity to schools or students and their families;
• does not prohibit an operator of an Internet Web site, online service, online application, or mobile application from marketing educational products directly to parents so long as the marketing did not result from the use of covered information obtained by the operator through the provision of services covered under this section;
• does not impose a duty upon a provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software or applications to review or enforce compliance of this section on those applications or software;
• does not impose a duty upon a provider of an interactive computer service, as defined in Section 230 of Title 47 of the United States Code, to review or enforce compliance with this section by third-party content providers; and
• does not impede the ability of students to download, export, or otherwise save or maintain their own student created data or documents. (Bus. & Prof. Code Sec. 22584 (k)-(r).)

This bill creates the Early Learning Privacy Information Protection Act (ELPIPA) providing pre-kindergarten and pre-school students with the exact protections afforded to K-12 students by the Student Online Personal Information Protection Act (SOPIPA) (detailed above).

COMMENT

1. Stated Need for the bill:

According to the author:

Technology is an integral part of learning for today’s kids, even the youngest among them. Preschools and pre-kindergartens increasingly integrate tablets in the classroom and use cloud-computing services to enrich student education and improve academic operations.  In a recent survey, 65% of preschool educators report using digital devices and materials in their classrooms.

While young children can benefit from guided early online learning, more needs to be done to ensure the safety of their private information. Online services, websites, apps, and digital platforms collect a wealth of personal data that is vulnerable to exploitation.  The recent Vtech data breach, which exposed the personal information of nearly 6.4 million children, is just one example that shows the necessity of protecting kids’ private information as they engage with education technology.

California became the national leader on student privacy protections with the unanimous passage of SB 1177 (Steinberg), known as the Student Online Personal Information Protection Act (SOPIPA), in 2014.  This law, which went into effect on January 1, 2016, ensures the privacy and security of personal and academic data in 21^st century K-12 classrooms.

SOPIPA was passed in response to the massive amounts of sensitive student data that online services could collect - including academic performance, health records, and more – without clearly limiting the use of that data for educational purposes. 

Preschools and pre-kindergartens should be safe-havens for learning and benefit from the same privacy protections for children as California’s K-12 schools.

2.  ELPIPA extends protections in SOPIPA to pre-school students

California became the national leader on student privacy when it unanimously passed the Student Online Personal Information Protection Act (SOPIPA). (SB 1177 (Steinberg, Ch. 839, Stats. 2014).) SOPIPA was California’s response to reports regarding uses of student information and the inadequacies of state and federal law in protecting student personal information.^[1]

While the Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. Sec. 1232g(b)(1)) generally protects personally identifiable information from unauthorized disclosure, that provision applies only to schools, not to third parties who operate early education through 12^th grade Web sites, services, or applications. Furthermore, an article by Paul Schwartz and Daniel Solove, entitled, The Battle for Leadership in Education Privacy Law: Will California Seize the Throne? observed:

There are notable gaps in FERPA that make it largely ineffective in protecting student privacy in today’s digital age. For example, FERPA lacks meaningful enforcement. Students and their parents have no right to sue for FERPA violations. Only the Department of Education can enforce the law. FERPA only allows one sanction -- the removal of all federal funding for an educational institution. This sanction is so impractical and severe that the Department has never used it in FERPA’s four-decade history. Thus, enforcement of the statute is essentially nonexistent.

Moreover, FERPA enforcement only applies to schools. Unlike HIPAA, which gives the Department of Health and Human Services (HHS) the authority to enforce against nearly all entities that receive HIPAA-regulated information, the Department of Education lacks similar authority. The Department of Education is unable to enforce against businesses that are not schools, but that receive FERPA-regulated data.

FERPA also says little about selecting a cloud provider or about the responsibilities of such an entity. . . . FERPA [also] does not have much more to say about the responsibilities of a cloud computing provider. In fact, it contains a potentially broad loophole. If a school discloses education records for outsourcing its functions, the FERPA Regulations allow the school to designate the cloud computing provider as a “school official” in order to facilitate the sharing. When a school shares student data with a cloud service provider, the duties of the provider to protect the data are governed by the contract into which the school and the provider enter. (Paul Schwartz, Daniel Solove, SafeGov, The Battle for Leadership in Education Privacy Law: Will California Seize the Throne? (Mar. 27, 2014) <http://www.safegov.org/2014/3/27/the-battle-for-leadership-in-education-privacy-law-will-california-seize-the-throne> [as of June 4, 2016].)

Moreover, FERPA “did not anticipate the explosion in online learning.  Students shed streams of data about their academic progress, work habits, learning styles and personal interests as they navigate educational Websites.  All that data has potential commercial value:  It could be used to target ads to the kids and their families, or to build profiles on them ...” (Stephanie Simon, Politico, Data Mining Your Children, (May 15, 2014.) 

Prior to SOPIPA, online companies in the K-12 education technology space could collect and sell student personal information obtained through student, parent, and teacher use of the online sites used for K-12 school purposes.  Because SOPIPA only covers the K-12 online space, online companies in the early learning education technology space can collect and sell student personal information obtained through student, parent, and teacher use of online sites used for early learning purposes.  The misuse of student personal information that could legally take place in the K-12 space before SOPIPA took effect on January 1, 2016 can currently take place in the early education space. Accordingly, this bill creates the Early Learning Privacy Information Protection Act (ELPIPA) to extend all of the protections offered by SOPIPA to pupils enrolled in preschools and pre-kindergarten.  ELPIPA imposes requirements directly on Websites, online services, and mobile applications that are designed, marketed and used primarily by children enrolled in a preschool or prekindergarten course of instruction.  ELPIPA would protect early learners’ privacy in this digital age by:

• prohibiting the sale of early learners’ personal information by operators of early learning online sites;
• prohibiting targeted advertising on early learning sites;
• prohibiting operators of early learning online sites from using information they obtain on the early learning site to target advertising on other sites;
• prohibiting operators from amassing a profile about an early learning student except in furtherance of early learning school purposes;
• prohibiting disclosure of early learner personal information unless the disclosure is made in furtherance of the early learning purpose; and
• requiring these early learning online operators to keep the early learner personal information safe and secure.

3. Conforming Amendments

The author proposes the following technical amendments to conform ELPIPA to SOPIPA:

On page 3, in line 4, strike out “if” and insert: “when”

On page 3, in line 22, strike out “Is prohibited from further disclosure of” and insert: “Shall not further disclose”

On page 3, in line 26, after “Is” insert: “legally”

On page 3, in line 26, strike out “(d).” and insert: “(d);”

On page 3, in line 27, strike out “compliance.” and insert: “compliance;”

On page 3, in line 28, strike out “process.” and insert: “process;”

On page 3, in line 29, strike out “others, or the” and insert: “others or security of the site; or”

On page 3, in line 31, strike out “if” and insert: “provided”

On page 3, in line 35, strike out “to” and insert: “by”

On page 4, in line 10, strike out the first “the”

On page 4, in line 13, strike out “pupil if” and insert: “pupil, as long as”

On page 4, in line 14, strike out “violated” and insert: “violated,”

On page 4, in line 20, after “For” insert: “legitimate”

On page 4, in line 20, strike out “purposes” and insert: “purposes:”

On page 4, in line 21, strike out “or” and insert: “and”

On page 4, in line 26, strike out “of” and insert: “on”

On page 4, in line 38, after “including” insert: “in”

On page 4, in line 40, after “deidentified” insert: “pupil”

On page 4, in line 40, strike out “of a pupil”

On page 5, in line 4, strike out “it” and insert: “they”

On page 5, in line 4, strike out “meets” and insert: “meet”

On page 5, in line 16, strike out the second “the” and insert: “a”

On page 5, in line 35, strike out “classroom,” and insert: “classroom”

On page 6, in line 6, strike out “pupil’s educational” and insert: “pupil”

On page 6, in line 9, strike out “site,” and insert: “sites,”

On page 6, in line 22, strike out “by” and insert: “under”

Support: California State PTA; California School Boards Association; Los Angeles Unified School District; Privacy Rights Clearinghouse

Opposition: None Known

HISTORY

Source: Common Sense Kids Action

Related Pending Legislation: None Known

Prior Legislation:

SB 1177 (Steinberg, Ch. 839, Stats. 2014) See background.

SB 568 (Steinberg, Ch. 336, Stats. 2013) prohibited an operator of an Internet Web site, online service, online application, or mobile application, as specified, from marketing or advertising specified types of products or services to a minor; prohibited an operator from knowingly using, disclosing, compiling, or allowing a third party to use, disclose, or compile, the personal information of a minor for the purpose of marketing or advertising specified types of products or services; required the operator of an Internet Web site, online service, online application, or mobile application to permit a minor, who is a registered user of the operator’s Internet Web site, online service, online application, or mobile application, to remove, or to request and obtain removal of, content or information posted on the operator’s Internet Web site, service, or application by the minor, as specified.

Prior Vote:

Assembly Floor (Ayes 78, Noes 0)

Assembly Education Committee (Ayes 7, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 10, Noes 0)

**************

1. Fordham Law School Center for Law and Information Policy Report, Privacy and Cloud Computing in Public Schools (Dec. 13, 2013); Stephanie Simon, Politico, Data Mining Your Children (May 15, 2014); Paul Schwartz, The Battle for Leadership in Education Privacy Law:  Will California Seize the Throne? (March 27, 2014); Benjamin Herold, Education Week, Google Under Fire for Data-Mining Student Email Messages (March 26, 2014); Los Angeles Times Editorial Board, U.S. Needs To Add Student Online Privacy Rules: A Bill By State Sen. Darrell Steinberg Would Ban Private Firms Contracting With Public Schools From Selling California Student’s Records (March 5, 2014); The Sacramento Bee Editorial Board, State Should Not Wait For Congress to Protect Kids’ Privacy (March 3, 2014); Natasha Singer, The New York Times, Scrutiny in California For Software In Schools (Feb. 20, 2014). ↑

Date of Hearing: May 4, 2016

ASSEMBLY COMMITTEE ON EDUCATION

Patrick O'Donnell, Chair

ABPCA Bill Id:AB 2799 (

Author:Chau) – As Amended Ver:April 7, 2016

[This bill was double referred to the Committee on Privacy and Consumer Protection and was heard by that committee as it relates to issues under its jurisdiction.]

SUBJECT: Privacy: personal information: preschool and prekindergarten purposes

SUMMARY: Prohibits operators of Internet websites, online services, and mobile apps that are designed, marketed and used primarily for prekindergarten and preschool pupils, from using data about those pupils for targeting, marketing or profiling, and prohibits selling or disclosing a pupil’s information with limited exceptions. Specifically, this bill:

1. Establishes the Early Learning Personal Information Protection Act (ELPIPA), which prohibits an operator of an Internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool or prekindergarten purposes (Operator) from knowingly engaging in any of the following activities:
   1. Engaging in targeted advertising on the Operator’s site, service, or application; or targeting advertising on any other site, service, or application when the targeting of the advertising is based upon any information, including covered information and persistent unique identifiers, that the Operator has acquired because of the use of that Operator’s site, service, or application;
      
   2. Using information, including persistent unique identifiers, created or gathered by the Operator’s site, service, or application, to amass a profile about a pupil except in furtherance of preschool or prekindergarten purposes;
   3. Selling or disclosing a pupil’s information, except in the case of a purchase, merger, or other type of acquisition of an entity that operates an Internet website, online service, online application, or mobile application by another entity; and
   4. Disclosing covered information, unless the disclosure is made:
      
2. In furtherance of the preschool or prekindergarten purposes of the site, service, or application;
3. To ensure legal and regulatory compliance;
4. To respond to or participate in judicial process;
5. To protect the safety of users or others or security of the site; or
6. To a service provider, provided the service provider is contractually required to comply with specified security procedures.
   
7. Specifies that ELPIPA does not prohibit an Operator from using information to maintain, develop, support, improve, or diagnose an Operator’s website, service, or application.
8. Requires under ELPIPA that an Operator implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.
9. Requires an Operator to delete a pupil’s covered information if the preschool or prekindergarten requests deletion of data under the control of the preschool, prekindergarten, school or district.
10. Permits an Operator to disclose the covered information of a student under the following circumstances:
    1. If other provisions of federal or state law require the Operator to disclose the information, and the Operator complies with the requirements of federal and state law in protecting and disclosing that information;
       
    2. For legitimate research purposes, as specified, if no covered information is used for any purpose in furtherance of advertising or to amass a profile on the student for purposes other than preschool or prekindergarten purposes; and
       
    3. If the disclosure is to a state or local educational agency, including preschools and prekindergartens, schools and school districts as permitted by state or federal law.
11. Permits an Operator to use aggregated, de-identified covered information of a pupil as follows:
    
    1. Within the Operator’s site, service, or application or other sites, services, or applications owned by the Operator to improve educational products;
       
    2. To demonstrate the effectiveness of the Operator’s products, including in their marketing; and
       
    3. To share aggregated de-identified pupil covered information for the development and improvement of educational sites, services, or applications.
       
12. Defines “pupil” as a child enrolled in a preschool or prekindergarten course of instruction.
13. Defines “online services” under ELPIPA to include cloud computing services.
    
14. Defines “covered information” under ELPIPA to mean information or materials in any media or format that meets any of the following:
    
    1. Are created or provided by a pupil, or the pupil’s parent or legal guardian, in the course of the pupil’s, parent’s, or legal guardian’s use of the site, service, or application for preschool or prekindergarten purposes;
       
    2. Are created or provided by an employee or agent of the educational institution; and
       
    3. Are gathered by the site, service, or application, that is descriptive of a pupil or otherwise personally identifies a pupil, including, but not limited to, information in the pupil’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocation information.
       
15. Defines “preschool or prekindergarten purposes” under ELPIPA to mean purposes that customarily take place at the direction of the preschool, prekindergarten, teacher, or school district, or aid in the administration of preschool or prekindergarten activities, including, but not limited to, instruction in the classroom or home, administrative activities, and collaboration between pupils, preschool or prekindergarten personnel, or parents, or are for the use and benefit of the preschool or prekindergarten.
    
16. Specifies that ELPIPA does not limit the authority of a law enforcement agency to obtain any content or information from an Operator as authorized by law or pursuant to an order of a court of competent jurisdiction.
    
17. Authorizes an Operator to use a pupil’s educational data for adaptive learning or customized early learning purposes.
    
18. Specifies that ELPIPA does not apply to general audience Internet websites, general audience online services, general audience online applications, or general audience mobile applications, even if login credentials created for an Operator’s site, service or application may be used to access those general audience sites, services, or applications.
    
19. Specifies that ELPIPA does not limit Internet service providers from providing Internet connectivity to preschools, prekindergartens, schools or pupils and their families.
    
20. Clarifies that ELPIPA does not prohibit an Operator from marketing educational products directly to parents as long as the marketing was not the result of covered information obtained by the Operator through the provision of services covered under this section.
    
21. Clarifies that ELPIPA does not impose a duty upon a provider of an electronic store, gateway, marketplace, interactive computer service, or other means of purchasing or downloading software or applications to review or enforce compliance of this section on those applications or software.
    
22. Provides that ELPIPA does not impede the ability of minors to download, export, or otherwise save or maintain their own student created data or documents.

EXISTING LAW:

1. Establishes the Student Online Privacy Protection Act (SOPIPA), which prohibits an operator of a website, online service, online application, or mobile application from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a K-12 student, selling a student’s information, or disclosing covered information, as provided. (Business and Professions Code (BPC) Section 22584-85)
2. Defines an “Operator” as the operator of a website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K-12 school purposes. (BPC 22584(a))
3. Requires an Operator of a commercial website or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its website to conspicuously post its privacy policy. (BPC 22575)
   
4. Protects, pursuant to the federal Family Educational Rights and Privacy Act (FERPA), the confidentiality of educational records (and personally identifiable information contained therein) by prohibiting the funding of schools that permit the release of those records. It applies to all schools that receive funds under an applicable program of the U.S. Department of Education. Generally, schools must have written permission from the parent or eligible student in order to release any information from a student’s education record. FERPA’s prohibition only applies to the school itself and contains various exemptions where the data may be released without the written consent of the parents. (20 U.S.C. Sec. 1232g(b)(1))
   
5. Prohibits, pursuant to the federal Children's Online Privacy Protection Act of 1998, an Operator of a website or online service directed to pupils under the age of 13 from collecting personal information from a pupil, including a pupil’s first and last name, home or other physical address including street name and name of a city or town, e-mail address, telephone number, or Social Security number. (5 U.S.C. 6501-6505)

FISCAL EFFECT: This bill is keyed nonfiscal

COMMENTS:

1. Purpose of this bill. This bill is intended to close a gap in current online student privacy laws for prekindergarten and preschool pupils by applying to those pupils the existing privacy protections that currently apply to K-12 students. AB 2799 is sponsored by Common Sense Media.
2. Author’s statement. According to the author's office, "In 2014, California became the national leader on student privacy protections with the unanimous passage of SB 1177 (Steinberg), the Student Online Personal Information Protection Act (SOPIPA). While SOPIPA protects privacy for K-12 students, our new law does not protect children in pre-kindergarten and preschool classrooms. Preschools should also be safe-havens for learning just as K-12 classrooms are today under SOPIPA. This bill, the Early Learning Privacy Information Protection Act (ELPIPA), simply extends the protections offered by SOPIPA to preschool and pre-kindergarten kids."

“ELPIPA protects privacy but still enables innovation, because it allows companies to use de-identified kids’ information internally to improve educational products and services. The bill also allows sharing of aggregated de-identified personal data for the development of educational sites, services, and apps.”

1. Technology in the preschool classroom. Technology is an integral part of learning for today’s kids, even for the youngest among them. Preschool and prekindergarten teachers are increasingly integrating tablets into the classroom and using cloud-computing services to enrich student education and improve academic operations.
   
   According to a recent study conducted by Common Sense Media, technology and media use begins at an increasingly young age, with as many as 38% of kids under the age of two using mobile devices for media in 2013. The report also found that half (50%) of all children ages zero to eight have used mobile apps, up from just 16% in 2011. According to the study, the most frequently used apps are educational games (43%), games that are just for fun (42%), and creative apps such as those for drawing, music, or photos (38%). (“Zero to Eight: Children’s Media Use in America” Common Sense Media, 2013.)

A 2015 industry survey that examined early childhood education and marketing educational products for 4-year-olds found that 65% of preschool educators are already using digital devices and materials in their classrooms. The report focused on children who were enrolled in Head Start, state and locally funded public prekindergarten classrooms, and private childcare centers. (“Market Opportunities for PreK Instructional Materials 2015-2016” Simba Information, 2015)

1. Federal student privacy law. FERPA protects the confidentiality of school records by prohibiting federal funding of schools that permit the release of those records. FERPA’s prohibition only applies to the school itself – not technology vendors – and contains various exemptions allowing data to be released without the written consent of the parents.

Since the enactment of FERPA in 1974, educational institutions have undergone dramatic changes in the way students are taught. Schools now routinely use computers, the Internet, and digital resources in a variety of ways to support teaching and learning. Electronic grade books, digital portfolios, learning games, and real-time feedback on teacher and student performance are just a few of the ways technology is now integrated into classroom learning. More recently, these changes led California to pass its own student privacy law, discussed below.

1. California's student privacy law. In 2014, California became the national leader on student privacy protections with the unanimous passage of SB 1177 (Steinberg, Chapter 839, Statutes of 2014)), known SOPIPA. SOPIPA went into effect on January 1, 2016, and mandates privacy and data security requirements on websites, online services, and mobile apps that are designed, marketed and used primarily for K-12 students.
   
   SOPIPA was passed in response to the massive amounts of sensitive student data that online educational products and services were collecting about students, including academic performance, health records, and personal interests. However, SOPIPA only applies to K-12 students, leaving younger children in preschool and pre-kindergarten classrooms without the same privacy protections, despite the fact that many were using educational technology.

While SOPIPA dealt with the protection of student information obtained through the use of websites, online services, and mobile apps by students and teachers, AB 1584 (Buchanan, Chapter 800, Statutes of 2014) dealt with contracts that local education agencies enter into with third parties for digital educational software and services for the digital storage, management, and retrieval of student records. AB 1584 requires such contracts to contain specified provisions that prohibit the third party from using information in student records for any purposes other than those required or specifically permitted by the contract.

1. ELPIPA in practice. This bill, dubbed the “Early Learning Personal Information Protection Act,” is modeled on SOPIPA and expands the same privacy and data security requirements that exist today for K-12 oriented websites, online services, and mobile apps to those designed primarily for prekindergarten and preschool pupils.

The major provisions of this bill would:

• Prohibit using pupils’ personal information for targeted advertising;
• Prohibit using pupils’ personal information for profiling (except for school purposes);
• Prohibit selling pupils’ personal information;
• Prohibit disclosing pupils’ personal information (with limited exceptions to permit site functionality or as required by law);
• Require reasonable data security for the pupils’ information; and
• Require companies to delete pupils’ information upon the school’s request.

REGISTERED SUPPORT / OPPOSITION:

Support

Privacy Rights Clearinghouse

Opposition

None received

Analysis Prepared by: Rick Pratt / ED. / (916) 319-2087

Date of Hearing: April 12, 2016

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 2799 (

Author:Chau) – As Amended Ver:April 7, 2016

SUBJECT: Privacy: personal information: preschool and prekindergarten purposes

SUMMARY: Prohibits operators of Internet websites, online services, and mobile apps that are designed, marketed and used primarily for prekindergarten and preschool pupils, from using data about those pupils for targeting, marketing or profiling, and prohibits selling or disclosing a pupil’s information with limited exceptions. Specifically, this bill:

1. Establishes the Early Learning Personal Information Protection Act (ELPIPA), which prohibits an operator of an Internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool or prekindergarten purposes (Operator) from knowingly engaging in any of the following activities:
   1. Engaging in targeted advertising on the Operator’s site, service, or application; or targeting advertising on any other site, service, or application when the targeting of the advertising is based upon any information, including covered information and persistent unique identifiers, that the Operator has acquired because of the use of that Operator’s site, service, or application;
      
   2. Using information, including persistent unique identifiers, created or gathered by the Operator’s site, service, or application, to amass a profile about a pupil except in furtherance of preschool or prekindergarten purposes;
   3. Selling or disclosing a pupil’s information, except in the case of a purchase, merger, or other type of acquisition of an entity that operates an Internet website, online service, online application, or mobile application by another entity; and
   4. Disclosing covered information, unless the disclosure is made:
      
2. In furtherance of the preschool or prekindergarten purposes of the site, service, or application;
3. To ensure legal and regulatory compliance;
4. To respond to or participate in judicial process;
5. To protect the safety of users or others or security of the site; or
6. To a service provider, provided the service provider is contractually required to comply with specified security procedures.
   
7. Specifies that ELPIPA does not prohibit an Operator from using information to maintain, develop, support, improve, or diagnose an Operator’s website, service, or application.
8. Requires under ELPIPA that an Operator implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.
9. Requires an Operator to delete a pupil’s covered information if the preschool or prekindergarten requests deletion of data under the control of the preschool, prekindergarten, school or district.
10. Permits an Operator to disclose the covered information of a student under the following circumstances:
    1. If other provisions of federal or state law require the Operator to disclose the information, and the Operator complies with the requirements of federal and state law in protecting and disclosing that information;
       
    2. For legitimate research purposes, as specified, if no covered information is used for any purpose in furtherance of advertising or to amass a profile on the student for purposes other than preschool or prekindergarten purposes; and
       
    3. If the disclosure is to a state or local educational agency, including preschools and prekindergartens, schools and school districts as permitted by state or federal law.
11. Permits an Operator to use aggregated, de-identified covered information of a pupil as follows:
    
    1. Within the Operator’s site, service, or application or other sites, services, or applications owned by the Operator to improve educational products;
       
    2. To demonstrate the effectiveness of the Operator’s products, including in their marketing; and
       
    3. To share aggregated de-identified pupil covered information for the development and improvement of educational sites, services, or applications.
       
12. Defines “pupil” as a child enrolled in a preschool or prekindergarten course of instruction.
13. Defines “online services” under ELPIPA to include cloud computing services.
    
14. Defines “covered information” under ELPIPA to mean information or materials in any media or format that meets any of the following:
    
    1. Are created or provided by a pupil, or the pupil’s parent or legal guardian, in the course of the pupil’s, parent’s, or legal guardian’s use of the site, service, or application for preschool or prekindergarten purposes;
       
    2. Are created or provided by an employee or agent of the educational institution; and
       
    3. Are gathered by the site, service, or application, that is descriptive of a pupil or otherwise personally identifies a pupil, including, but not limited to, information in the pupil’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocation information.
       
15. Defines “preschool or prekindergarten purposes” under ELPIPA to mean purposes that customarily take place at the direction of the preschool, prekindergarten, teacher, or school district, or aid in the administration of preschool or prekindergarten activities, including, but not limited to, instruction in the classroom or home, administrative activities, and collaboration between pupils, preschool or prekindergarten personnel, or parents, or are for the use and benefit of the preschool or prekindergarten.
    
16. Specifies that ELPIPA does not limit the authority of a law enforcement agency to obtain any content or information from an Operator as authorized by law or pursuant to an order of a court of competent jurisdiction.
    
17. Authorizes an Operator to use a pupil’s educational data for adaptive learning or customized early learning purposes.
    
18. Specifies that ELPIPA does not apply to general audience Internet websites, general audience online services, general audience online applications, or general audience mobile applications, even if login credentials created for an Operator’s site, service or application may be used to access those general audience sites, services, or applications.
    
19. Specifies that ELPIPA does not limit Internet service providers from providing Internet connectivity to preschools, prekindergartens, schools or pupils and their families.
    
20. Clarifies that ELPIPA does not prohibit an Operator from marketing educational products directly to parents as long as the marketing was not the result of covered information obtained by the Operator through the provision of services covered under this section.
    
21. Clarifies that ELPIPA does not impose a duty upon a provider of an electronic store, gateway, marketplace, interactive computer service, or other means of purchasing or downloading software or applications to review or enforce compliance of this section on those applications or software.
    
22. Provides that ELPIPA does not impede the ability of minors to download, export, or otherwise save or maintain their own student created data or documents.

EXISTING LAW:

1. Establishes the Student Online Privacy Protection Act (SOPIPA), which prohibits an operator of a website, online service, online application, or mobile application from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a K-12 student, selling a student’s information, or disclosing covered information, as provided. (Business and Professions Code (BPC) Section 22584-85)
2. Defines an “Operator” as the operator of a website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K-12 school purposes. (BPC 22584(a))
3. Requires an Operator of a commercial website or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its website to conspicuously post its privacy policy. (BPC 22575)
   
4. Protects, pursuant to the federal Family Educational Rights and Privacy Act (FERPA), the confidentiality of educational records (and personally identifiable information contained therein) by prohibiting the funding of schools that permit the release of those records. It applies to all schools that receive funds under an applicable program of the U.S. Department of Education. Generally, schools must have written permission from the parent or eligible student in order to release any information from a student’s education record. FERPA’s prohibition only applies to the school itself and contains various exemptions where the data may be released without the written consent of the parents. (20 U.S.C. Sec. 1232g(b)(1))
   
5. Prohibits, pursuant to the federal Children's Online Privacy Protection Act of 1998, an Operator of a website or online service directed to pupils under the age of 13 from collecting personal information from a pupil, including a pupil’s first and last name, home or other physical address including street name and name of a city or town, e-mail address, telephone number, or Social Security number. (5 U.S.C. 6501-6505)

FISCAL EFFECT: None. This bill is keyed nonfiscal by the Legislative Counsel.

COMMENTS:

1. Purpose of this bill. This bill is intended to close a gap in current online student privacy laws for prekindergarten and preschool pupils by applying to those pupils the existing privacy protections that currently apply to K-12 students. AB 2799 is sponsored by Common Sense Media.
2. Author’s statement. According to the author's office, "In 2014, California became the national leader on student privacy protections with the unanimous passage of SB 1177 (Steinberg), the Student Online Personal Information Protection Act (SOPIPA). While SOPIPA protects privacy for K-12 students, our new law does not protect children in pre-kindergarten and preschool classrooms. Preschools should also be safe-havens for learning just as K-12 classrooms are today under SOPIPA. This bill, the Early Learning Privacy Information Protection Act (ELPIPA), simply extends the protections offered by SOPIPA to preschool and pre-kindergarten kids."

“ELPIPA protects privacy but still enables innovation, because it allows companies to use de-identified kids’ information internally to improve educational products and services. The bill also allows sharing of aggregated de-identified personal data for the development of educational sites, services, and apps.”

1. Technology in the preschool classroom. Technology is an integral part of learning for today’s kids, even for the youngest among them. Preschool and prekindergarten teachers are increasingly integrating tablets into the classroom and using cloud-computing services to enrich student education and improve academic operations.
   
   According to a recent study conducted by Common Sense Media, technology and media use begins at an increasingly young age, with as many as 38% of kids under the age of two using mobile devices for media in 2013. The report also found that half (50%) of all children ages zero to eight have used mobile apps, up from just 16% in 2011. According to the study, the most frequently used apps are educational games (43%), games that are just for fun (42%), and creative apps such as those for drawing, music, or photos (38%). (“Zero to Eight: Children’s Media Use in America” Common Sense Media, 2013.)

A 2015 industry survey that examined early childhood education and marketing educational products for 4-year-olds found that 65% of preschool educators are already using digital devices and materials in their classrooms. The report focused on children who were enrolled in Head Start, state and locally funded public prekindergarten classrooms, and private childcare centers. (“Market Opportunities for PreK Instructional Materials 2015-2016” Simba Information, 2015)

1. Federal student privacy law. FERPA protects the confidentiality of school records by prohibiting federal funding of schools that permit the release of those records. FERPA’s prohibition only applies to the school itself – not technology vendors – and contains various exemptions allowing data to be released without the written consent of the parents.

Since the enactment of FERPA in 1974, educational institutions have undergone dramatic changes in the way students are taught. Schools now routinely use computers, the Internet, and digital resources in a variety of ways to support teaching and learning. Electronic grade books, digital portfolios, learning games, and real-time feedback on teacher and student performance are just a few of the ways technology is now integrated into classroom learning. More recently, these changes led California to pass its own student privacy law, discussed below.

1. California's student privacy law. In 2014, California became the national leader on student privacy protections with the unanimous passage of SB 1177 (Steinberg), known SOPIPA. SOPIPA went into effect on January 1, 2016, and mandates privacy and data security requirements on websites, online services, and mobile apps that are designed, marketed and used primarily for K-12 students.
   
   SOPIPA was passed in response to the massive amounts of sensitive student data that online educational products and services were collecting about students, including academic performance, health records, and personal interests. However, SOPIPA only applies to K-12 students, leaving younger children in preschool and pre-kindergarten classrooms without the same privacy protections, despite the fact that many were using educational technology.
2. ELPIPA in practice. This bill, dubbed the “Early Learning Personal Information Protection Act,” is modeled on SOPIPA and expands the same privacy and data security requirements that exist today for K-12 oriented websites, online services, and mobile apps to those designed primarily for prekindergarten and preschool pupils.

The major provisions of this bill would:

• Prohibit using pupils’ personal information for targeted advertising;
• Prohibit using pupils’ personal information for profiling (except for school purposes);
• Prohibit selling pupils’ personal information;
• Prohibit disclosing pupils’ personal information (with limited exceptions to permit site functionality or as required by law);
• Require reasonable data security for the pupils’ information; and
• Require companies to delete pupils’ information upon the school’s request.

1. Recent amendments harmonize the bill with current law. As the model for this bill, SOPIPA (which is located in the Business and Professions Code) explicitly describes the K-12 students protected by the bill as “students,” while the Education Code generally refers to K-12 students as well as preschool students as “pupils.” The prior version of this bill used the term “child” and “minor” to describe the children in pre-kindergarten and preschool protected by its provisions.
   
   For the sake of consistency and to help alleviate a concern that the bill, as introduced, may have applied to young children who are not yet in preschool or prekindergarten, the author amended the bill to replace the terms “child” and “minor” with the term “pupil.” The term pupil is defined in the bill as “a child enrolled in a preschool or prekindergarten course of instruction.”
2. Arguments in support. The California State PTA states in support of this bill, “Schools are increasingly integrating the use of computers and technology in the classroom even with our youngest students. Preschools and pre-kindergartens are integrating tablets in the class room and utilizing other interactive technologies to enhance student learning. California is recognized as a leader in student online privacy protections with the passage of AB 1177 (Steinberg) in 2014. California State PTA was a strong supporter of the bill which assured the privacy and security of personal and academic information for K-12 students. Preschoolers and pre-kindergarteners need to be provided with the same protections.”

Los Angeles Unified School District notes in support that “preschools and pre-kindergartens were not afforded the same privacy protections under [SOPIPA] as California’s K-12 schools. Because of this, AB 2799 (The Early Learning Privacy Information Protection Act [ELPIPA]) would extend the protections offered under SOPIPA to early education programs. The use of technology in the classroom provides an opportunity for our students to learn and explore while preparing them for a 21st century workforce. It is important to allow these technologies to flourish, but there needs to be constraint and restriction in how the information gathered is utilized.”

The bill’s sponsor, Common Sense Kids Action, states in support that this bill “is among seven bills and one budget proposal chosen by our team of skilled policy staff and advisors to receive a For Kids rating and Common Sense Star through our Common Sense Legislative Ratings initiative.”

1. Prior Legislation. SB 1177 (Steinberg), Chapter 839, Statutes of 2014, known SOPIPA, prohibits websites, online services, and mobile apps that are designed, marketed and used primarily for K-12 students from using student data for targeting marketing or profiling, and prohibits selling or disclosing student information with limited exceptions. SB 1177 also requires reasonable security procedures and the deletion of student data upon a school’s request.
2. Double-referral. This bill was double-referred to the Assembly Education Committee, where it will be heard if passed by this Committee.

REGISTERED SUPPORT / OPPOSITION:

Support

Common Sense Media (sponsor)

California State PTA

Los Angeles Unified School District

Privacy Rights Clearinghouse

Opposition

None on file.

Analysis Prepared by: Jennie Bretschneider / P. & C.P. / (916) 319-2200