The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The act establishes a variety of exceptions to the obligations imposed on a business under these provisions. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

The Early Learning Personal Information Protection Act and the Student Online Personal Information Protection Act prohibit the operator of specified internet websites, online services, online applications, or mobile applications from knowingly engaging in targeted advertising to amass a profile about a preschool or prekindergarten pupil or K12 student, selling a pupils or students information, or disclosing covered information, except as otherwise provided. Existing law defines covered information as personally identifiable information or materials, in any media or format that, among other things, is gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or student or otherwise identifies a pupil or student.

This bill would instead refer to a K12 student as a pupil, and make conforming changes.

Existing law requires an operator to take specified other actions relating to the protection of a pupils or students covered information, including implementing and maintaining reasonable security procedures and practices and deleting a pupils or students covered information if the school or district requests deletion of data under the control of the school or district.

This bill would except from that deletion requirement, with respect to K-12 pupils, pupil records held by a national assessment provider, as defined, and that only include standardized test results. The bill would additionally require, except as prescribed, an operator to delete a preschool, prekindergarten, or K12 pupils covered information under the operators control that is not subject to the CCPA if the pupils parent or legal guardian, the pupils education rights holder, or the pupil, as prescribed, requests an operator to delete the covered information under the operators control if the pupil has been no longer enrolled in the local educational agency, preschool, prekindergarten, or district, as applicable, for at least 60 days and would require an operator to require documentation that the pupil is no longer enrolled. The bill would also specify that these provisions shall not be interpreted to limit or supersede any rights or requirements under specified federal law.

The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The act establishes a variety of exceptions to the obligations imposed on a business under these provisions. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

The Early Learning Personal Information Protection Act and the Student Online Personal Information Protection Act prohibit the operator of specified internet websites, online services, online applications, or mobile applications from knowingly engaging in targeted advertising to amass a profile about a preschool or prekindergarten pupil or K12 student, selling a pupils or students information, or disclosing covered information, except as otherwise provided. Existing law defines covered information as personally identifiable information or materials, in any media or format that, among other things, is gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or student or otherwise identifies a pupil or student.

This bill would instead refer to a K12 student as a pupil, and make conforming changes.

Existing law requires an operator to take specified other actions relating to the protection of a pupils or students covered information, including implementing and maintaining reasonable security procedures and practices and deleting a pupils or students covered information if the school or district requests deletion of data under the control of the school or district.

This bill would except from that deletion requirement, with respect to K-12 pupils, pupil records held by a national assessment provider, as defined, and that only include standardized test results. The bill would additionally require, except as prescribed, an operator to delete a preschool, prekindergarten, or K12 pupils covered information under the operators control that is not subject to the CCPA if the pupils parent or legal guardian, the pupils education rights holder, or the pupil, as prescribed, requests an operator to delete the covered information under the operators control if the pupil has been no longer enrolled in the local educational agency, preschool, prekindergarten, or district, as applicable, for at least 60 days and would require an operator to require documentation that the pupil is no longer enrolled. The bill would also specify that these provisions shall not be interpreted to limit or supersede any rights or requirements under specified federal law.

The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The act establishes a variety of exceptions to the obligations imposed on a business under these provisions. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

The Early Learning Personal Information Protection Act and the Student Online Personal Information Protection Act, prohibits Act prohibit the operator of specified internet websites, online services, online applications, or mobile applications from knowingly engaging in targeted advertising to amass a profile about a preschool or prekindergarten pupil or K12 student, selling a pupils or students information, or disclosing covered information, except as otherwise provided. Existing law defines covered information as personally identifiable information or materials, in any media or format that, among other things, is gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or student or otherwise identifies a pupil or student.

This bill would instead refer to a K12 student as a pupil, and make conforming changes.

Existing law requires an operator to take specified other actions relating to the protection of a pupils or students covered information, including implementing and maintaining reasonable security procedures and practices, practices and deleting a pupils or students covered information if the school or district requests deletion of data under the control of the school or district.

This bill would except from that deletion requirement, with respect to K-12 pupils, pupil records held by a national assessment provider, as defined, and that only include standardized test results. The bill would require additionally require, except as prescribed, an operator to delete a preschool, prekindergarten, or K12 pupils covered information under the operators control that is not subject to the CCPA if the pupils parent or legal guardian, the pupils education rights holder, or the pupil, as provided, prescribed, requests an operator to delete the covered information under the operators control if the pupil is has been no longer enrolled in the local educational agency, preschool, prekindergarten, or district, as applicable, for at least 60 days and would require an operator to require documentation that the pupil is no longer enrolled. The bill would also specify that these provisions shall not be interpreted to limit or supersede any rights or requirements under specified federal law.

The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The act establishes a variety of exceptions to the obligations imposed on a business under these provisions. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

Existing law, the Early Learning Personal Information Protection Act and the Student Online Personal Information Protection Act, prohibits the operator of specified internet websites, online services, online applications, or mobile applications from knowingly engaging in targeted advertising to amass a profile about a preschool or prekindergarten pupil or K12 student, selling a pupils or students information, or disclosing covered information, except as otherwise provided. Existing law defines covered information as personally identifiable information or materials, in any media or format that, among other things, is gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or student or otherwise identifies a pupil or student.

This bill would instead refer to a K12 student as a pupil, and make conforming changes. The bill would additionally provide that, when applied to K12 pupils, covered information does not include mandatory pupil records, official records, files, and data directly related to a pupil and maintained by the school or local educational agency, including information within records encompassing all the material kept in the pupils cumulative folder.

Existing law requires an operator to take specified other actions relating to the protection of a pupils or students covered information, including implementing and maintaining reasonable security procedures and practices, and deleting a pupils or students covered information if the school or district requests deletion of data under the control of the school or district.

This bill would require an operator to delete a preschool, prekindergarten, or K12 pupils covered information that is not subject to the CCPA if the pupils parent or legal guardian, the pupils education rights holder, or the pupil, as provided, requests an operator to delete the covered information under the operators control if the pupil is no longer enrolled in the local educational agency, preschool, prekindergarten, or district, as applicable, and would require an operator to require documentation that the pupil is no longer enrolled. The bill would also specify that these provisions shall not be interpreted to limit or supersede any rights or requirements under specified federal law.

The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The act establishes a variety of exceptions to the obligations imposed on a business under these provisions. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

Existing law, the Early Learning Personal Information Protection Act and the Student Online Personal Information Protection Act, prohibit prohibits the operator of specified internet websites, online services, online applications, or mobile applications from knowingly engaging in targeted advertising to amass a profile about a preschool, prekindergarten, preschool or prekindergarten pupil or K12 student, selling a pupils or students information, or disclosing covered information, except as otherwise provided. Existing law defines covered information as personally identifiable information or materials, in any media or format that, among other things, is gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or student or otherwise identifies a pupil or student.

This bill would instead refer to a K12 student as a pupil, and make conforming changes. The bill would additionally provide that, when applied to K12 students, pupils, covered information does not include mandatory pupil records, official records, files, and data directly related to a student pupil and maintained by the school or local educational agency, including information within records encompassing all the material kept in the students pupils cumulative folder.

Existing law requires an operator to take specified other actions relating to the protection of a student or parents pupils or students covered information, including implementing and maintaining reasonable security procedures and practices, and deleting a pupils or students covered information if the school or district requests deletion of data under the control of the school or district.

This bill would require an operator to delete a preschool, prekindergarten, or K12 students pupils covered information that is not subject to the CCPA if the student, or the students pupils parent or legal guardian, the pupils education rights holder, or the pupil, as provided, requests an operator to delete the covered information under the operators control if the student pupil is no longer attending the school or district, enrolled in the local educational agency, preschool, prekindergarten, or district, as applicable, and would require an operator to require documentation that the student no longer attends the school or district. pupil is no longer enrolled. The bill would also specify that these provisions shall not be interpreted to limit or supersede any rights or requirements under specified federal law.

Existing law, the Early Learning Personal Information Protection Act and the Student Online Personal Information Protection Act, prohibit the operator of specified internet websites, online services, online applications, or mobile applications from knowingly engaging in targeted advertising to amass a profile about a preschool, prekindergarten, or K12 student, selling a students information, or disclosing covered information, as defined, except as otherwise provided. Existing law requires defines covered information as personally identifiable information or materials, in any media or format that, among other things, is gathered by an operator through the operation of a site, service, or application and is descriptive of a student or otherwise identifies a student.

Existing law requires an operator to take specified other actions relating to the protection of a student or parents covered information, including implementing and maintaining reasonable security procedures and practices, and deleting a students covered information if the school or district requests deletion of data under the control of the school or district.

This bill would require an operator to delete a preschool, prekindergarten, or K12 students covered information that is not subject to the CCPA if the student, or the students parent or legal guardian, as provided, requests an operator to delete the covered information under the operators control if the student is no longer attending the school or district, and would authorize require an operator to require documentation that the student no longer attends the school or district.

Existing law, the Early Learning Personal Information Protection Act and the Student Online Personal Information Protection Act, prohibit the operator of specified internet websites, online services, online applications, or mobile applications from knowingly engaging in targeted advertising to amass a profile about a preschool, prekindergarten, or K12 student, selling a students information, or disclosing covered information, as defined, except as otherwise provided. Existing law requires an operator to take specified other actions relating to the protection of a student or parents covered information, including implementing and maintaining reasonable security procedures and practices, and deleting a students covered information if the school or district requests deletion of data under the control of the school or district.

This bill would require an operator to delete a preschool, prekindergarten, or K12 students covered information if the student, or the students parent or legal guardian, requests an operator to delete the covered information under the operators control if the student is no longer attending the school or district, and would authorize an operator to require documentation that the student no longer attends the school or district.

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 801

Author:(Joe Patterson)

As Amended Ver:August 23, 2024

Majority vote

SUMMARY

Requires an operator of an internet website, online service, online application, or mobile application to delete a student's information, as defined, at the request of the student's parent or guardian, if the student is no longer attending a school or school district.

Senate Amendments

1. Define "national assessment provider" as a person that develops, sponsors or administers standardized tests.
2. Define "standardized test" as a test administered at the expense of the test subject that is used for the purposes of admission in postsecondary institutions or a test used for preliminary preparation for the admission tests.
3. Clarify that the national assessment provider is not required to delete pupil records that only include standardized test results.
4. State that the covered information under the operator's control needs to be deleted if requested if the student has not been enrolled for at least 60 days.
5. Make technical and clarifying changes.

COMMENTS

This bill is intended to ensure that students, parents and guardians have the ability to require that third-party vendors delete identifying information related to the student if they are no longer enrolled in the school.

The use of online education programs and mobile applications has opened a back door through which student information—even information that is otherwise protected by federal Family Educational Rights and Privacy Act (FERPA)—can be freely accessed and used by the company collecting it. In addition, it is unclear whether an educational technology business operating under a contract with a school district is bound by the California Consumer Privacy Act (CCPA) because even though it may meet the definition of a "business" under the CCPA, it is under contract to a government entity that is not bound by the CCPA. This bill addresses this problem by clarifying that in the event the business and the data it is collecting is not covered by the CCPA, then privacy protections similar to those under the CCPA would apply under Student Online Personal Information Protection Act (SOPIPA).

According to the Author

As a father with 4 young children, the protection of their privacy is of utmost importance. Most schools have multiple platforms that students need to download or use as part of their curriculum. The individual schools or districts have so many things on their plates and ultimately, this bill will alleviate some of the burden put on the school and district staff while managing student's information. This bill will give control over student's personal information to their parents and guardians where it belongs.

Arguments in Support

Protection of the Educational Rights of Kids writes: "We support AB 801 because Protection of the Educational Rights of Kids, PERK, cares about protecting students and their personal and covered information. The state has made it possible to provide technology to all students, and it is important that the state take steps to ensure protections for these children, especially pertaining to student privacy. Cybersecurity cannot be overlooked, and this bill will make sure students' covered information is protected from unauthorized use, disclosure, and will be appropriately deleted."

Arguments in Opposition

None on file.

FISCAL COMMENTS

No fiscal impact.

VOTES:

ASM PRIVACY AND CONSUMER PROTECTION: 11-0-0

YES: Gabriel, Joe Patterson, Bauer-Kahan, Bennett, Essayli, Vince Fong, Irwin, Lowenthal, Papan, Wicks, Wilson

ASM EDUCATION: 7-0-0

YES: Muratsuchi, Ortega, Alvarez, Bonta, Flora, Hoover, McCarty

ASSEMBLY FLOOR: 67-0-13

YES: Aguiar-Curry, Alanis, Arambula, Bains, Bennett, Berman, Boerner, Bonta, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Davies, Dixon, Flora, Mike Fong, Vince Fong, Friedman, Gabriel, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Kalra, Lackey, Lee, Low, Lowenthal, Maienschein, Mathis, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Quirk-Silva, Ramos, Reyes, Luz Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

ABS, ABST OR NV: Addis, Alvarez, Bauer-Kahan, Bryan, Chen, Megan Dahle, Essayli, Gallagher, Jones-Sawyer, McCarty, McKinnor, Petrie-Norris, Rendon

SENATE FLOOR: 39-0-1

YES: Allen, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dahle, Dodd, Durazo, Eggman, Glazer, Gonzalez, Grove, Hurtado, Jones, Laird, Limón, McGuire, Menjivar, Min, Newman, Nguyen, Niello, Ochoa Bogh, Padilla, Portantino, Roth, Rubio, Seyarto, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk

ABS, ABST OR NV: Alvarado-Gil

UPDATED

VERSION: August 23, 2024

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0004966

 THIRD READING  

Bill No: AB 801

Author: Joe Patterson (R)

Amended: 8/23/24 in Senate

Vote: 21

SENATE EDUCATION COMMITTEE: 7-0, 6/5/24

AYES: Newman, Jones, Cortese, Glazer, Gonzalez, Smallwood-Cuevas, Wilk

SENATE JUDICIARY COMMITTEE: 11-0, 6/11/24

AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Niello, Roth, Stern, Wahab

ASSEMBLY FLOOR: 67-0, 1/18/24 - See last page for vote

SUBJECT: Student privacy: online personal information

SOURCE: Author

DIGEST:

This bill, at the request of the student’s parent or guardian, requires an operator of an internet website, online service, online application, or mobile application to delete a student’s information if the student is no longer attending a school or school district for at least 60 days.

Senate Floor Amendment of 8/23/24 adds and defines “national assessment provider” and “standardized test” in addition to clarifying that a national assessment provider is not required to delete a pupils records, as specified.

ANALYSIS:

Existing federal law:

1. Protects, pursuant to the federal Family Educational Rights and Privacy Act (FERPA), the confidentiality of educational records meaning those records, files, documents, and other materials which, (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution by prohibiting the funding of schools that permit the release of those records. FERPA applies to all schools that receive funds under an applicable program of the U.S. Department of Education (USDOE). Generally, schools must have written permission from the parent or eligible student in order to release any information from a student’s education record. FERPA’s prohibition only applies to the school itself and contains various exemptions allowing the data to be released without the written consent of the parents. (20 United States Code (U.S.C.) 1232g(b)(1))

Existing state law:

1. Establishes the Student Online Personal Information Protection Act (SOPIPA), which prohibits an operator of a website, online service, online application, or mobile application from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a K-12 student, selling a student’s information, or disclosing covered information, as provided. (Business and Professions Code (BPC) § 22584-85)
2. Defines an “operator” to mean the operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes. (BPC § 22584(a))
3. Defines “covered information” as personally identifiable information or materials, in any media or format that meets any of the following:
   1. It is created or provided by a student, or the student’s parent or legal guardian, to an operator in the course of the student’s, parents’, or legal guardian’s use of the operator’s site, service, or application for the school’s purposes.
   2. It is created or provided by an employee or agent of the preschool, prekindergarten, school district, local education agency, or county office of education (COE) to an operator.
   3. It is gathered by an operator through the operation of a site, service, or application, and is descriptive of a student or otherwise identifies a student, including, but not limited to, information in the student’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocation information. (BPC § 22584(i) and 22586(i))
4. Requires an operator of a commercial website or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its website to conspicuously post its privacy policy. (BPC § 22575)
5. Establishes the California Privacy Protection Agency (CPPA), vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The agency is governed by a five-member board, with the chairperson and one member appointed by the Governor, and the three remaining members are appointed by the Attorney General, the Senate Rules Committee, and the Speaker of the Assembly. (Civil Code (CIV) § 1798.199.10)
6. Authorizes an LEA, pursuant to a policy adopted by its governing board, to enter into a contract with third parties to provide services, including cloud-based services, for the digital storage, management, and retrieval of pupil records, and to provide digital educational software, provided the contract includes specific provisions about the security, use, ownership, and control of the pupil records. (Education Code (EC) § 49073.1)

This bill:

1. Requires an operator, pursuant to the SOPIPA, to delete a student's CCPA-excluded covered information if a pupil's parent, guardian, or education rights holder, or (in the case of a current or former pupil 18 years of age or older) the pupil themselves requests an operator to delete the covered information under the operator's control if the pupil is no longer enrolled in the local educational agency (LEA) for at least 60 days.
2. Requires an operator, pursuant to the ELPIPA, to delete a pupil's CCPA-excluded covered information if a pupil's parent, guardian, or education rights holder, or (in the case of a former pupil 18 years of age or older) the pupil themselves requests an operator to delete the covered information under the operator's control if the pupil is no longer enrolled in the preschool, prekindergarten, or district.
3. Clarifies that a national assessment provider is not required to delete a pupils records, as specified.
4. Defines “National assessment provider” to mean a person that develops, sponsors, or administers standardized test
5. Defines “standardized test to mean a test administered in California at the expense of the test subject, as specified.
6. Defines "covered information" to means personally identifiable information or materials, in any media or format that is created or provided by a pupil, or the pupil’s parent or legal guardian, to an operator in the course of the pupil’s, parent’s, or legal guardian’s use of the operator’s site, service, or application for K–12 school purposes, is created or provided by an employee or agent of the school or LEA to an operator, is gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or otherwise identifies a pupil, including, but not limited to, information in the pupil’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, pupil identifiers, search activity, photographs, voice recordings, or geolocation information, and does not include mandatory pupil records or any official records, files, and data directly related to a pupil and maintained by the school or LEA, including, but not limited to, records encompassing all the material kept in the pupil’s cumulative folder, including, but not limited to, general identifying data, records of attendance and of academic work completed, records of achievement and results of evaluative tests, health data, disciplinary status, test protocols, and individualized education programs.
7. Defines "California Consumer Privacy Act (CCPA)-excluded covered information" or "CCPA-excluded covered information" to mean covered information that is not subject to the California Consumer Privacy Act of 2018.

Comments

1. Need for the bill. According to the author, “As a father with 4 young children, the protection of their privacy is of utmost importance. Most schools have multiple platforms that students need to download or use as part of their curriculum. The individual schools or districts have so many things on their plates and ultimately, this bill will alleviate some of the burden put on the school and district staff while managing student’s information. This bill will give control over student’s personal information to their parents and guardians where it belongs.”
2. New Technology “Clouds” Student Data Privacy. The issue of privacy has become a priority for all stakeholders in the education community, as technology continues to advance. The rise of new technologies like cloud computing and software-as-a-service (SaaS) has heightened concerns about student data privacy. As technology delivers promising devices and applications to enhance learning. For the purposes of digital storage, management, and retrieval of student records, or for digital educational software, many districts choose to have their student information system vendered to ensure the security and privacy of students.

Online providers, including website operators, online service and app providers, may collect data, often tracking a student online and using it to target advertising or profit from the data. While it may seem obvious that such commercial uses of data collected about student online usage should not be allowed, providers of free online services and apps are typically for-profit businesses that must generate revenue to pay employees and add new features to their apps or services.

1. Gaps In Data Privacy Still Exist Despite Student and Data Protection Laws. Statute currently provides protections for students and Californians to ensure individuals are in control of what information is shared and used.

The Family Education Rights Protections Act. FERPA is a federal law that protects "education records," which are records directly related to a student and maintained by an educational agency or institution or a party acting for the agency or institution. FERPA gives parents the right to view their children's academic records, request changes to their child's education records, and prevent schools from sharing personal information from a student's education records with a third party unless the student's parent has given written consent. Districts must inform parents of these rights annually, and parents who believe that their FERPA rights may have been violated can file a complaint with the USDOE. Under current law, school districts can enter into agreements with third parties to offer services and providers for digital storage, management, and retrieval of student records and digital educational software. Each contract must contain specific provisions regarding the security, use, ownership, and control of student records. These details are typically located in a vendors terms of services.

Student Online Personal Information Protection Act. In September 2014, California Governor Jerry Brown signed SB 1177 (Steinberg, Chapter 839, Statutes of 2014), which established SOPIPA. SOPIPA places the responsibility of safeguarding student data directly on the education technology service providers. It explicitly prohibits them from selling student data, using it for targeted advertising to students or their families, or creating profiles on students for non-educational purposes. Additionally, the law mandates that online service providers ensure the security of any data they collect and delete student information when requested by a school or district.

California Consumer Protection Act. In 2018, the California Legislature enacted the CCPA, which granted consumers certain rights regarding their personal information. These rights include the right to know what personal information is collected and sold about them, request specific categories and pieces of personal information, and opt-out of the sale of their personal information for minors under 16 years of age. In 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. The CCPA and CPRA have become the most comprehensive laws in the country for protecting consumers' rights to privacy. The CPPA was created to implement and enforce the CCPA and CPRA, updating existing regulations and adopting new ones.

According to the Assembly Committee on Privacy and Consumer Protection, “In general, state law in the form of SOPIPA mirrors FERPA and the control of online personal information lies within the hands of schools and/or administrators and they control how that data is used. This right to control personal information about students and their families is not extended by SOPIPA to the student, parent, or guardian. As a result, the student has limited control over their educational records stored by online service providers. In addition, information that is obtained directly from a student or teacher by the vendor is not protected, even if it is the same information that would otherwise be protected if it is obtained from school records. However, despite the gaps in FERPA, and SOPIPA, California has some of the most robust privacy protection laws in the nation under the CCPA. Unfortunately, despite the cumulative protections in SOPIPA, FERPA and the CCPA, it remains unclear whether the personal data collected by educational technology vendors is covered when it comes to a consumer’s right to protect their private information.”

The rise of online education programs and mobile applications has raised concerns about potentially misusing student information, even data FERPA protects. There is uncertainty regarding whether educational technology companies operating under contracts with school districts are subject to the CCPA, as they are contracted with a government entity not bound by the CCPA. This bill aims to address this issue by specifying that if the CCPA does not cover the business and the data it collects, then privacy protections similar to those under the CCPA would apply under SOPIPA.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 8/26/24)

California County Superintendents

PERK Advocacy

Oakland Privacy

OPPOSITION: (Verified 8/26/24)

None received

ARGUMENTS IN SUPPORT: According to the California County Superintendents, “AB 801 will allow a parent or student to delete a student’s private information from school technology vendors such as internet websites, online services, and online and mobile applications. Moreover, this bill would prevent such vendors from selling the student’s information. As the author states, this bill's intent is to close gaps in data privacy protection for online programs provided via a local educational agency. While existing law allows for the deletion of a student’s data upon the school or district’s request, this bill will empower the student’s guardian to have control over the student’s personal information. In addition, this bill will result in strengthened data, privacy, and security measures. As technology plays an increasingly important role in our classrooms, these types of measures are more and more important. Not only are such policies beneficial to the students, but also to local educational agencies from an information technology security perspective. For these reasons, we are pleased to support AB 801.”

ASSEMBLY FLOOR: 67-0, 1/18/24

AYES: Aguiar-Curry, Alanis, Arambula, Bains, Bennett, Berman, Boerner, Bonta, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Davies, Dixon, Flora, Mike Fong, Vince Fong, Friedman, Gabriel, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Kalra, Lackey, Lee, Low, Lowenthal, Maienschein, Mathis, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Quirk-Silva, Ramos, Reyes, Luz Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

NO VOTE RECORDED: Addis, Alvarez, Bauer-Kahan, Bryan, Chen, Megan Dahle, Essayli, Gallagher, Jones-Sawyer, McCarty, McKinnor, Petrie-Norris, Rendon

Prepared by: Kordell Hampton / ED. / (916) 651-4105

8/26/24 17:00:42

**** END ****

 THIRD READING 

Bill No: AB 801

Author: Joe Patterson (R)

Amended: 6/13/24 in Senate

Vote: 21

SENATE EDUCATION COMMITTEE: 7-0, 6/5/24

AYES: Newman, Jones, Cortese, Glazer, Gonzalez, Smallwood-Cuevas, Wilk

SENATE JUDICIARY COMMITTEE: 11-0, 6/11/24

AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Niello, Roth, Stern, Wahab

ASSEMBLY FLOOR: 67-0, 1/18/24 - See last page for vote

SUBJECT: Student privacy: online personal information

SOURCE: Author

DIGEST:

This bill, at the request of the student’s parent or guardian, requires an operator of an internet website, online service, online application, or mobile application to delete a student’s information if the student is no longer attending a school or school district.

ANALYSIS: Existing federal law protects, pursuant to the federal Family Educational Rights and Privacy Act (FERPA), the confidentiality of educational records meaning those records, files, documents, and other materials which, (1) contain information directly related to a student; and (2) are maintained by an educational agency or institution or by a person acting for such agency or institution by prohibiting the funding of schools that permit the release of those records. FERPA applies to all schools that receive funds under an applicable program of the U.S. Department of Education (USDOE). Generally, schools must have written permission from the parent or eligible student in order to release any information from a student’s education record. FERPA’s prohibition only applies to the school itself and contains various exemptions allowing the data to be released without the written consent of the parents. (20 United States Code (U.S.C.) 1232g(b)(1))

Existing state law:

1. Requires, pursuant to the federal Children’s Online Privacy Protection Act (COPPA), that an operator of an internet website or online service directed to a child, as defined, or an operator of an internet website or online service that has actual knowledge that it is collecting personal information from a child, to provide notice of what information is being collected and how that information is being used, and to give the parents of the child the opportunity to refuse to permit the operator’s further collection of information from the child. (15 U.S.C. 6502)
2. Establishes the Student Online Personal Information Protection Act (SOPIPA), which prohibits an operator of a website, online service, online application, or mobile application from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a K-12 student, selling a student’s information, or disclosing covered information, as provided. (Business and Professions Code (BPC) § 22584-85)
3. Establishes the Early Learning Personal Information Protection Act (ELPIPA), which prohibits an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool or prekindergarten purposes from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a student, selling a student’s information, or disclosing covered information, as provided. (BPC § 22586-22587)
4. Defines an “operator” to mean the operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes. (BPC § 22584(a))
5. Defines “covered information” as personally identifiable information or materials, in any media or format that meets any of the following:
   1. It is created or provided by a student, or the student’s parent or legal guardian, to an operator in the course of the student’s, parents’, or legal guardian’s use of the operator’s site, service, or application for the school’s purposes.
   2. It is created or provided by an employee or agent of the preschool, prekindergarten, school district, local education agency, or county office of education (COE) to an operator.
   3. It is gathered by an operator through the operation of a site, service, or application, and is descriptive of a student or otherwise identifies a student, including, but not limited to, information in the student’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocation information. (BPC § 22584(i) and 22586(i))
6. Requires an operator of a commercial website or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its website to conspicuously post its privacy policy. (BPC § 22575)
7. Establishes the California Privacy Protection Agency (CPPA), vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The agency is governed by a five-member board, with the chairperson and one member appointed by the Governor, and the three remaining members are appointed by the Attorney General, the Senate Rules Committee, and the Speaker of the Assembly. (Civil Code (CIV) § 1798.199.10)
8. Authorizes an LEA, pursuant to a policy adopted by its governing board, to enter into a contract with third parties to provide services, including cloud-based services, for the digital storage, management, and retrieval of pupil records, and to provide digital educational software, provided the contract includes specific provisions about the security, use, ownership, and control of the pupil records. (Education Code (EC) § 49073.1)

This bill:

1. Requires an operator, pursuant to the SOPIPA, to delete a student's CCPA-excluded covered information if a pupil's parent, guardian, or education rights holder, or (in the case of a current or former pupil 18 years of age or older) the pupil themselves requests an operator to delete the covered information under the operator's control if the pupil is no longer enrolled in the local educational agency (LEA).
2. Requires an operator, pursuant to the ELPIPA, to delete a pupil's CCPA-excluded covered information if a pupil's parent, guardian, or education rights holder, or (in the case of a former pupil 18 years of age or older) the pupil themselves requests an operator to delete the covered information under the operator's control if the pupil is no longer enrolled in the preschool, prekindergarten, or district.
3. Defines "covered information" to means personally identifiable information or materials, in any media or format that is created or provided by a pupil, or the pupil’s parent or legal guardian, to an operator in the course of the pupil’s, parent’s, or legal guardian’s use of the operator’s site, service, or application for K–12 school purposes, is created or provided by an employee or agent of the school or LEA to an operator, is gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or otherwise identifies a pupil, including, but not limited to, information in the pupil’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, pupil identifiers, search activity, photographs, voice recordings, or geolocation information, and does not include mandatory pupil records or any official records, files, and data directly related to a pupil and maintained by the school or LEA, including, but not limited to, records encompassing all the material kept in the pupil’s cumulative folder, including, but not limited to, general identifying data, records of attendance and of academic work completed, records of achievement and results of evaluative tests, health data, disciplinary status, test protocols, and individualized education programs.
4. Defines "California Consumer Privacy Act (CCPA)-excluded covered information" or "CCPA-excluded covered information" to mean covered information that is not subject to the California Consumer Privacy Act of 2018.

Comments

1. Need for the bill. According to the author, “As a father with 4 young children, the protection of their privacy is of utmost importance. Most schools have multiple platforms that students need to download or use as part of their curriculum. The individual schools or districts have so many things on their plates and ultimately, this bill will alleviate some of the burden put on the school and district staff while managing student’s information. This bill will give control over student’s personal information to their parents and guardians where it belongs.”
2. New Technology “Clouds” Student Data Privacy. The issue of privacy has become a priority for all stakeholders in the education community, as technology continues to advance. The rise of new technologies like cloud computing and software-as-a-service (SaaS) has heightened concerns about student data privacy. As technology delivers promising devices and applications to enhance learning. For the purposes of digital storage, management, and retrieval of student records, or for digital educational software, many districts choose to have their student information system vendered to ensure the security and privacy of students.

Online providers, including website operators, online service and app providers, may collect data, often tracking a student online and using it to target advertising or profit from the data. While it may seem obvious that such commercial uses of data collected about student online usage should not be allowed, providers of free online services and apps are typically for-profit businesses that must generate revenue to pay employees and add new features to their apps or services.

1. Gaps In Data Privacy Still Exist Despite Student and Data Protection Laws. Statute currently provides protections for students and Californians to ensure individuals are in control of what information is shared and used.
   1. The Family Education Rights Protections Act. FERPA is a federal law that protects "education records," which are records directly related to a student and maintained by an educational agency or institution or a party acting for the agency or institution. FERPA gives parents the right to view their children's academic records, request changes to their child's education records, and prevent schools from sharing personal information from a student's education records with a third party unless the student's parent has given written consent. Districts must inform parents of these rights annually, and parents who believe that their FERPA rights may have been violated can file a complaint with the USDOE.

Under current law, school districts can enter into agreements with third parties to offer services and providers for digital storage, management, and retrieval of student records and digital educational software. Each contract must contain specific provisions regarding the security, use, ownership, and control of student records. These details are typically located in a vendors terms of services.

• 1. Student Online Personal Information Protection Act. In September 2014, California Governor Jerry Brown signed SB 1177 (Steinberg, Chapter 839, Statutes of 2014), which established SOPIPA. SOPIPA places the responsibility of safeguarding student data directly on the education technology service providers. It explicitly prohibits them from selling student data, using it for targeted advertising to students or their families, or creating profiles on students for non-educational purposes. Additionally, the law mandates that online service providers ensure the security of any data they collect and delete student information when requested by a school or district.
  2. California Consumer Protection Act. In 2018, the California Legislature enacted the CCPA, which granted consumers certain rights regarding their personal information. These rights include the right to know what personal information is collected and sold about them, request specific categories and pieces of personal information, and opt-out of the sale of their personal information for minors under 16 years of age. In 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. The CCPA and CPRA have become the most comprehensive laws in the country for protecting consumers' rights to privacy. The CPPA was created to implement and enforce the CCPA and CPRA, updating existing regulations and adopting new ones.

According to the Assembly Committee on Privacy and Consumer Protection, “In general, state law in the form of SOPIPA mirrors FERPA and the control of online personal information lies within the hands of schools and/or administrators and they control how that data is used. This right to control personal information about students and their families is not extended by SOPIPA to the student, parent, or guardian. As a result, the student has limited control over their educational records stored by online service providers. In addition, information that is obtained directly from a student or teacher by the vendor is not protected, even if it is the same information that would otherwise be protected if it is obtained from school records. However, despite the gaps in FERPA, and SOPIPA, California has some of the most robust privacy protection laws in the nation under the CCPA. Unfortunately, despite the cumulative protections in SOPIPA, FERPA and the CCPA, it remains unclear whether the personal data collected by educational technology vendors is covered when it comes to a consumer’s right to protect their private information.”

The rise of online education programs and mobile applications has raised concerns about potentially misusing student information, even data FERPA protects. There is uncertainty regarding whether educational technology companies operating under contracts with school districts are subject to the CCPA, as they are contracted with a government entity not bound by the CCPA. This bill aims to address this issue by specifying that if the CCPA does not cover the business and the data it collects, then privacy protections similar to those under the CCPA would apply under SOPIPA.

Related/Prior Legislation

AB 375 (Chau, Chapter 55, Statutes of 2018) established the CCPA, which provides consumers the right to access their personal information that is collected by a business, the right to delete it, the right to know what personal information is collected, the right to know whether and what personal information is being sold or disclosed, the right to stop a business from selling their information, and the right to equal service and price.

SB 1177 (Steinberg, Chapter 839, Statutes of 2014) established the SOPIPA to restrict the use and disclosure of information about K-12 students.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 6/11/24)

California County Superintendents

PERK Advocacy

Oakland Privacy

OPPOSITION: (Verified 6/11/24)

None received

ARGUMENTS IN SUPPORT: According to the California County Superintendents, “AB 801 will allow a parent or student to delete a student’s private information from school technology vendors such as internet websites, online services, and online and mobile applications. Moreover, this bill would prevent such vendors from selling the student’s information. As the author states, this bill's intent is to close gaps in data privacy protection for online programs provided via a local educational agency. While existing law allows for the deletion of a student’s data upon the school or district’s request, this bill will empower the student’s guardian to have control over the student’s personal information. In addition, this bill will result in strengthened data, privacy, and security measures. As technology plays an increasingly important role in our classrooms, these types of measures are more and more important. Not only are such policies beneficial to the students, but also to local educational agencies from an information technology security perspective. For these reasons, we are pleased to support AB 801.”

ASSEMBLY FLOOR: 67-0, 1/18/24

AYES: Aguiar-Curry, Alanis, Arambula, Bains, Bennett, Berman, Boerner, Bonta, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Davies, Dixon, Flora, Mike Fong, Vince Fong, Friedman, Gabriel, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Kalra, Lackey, Lee, Low, Lowenthal, Maienschein, Mathis, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Quirk-Silva, Ramos, Reyes, Luz Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

NO VOTE RECORDED: Addis, Alvarez, Bauer-Kahan, Bryan, Chen, Megan Dahle, Essayli, Gallagher, Jones-Sawyer, McCarty, McKinnor, Petrie-Norris, Rendon

Prepared by: Kordell Hampton / ED. / (916) 651-4105

6/17/24 15:37:26

**** END ****

 CONSENT  

Bill No: AB 801

Author: Joe Patterson (R)

Amended: 1/12/24 in Assembly

Vote: 21

SENATE EDUCATION COMMITTEE: 7-0, 6/5/24

AYES: Newman, Jones, Cortese, Glazer, Gonzalez, Smallwood-Cuevas, Wilk

SENATE JUDICIARY COMMITTEE: 11-0, 6/11/24

AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Niello, Roth, Stern, Wahab

ASSEMBLY FLOOR: 67-0, 1/18/24 - See last page for vote

SUBJECT: Student privacy: online personal information

SOURCE: Author

DIGEST:

This bill, at the request of the student’s parent or guardian, requires an operator of an internet website, online service, online application, or mobile application to delete a student’s information if the student is no longer attending a school or school district.

ANALYSIS:

Existing law:

Existing federal law protects, pursuant to the federal Family Educational Rights and Privacy Act (FERPA), the confidentiality of educational records meaning those records, files, documents, and other materials which, (1) contain information directly related to a student; and (2) are maintained by an educational agency or institution or by a person acting for such agency or institution by prohibiting the funding of schools that permit the release of those records. FERPA applies to all schools that receive funds under an applicable program of the U.S. Department of Education (USDOE). Generally, schools must have written permission from the parent or eligible student in order to release any information from a student’s education record. FERPA’s prohibition only applies to the school itself and contains various exemptions allowing the data to be released without the written consent of the parents. (20 United States Code (U.S.C.) 1232g(b)(1))

Existing state law:

1. Requires, pursuant to the federal Children’s Online Privacy Protection Act (COPPA), that an operator of an internet website or online service directed to a child, as defined, or an operator of an internet website or online service that has actual knowledge that it is collecting personal information from a child, to provide notice of what information is being collected and how that information is being used, and to give the parents of the child the opportunity to refuse to permit the operator’s further collection of information from the child. (15 U.S.C. 6502)
2. Establishes the Student Online Personal Information Protection Act (SOPIPA), which prohibits an operator of a website, online service, online application, or mobile application from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a K-12 student, selling a student’s information, or disclosing covered information, as provided. (Business and Professions Code (BPC) § 22584-85)
3. Establishes the Early Learning Personal Information Protection Act (ELPIPA), which prohibits an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool or prekindergarten purposes from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a student, selling a student’s information, or disclosing covered information, as provided. (BPC § 22586-22587)
4. Defines an “operator” to mean the operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes. (BPC § 22584(a))
5. Defines “covered information” as personally identifiable information or materials, in any media or format that meets any of the following:
   1. It is created or provided by a student, or the student’s parent or legal guardian, to an operator in the course of the student’s, parents’, or legal guardian’s use of the operator’s site, service, or application for the school’s purposes.
   2. It is created or provided by an employee or agent of the preschool, prekindergarten, school district, local education agency, or county office of education (COE) to an operator.
   3. It is gathered by an operator through the operation of a site, service, or application, and is descriptive of a student or otherwise identifies a student, including, but not limited to, information in the student’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocation information. (BPC § 22584(i) and 22586(i))
6. Requires an operator of a commercial website or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its website to conspicuously post its privacy policy. (BPC § 22575)
7. Establishes the California Privacy Protection Agency (CPPA), vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The agency is governed by a five-member board, with the chairperson and one member appointed by the Governor, and the three remaining members are appointed by the Attorney General, the Senate Rules Committee, and the Speaker of the Assembly. (Civil Code (CIV) § 1798.199.10)
8. Authorizes an LEA, pursuant to a policy adopted by its governing board, to enter into a contract with third parties to provide services, including cloud-based services, for the digital storage, management, and retrieval of pupil records, and to provide digital educational software, provided the contract includes specific provisions about the security, use, ownership, and control of the pupil records. (Education Code (EC) § 49073.1)

This bill:

1. Requires an operator, pursuant to the SOPIPA, to delete a student's CCPA-excluded covered information if a pupil's parent, guardian, or education rights holder, or (in the case of a current or former pupil 18 years of age or older) the pupil themselves requests an operator to delete the covered information under the operator's control if the pupil is no longer enrolled in the local educational agency (LEA).
2. Requires an operator, pursuant to the ELPIPA, to delete a pupil's CCPA-excluded covered information if a pupil's parent, guardian, or education rights holder, or (in the case of a former pupil 18 years of age or older) the pupil themselves requests an operator to delete the covered information under the operator's control if the pupil is no longer enrolled in the preschool, prekindergarten, or district.
3. Defines "covered information" to means personally identifiable information or materials, in any media or format that is created or provided by a pupil, or the pupil’s parent or legal guardian, to an operator in the course of the pupil’s, parent’s, or legal guardian’s use of the operator’s site, service, or application for K–12 school purposes, is created or provided by an employee or agent of the school or LEA to an operator, is gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or otherwise identifies a pupil, including, but not limited to, information in the pupil’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, pupil identifiers, search activity, photographs, voice recordings, or geolocation information, and does not include mandatory pupil records or any official records, files, and data directly related to a pupil and maintained by the school or LEA, including, but not limited to, records encompassing all the material kept in the pupil’s cumulative folder, including, but not limited to, general identifying data, records of attendance and of academic work completed, records of achievement and results of evaluative tests, health data, disciplinary status, test protocols, and individualized education programs.
4. Defines "California Consumer Privacy Act (CCPA)-excluded covered information" or "CCPA-excluded covered information" to mean covered information that is not subject to the California Consumer Privacy Act of 2018.

Comments

1. Need for the bill. According to the author, “As a father with 4 young children, the protection of their privacy is of utmost importance. Most schools have multiple platforms that students need to download or use as part of their curriculum. The individual schools or districts have so many things on their plates and ultimately, this bill will alleviate some of the burden put on the school and district staff while managing student’s information. This bill will give control over student’s personal information to their parents and guardians where it belongs.”
2. New Technology “Clouds” Student Data Privacy. The issue of privacy has become a priority for all stakeholders in the education community, as technology continues to advance. The rise of new technologies like cloud computing and software-as-a-service (SaaS) has heightened concerns about student data privacy. As technology delivers promising devices and applications to enhance learning. For the purposes of digital storage, management, and retrieval of student records, or for digital educational software, many districts choose to have their student information system vendered to ensure the security and privacy of students.

Online providers, including website operators, online service and app providers, may collect data, often tracking a student online and using it to target advertising or profit from the data. While it may seem obvious that such commercial uses of data collected about student online usage should not be allowed, providers of free online services and apps are typically for-profit businesses that must generate revenue to pay employees and add new features to their apps or services.

1. Gaps In Data Privacy Still Exist Despite Student and Data Protection Laws. Statute currently provides protections for students and Californians to ensure individuals are in control of what information is shared and used.
   1. The Family Education Rights Protections Act. FERPA is a federal law that protects "education records," which are records directly related to a student and maintained by an educational agency or institution or a party acting for the agency or institution. FERPA gives parents the right to view their children's academic records, request changes to their child's education records, and prevent schools from sharing personal information from a student's education records with a third party unless the student's parent has given written consent. Districts must inform parents of these rights annually, and parents who believe that their FERPA rights may have been violated can file a complaint with the USDOE.

Under current law, school districts can enter into agreements with third parties to offer services and providers for digital storage, management, and retrieval of student records and digital educational software. Each contract must contain specific provisions regarding the security, use, ownership, and control of student records. These details are typically located in a vendors terms of services.

• 1. Student Online Personal Information Protection Act. In September 2014, California Governor Jerry Brown signed SB 1177 (Steinberg, Chapter 839, Statutes of 2014), which established SOPIPA. SOPIPA places the responsibility of safeguarding student data directly on the education technology service providers. It explicitly prohibits them from selling student data, using it for targeted advertising to students or their families, or creating profiles on students for non-educational purposes. Additionally, the law mandates that online service providers ensure the security of any data they collect and delete student information when requested by a school or district.
  2. California Consumer Protection Act. In 2018, the California Legislature enacted the CCPA, which granted consumers certain rights regarding their personal information. These rights include the right to know what personal information is collected and sold about them, request specific categories and pieces of personal information, and opt-out of the sale of their personal information for minors under 16 years of age. In 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. The CCPA and CPRA have become the most comprehensive laws in the country for protecting consumers' rights to privacy. The CPPA was created to implement and enforce the CCPA and CPRA, updating existing regulations and adopting new ones.

According to the Assembly Committee on Privacy and Consumer Protection, “In general, state law in the form of SOPIPA mirrors FERPA and the control of online personal information lies within the hands of schools and/or administrators and they control how that data is used. This right to control personal information about students and their families is not extended by SOPIPA to the student, parent, or guardian. As a result, the student has limited control over their educational records stored by online service providers. In addition, information that is obtained directly from a student or teacher by the vendor is not protected, even if it is the same information that would otherwise be protected if it is obtained from school records. However, despite the gaps in FERPA, and SOPIPA, California has some of the most robust privacy protection laws in the nation under the CCPA. Unfortunately, despite the cumulative protections in SOPIPA, FERPA and the CCPA, it remains unclear whether the personal data collected by educational technology vendors is covered when it comes to a consumer’s right to protect their private information.”

The rise of online education programs and mobile applications has raised concerns about potentially misusing student information, even data FERPA protects. There is uncertainty regarding whether educational technology companies operating under contracts with school districts are subject to the CCPA, as they are contracted with a government entity not bound by the CCPA. This bill aims to address this issue by specifying that if the CCPA does not cover the business and the data it collects, then privacy protections similar to those under the CCPA would apply under SOPIPA.

Related/Prior Legislation

AB 375 (Chau, Chapter 55, Statutes of 2018) established the CCPA, which provides consumers the right to access their personal information that is collected by a business, the right to delete it, the right to know what personal information is collected, the right to know whether and what personal information is being sold or disclosed, the right to stop a business from selling their information, and the right to equal service and price.

SB 1177 (Steinberg, Chapter 839, Statutes of 2014) established the SOPIPA to restrict the use and disclosure of information about K-12 students.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 6/11/24)

California County Superintendents

PERK Advocacy

Oakland Privacy

OPPOSITION: (Verified 6/11/24)

None received

ARGUMENTS IN SUPPORT: According to the California County Superintendents, “AB 801 will allow a parent or student to delete a student’s private information from school technology vendors such as internet websites, online services, and online and mobile applications. Moreover, this bill would prevent such vendors from selling the student’s information. As the author states, this bill's intent is to close gaps in data privacy protection for online programs provided via a local educational agency. While existing law allows for the deletion of a student’s data upon the school or district’s request, this bill will empower the student’s guardian to have control over the student’s personal information. In addition, this bill will result in strengthened data, privacy, and security measures. As technology plays an increasingly important role in our classrooms, these types of measures are more and more important. Not only are such policies beneficial to the students, but also to local educational agencies from an information technology security perspective. For these reasons, we are pleased to support AB 801.”

ASSEMBLY FLOOR: 67-0, 1/18/24

AYES: Aguiar-Curry, Alanis, Arambula, Bains, Bennett, Berman, Boerner, Bonta, Calderon, Juan Carrillo, Wendy Carrillo, Cervantes, Connolly, Davies, Dixon, Flora, Mike Fong, Vince Fong, Friedman, Gabriel, Garcia, Gipson, Grayson, Haney, Hart, Holden, Hoover, Irwin, Jackson, Kalra, Lackey, Lee, Low, Lowenthal, Maienschein, Mathis, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Jim Patterson, Joe Patterson, Pellerin, Quirk-Silva, Ramos, Reyes, Luz Rivas, Rodriguez, Blanca Rubio, Sanchez, Santiago, Schiavo, Soria, Ta, Ting, Valencia, Villapudua, Waldron, Wallis, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

NO VOTE RECORDED: Addis, Alvarez, Bauer-Kahan, Bryan, Chen, Megan Dahle, Essayli, Gallagher, Jones-Sawyer, McCarty, McKinnor, Petrie-Norris, Rendon

Prepared by: Kordell Hampton / ED. / (916) 651-4105

6/12/24 14:36:41

**** END ****

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2023-2024 Regular Session

Bill No: AB 801 (Author:Joe Patterson)

Version: January 12, 2024

Hearing Date: June 11, 2024

Fiscal: No

Urgency: No

Consultant: CK

SUBJECT

Student privacy: online personal information

DIGEST

This bill amends student privacy laws to provide students, now “pupils,” or their parents, the ability to delete specified information that is held by an operator of an internet website, online service, online application, or mobile application, as specified, that is not subject to the California Consumer Privacy Act. The bill exempts from the protections of one of these laws certain mandatory and official pupil records.

EXECUTIVE SUMMARY

The Student Online Personal Information Protection Act (SOPIPA) was enacted to protect student personal information by closing loopholes that allowed online companies in the education technology space to profit from student personal information obtained through student, parent, teacher, and administrator use of K-12 online sites. Subsequently, the Early Learning Privacy Information Protection Act (ELPIPA) extended all of the protections offered by SOPIPA to pupils enrolled in preschools and pre-kindergarten. The California Consumer Privacy Act of 2018 (CCPA) grants consumers certain rights with regard to their personal information, including rights to limit the sale or sharing of such information and to request businesses to delete such information, as provided.

While the above laws provide a strong net of protections for students’ privacy, this bill bolsters these laws by empowering students, or their parents or education rights holders, to delete information maintained by operators, where such information is not subject to the CCPA.

This bill is author-sponsored. It is supported by Protection of the Educational Rights of Kids - Advocacy (PERK). No opposition has been received by the Committee. The bill passed out of the Senate Education Committee on a vote of 7 to 0.

PROPOSED CHANGES TO THE LAW

Existing federal law:

1. Establishes the Children’s Online Privacy Protection Act of 1998 (COPPA), which imposes certain requirements on operators of websites or online services directed to children under 13 years of age, and on operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age. (15 U.S.C.S. § 6501; 16 C.F.R. Part 312.)
2. Establishes the Family Educational Rights and Privacy Act (FERPA), which protects the privacy of student education records. The law applies to all schools that receive funds under an applicable program of the U.S. Department of Education. (20 U.S.C. § 1232g; 34 C.F.R. Part 99.)

Existing state law:

1. Establishes SOPIPA to restrict the use and disclosure of students’ “covered information,” which means personally identifiable information or materials, in any media or format that meets any of the following:
   1. Is created or provided by a student, or the student’s parent or legal guardian, to an operator in the course of the student’s, parent’s, or legal guardian’s use of the operator’s site, service, or application for K-12 school purposes.
   2. Is created or provided by an employee or agent of the K-12 school, school district, local education agency, or county office of education, to an operator.
   3. Is gathered by an operator through the operation of a site, service, or application and is descriptive of a student or otherwise identifies a student, including information in the student’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocation information. (Bus. & Prof. Code § 22584.)
2. Prohibits, pursuant to SOPIPA, operators from knowingly engaging in targeting advertising, using information about students to create a profile about them except in furtherance of K-12 school purposes, selling students’ information, or disclosing their information, except as provided. (Bus. & Prof. Code § 22584(b).)
3. Defines the following terms for purposes of SOPIPA:
   1. “Operator” means the operator of a website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes.
   2. “K-12 school purposes” means purposes that customarily take place at the direction of the K-12 school, teacher, or school district or aid in the administration of school activities, including, but not limited to, instruction in the classroom or at home, administrative activities, and collaboration between students, school personnel, or parents, or are for the use and benefit of the school. (Bus. & Prof. Code § 22584.)
4. Establishes ELPIPA, which extends the protections of SOPIPA to pupils in preschool and prekindergarten. (Bus. & Prof. Code § 22586.)
5. Prohibits an operator of an Internet Web site, online service, online application, or mobile application, as specified, from marketing specified types of products or services to a minor and from knowingly using, disclosing, compiling, or knowingly allowing a 3rd party to use, disclose, or compile, the personal information of a minor for the purpose of marketing or advertising specified types of products or services. It also authorizes minor users to remove, or to request and obtain removal of, content or information publicly posted by the minor, subject to specified conditions and exceptions. (Bus. & Prof. Code § 22580.)
6. Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
7. Provides a consumer the right to request that a business delete any personal information about the consumer which the business has collected from the consumer. (Civ. Code § 1798.105.)
8. Prohibits a business from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
9. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including biometric information, geolocation data, and “sensitive personal information.” (Civ. Code § 1798.140(v)(1).)
10. Provides various exemptions from the obligations imposed by the CCPA, including where they would restrict a business’ ability to comply with federal, state, or local laws. (Civ. Code § 1798.145.)

This bill:

1. Amends SOPIPA to refer to “pupils” rather than “students.”
2. Requires an operator, pursuant to SOPIPA and ELPIPA, to delete a pupil’s “CCPA-excluded covered information” if a pupil’s parent or guardian, the pupil’s education rights holder, or, in the case of a current or former pupil who is 18 years of age or older, the pupil requests an operator to delete the covered information under the operator’s control if the pupil is no longer enrolled in the LEA, preschool, kindergarten, or district.
3. Requires the operator to require documentation that the pupil is no longer enrolled in the LEA, preschool, kindergarten, or district before deleting the above information.
4. Defines “CCPA-excluded covered information” as covered information that is not subject to the CCPA.
5. Amends SOPIPA to provide that “covered information” does not include mandatory pupil records described in Section 430 of Title 5 of the California Code of Regulations, or any official records, files, and data directly related to a pupil and maintained by the school or local educational agency, including, but not limited to, records encompassing all the material kept in the pupil’s cumulative folder, including, but not limited to, general identifying data, records of attendance and of academic work completed, records of achievement and results of evaluative tests, health data, disciplinary status, test protocols, and individualized education programs.
6. Provides that these laws shall not be interpreted to limit or supersede any rights or requirements under the federal Individuals with Disabilities Education Act (20 U.S.C. § 1400 et seq.), the Rehabilitation Act of 1973 (29 U.S.C. § 701 et seq.), and any rules or regulations promulgated pursuant to those laws.

COMMENTS

1. Existing laws protecting students’ privacy

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. (20 U.S.C. § 1232g; 34 C.F.R. Part 99.) The law applies to all schools that receive certain federal funding. Generally, schools must have written permission from the parent or eligible student in order to release information from a student’s education record. However, FERPA allows schools to disclose those records, without consent, to certain parties or under certain conditions.

California became the national leader on student privacy when it unanimously passed SB 1177 (Steinberg, Ch. 839, Stats. 2014), establishing SOPIPA. SOPIPA was California’s response to reports regarding uses of student information and the inadequacies of state and federal law in protecting student personal information. While FERPA generally protects personally identifiable information from unauthorized disclosure, that provision applies only to schools, not to third parties who operate early education through 12th grade websites, services, or applications.

SOPIPA restricts the use and disclosure of the personally identifiable information or materials of K-12 students. (Bus. & Prof. Code § 22584.) It regulates operators of websites, online services, online applications, or mobile applications with actual knowledge that the sites, services, or applications are used primarily for K–12 school purposes and were designed and marketed for K–12 school purposes. It prohibits operators from knowingly engaging in specified activities with respect to their site, service, or application. This includes:

• engaging in targeted advertising when the targeting of the advertising is based upon any information that the operator has acquired because of the use of that operator’s site, service, or application;
• use of information, including persistent unique identifiers, created or gathered by the operator’s site, service, or application, to amass a profile about a K–12 student except in furtherance of K–12 school purposes; or
• selling a student’s information.

SOPIPA also restricts disclosing the information but provides various exceptions, including where the disclosure is in furtherance of the K–12 purpose of the site, service, or application. Operators are also required to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, and protect that information from unauthorized access, destruction, use, modification, or disclosure.

To fill the gap for pupils in early education institutions, SB 2799 (Chau, Ch. 620, Stats. 2016) established ELPIPA to extend all of the protections offered by SOPIPA to pupils enrolled in preschools and pre-kindergarten. 

Both SOPIPA and ELPIPA apply their protections to “covered information,” defined as personally identifiable information or materials, in any media or format that meets any of the following:

• Is created or provided by a pupil, or the pupil’s parent or legal guardian, to an operator in the course of the pupil’s, parent’s, or legal guardian’s use of the operator’s site, service, or application for school purposes.
• Is created or provided by an employee or agent of the school or LEA to an operator.
• Is gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or otherwise identifies a pupil, including information in the pupil’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, pupil identifiers, search activity, photographs, voice recordings, or geolocation information.

The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale or sharing of information; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) It places attendant obligations on businesses to respect those rights. In the November 3, 2020 election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).

1. Empowering pupils and their parents

Relevant here, SOPIPA and ELPIPA require an operator to delete a student’s covered information but only if the school or LEA requests the operator to delete such information under their control.

The CCPA provides its own deletion rights for personal information in the hands of specified businesses. However, given that most of this information is transferred through these schools, there is concern this data may not be subject to the CCPA, potentially limiting pupils’ rights to seek deletion.

This bill empowers pupils, and their parents, guardians, or educational rights holders, to request deletion of covered information under control of the operator where such information is not already subject to the CCPA and where the pupil is no longer enrolled in the school. An operator is required to get documentation that the pupil is no longer enrolled.

According to the author:

As a father with 4 young children, the protection of their privacy is of the utmost importance. Most schools have multiple platforms that students need to download or use as part of their curriculum. The individual schools or districts have so much on their plates and, ultimately, this bill will alleviate some of the burden put on the school and district staff while managing students’ information. This bill will give control over students’ personal information to their parents and guardians where it belongs.

Writing in support, PERK explains:

PERK supports AB 801 because we care about protecting students and their personal and covered information. The state has made it possible to provide technology to all students, and it is important that the state takes steps to ensure protections for these children, especially pertaining to student privacy. Cybersecurity cannot be overlooked, and this bill will make sure students’ covered information is protected from unauthorized use, disclosure, and will be appropriately deleted.

The bill also excludes from the definition of “covered information” in SOPIPA specified, mandatory pupil records, or any official records, files, and data directly related to a pupil and maintained by the school or LEA, including records encompassing all the material kept in the pupil’s cumulative folder, including general identifying data, records of attendance and of academic work completed, records of achievement and results of evaluative tests, health data, disciplinary status, test protocols, and individualized education programs.

The goal of this exclusion was to ensure these mandatory records are not deleted. To effectuate that goal without impacting any existing rights, the author has agreed to amendments that remove this exclusion and instead make clear in the new deletion section that such mandatory records and files not be deleted.

SUPPORT

Protection of the Educational Rights of Kids - Advocacy

OPPOSITION

None received

RELATED LEGISLATION

Pending Legislation: AB 1971 (Addis, 2024) amends SOPIPA to allow consensual disclosure of students’ “covered information” for purposes of college admissions or scholarships and expands its scope to include information related to the administration of standardized tests for postsecondary educational institutions, preparation tests for such standardized tests, and the registration for or score reporting of such tests. The bill also removes the exemption for general audience online services, applications, or websites. AB 1971 is currently in this Committee.

Prior Legislation:

AB 375 (Chau, Ch. 55, Stats. 2018) established the CCPA.

SB 2799 (Chau, Ch. 620, Stats. 2016) See Comment 1.

SB 1177 (Steinberg, Ch. 839, Stats. 2014) See Comment 1.

PRIOR VOTES:

Senate Education Committee (Ayes 7, Noes 0)

Assembly Floor (Ayes 67, Noes 0)

Assembly Education Committee (Ayes 7, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 11, Noes 0)

**************

SENATE COMMITTEE ON EDUCATION

Senator Josh Newman, Chair

2023 - 2024 Regular

Bill No: Hearing Date: June 5, 2024

Subject: .

NOTE: This bill has been referred to the Committees on Education and Judiciary. A "do pass" motion should include referral to the Committee on Judiciary.

SUMMARY

This bill, at the request of the student’s parent or guardian, requires an operator of an internet website, online service, online application, or mobile application to delete a student’s information if the student is no longer attending a school or school district.

BACKGROUND

Existing Law:

Existing Federal Law

1. Protects, pursuant to the federal Family Educational Rights and Privacy Act (FERPA), the confidentiality of educational records meaning those records, files, documents, and other materials which, (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution by prohibiting the funding of schools that permit the release of those records. FERPA applies to all schools that receive funds under an applicable program of the U.S. Department of Education (USDOE). Generally, schools must have written permission from the parent or eligible student in order to release any information from a student’s education record. FERPA’s prohibition only applies to the school itself and contains various exemptions allowing the data to be released without the written consent of the parents. (20 United States Code (U.S.C.) 1232g(b)(1))
2. Requires, pursuant to the federal Children’s Online Privacy Protection Act (COPPA), that an operator of an internet website or online service directed to a child, as defined, or an operator of an internet website or online service that has actual knowledge that it is collecting personal information from a child, to provide notice of what information is being collected and how that information is being used, and to give the parents of the child the opportunity to refuse to permit the operator’s further collection of information from the child. (15 U.S.C. 6502)

Existing State Law

Business and Professions Code (BPC)

1. Establishes the Student Online Personal Information Protection Act (SOPIPA), which prohibits an operator of a website, online service, online application, or mobile application from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a K-12 student, selling a student’s information, or disclosing covered information, as provided. (BPC § 22584-85)
2. Establishes the Early Learning Personal Information Protection Act (ELPIPA), which prohibits an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool or prekindergarten purposes from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a student, selling a student’s information, or disclosing covered information, as provided. (BPC § 22586-22587)
3. Defines an “operator” to mean the operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes. (BPC § 22584(a))
4. Defines “covered information” as personally identifiable information or materials, in any media or format that meets any of the following:
   1. It is created or provided by a student, or the student’s parent or legal guardian, to an operator in the course of the student’s, parents’, or legal guardian’s use of the operator’s site, service, or application for the school’s purposes.
   2. It is created or provided by an employee or agent of the preschool, prekindergarten, school district, local education agency, or county office of education (COE) to an operator.
   3. It is gathered by an operator through the operation of a site, service, or application, and is descriptive of a student or otherwise identifies a student, including, but not limited to, information in the student’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocation information. (BPC § 22584(i) and 22586(i))
5. Requires an operator of a commercial website or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its website to conspicuously post its privacy policy. (BPC § 22575)

Civil Code (CIV)

1. Establishes the California Privacy Protection Agency (CPPA), vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The agency is governed by a five-member board, with the chairperson and one member appointed by the Governor, and the three remaining members are appointed by the Attorney General, the Senate Rules Committee, and the Speaker of the Assembly. (CIV § 1798.199.10)

Education Code (EC)

1. Authorizes an LEA, pursuant to a policy adopted by its governing board, to enter into a contract with third parties to provide services, including cloud-based services, for the digital storage, management, and retrieval of pupil records, and to provide digital educational software, provided the contract includes specific provisions about the security, use, ownership, and control of the pupil records. (EC § 49073.1)

ANALYSIS

This bill:

1. Requires an operator, pursuant to the SOPIPA, to delete a student's CCPA-excluded covered information if a pupil's parent, guardian, or education rights holder, or (in the case of a current or former pupil 18 years of age or older) the pupil themselves requests an operator to delete the covered information under the operator's control if the pupil is no longer enrolled in the local educational agency (LEA).
2. Requires an operator, pursuant to the ELPIPA, to delete a pupil's CCPA-excluded covered information if a pupil's parent, guardian, or education rights holder, or (in the case of a former pupil 18 years of age or older) the pupil themselves requests an operator to delete the covered information under the operator's control if the pupil is no longer enrolled in the preschool, prekindergarten, or district.
3. Defines "covered information" to means personally identifiable information or materials, in any media or format that is created or provided by a pupil, or the pupil’s parent or legal guardian, to an operator in the course of the pupil’s, parent’s, or legal guardian’s use of the operator’s site, service, or application for K–12 school purposes, is created or provided by an employee or agent of the school or LEA to an operator, is gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or otherwise identifies a pupil, including, but not limited to, information in the pupil’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, pupil identifiers, search activity, photographs, voice recordings, or geolocation information, and does not include mandatory pupil records or any official records, files, and data directly related to a pupil and maintained by the school or LEA, including, but not limited to, records encompassing all the material kept in the pupil’s cumulative folder, including, but not limited to, general identifying data, records of attendance and of academic work completed, records of achievement and results of evaluative tests, health data, disciplinary status, test protocols, and individualized education programs.
4. Defines "California Consumer Privacy Act (CCPA)-excluded covered information" or "CCPA-excluded covered information" to mean covered information that is not subject to the California Consumer Privacy Act of 2018.

STAFF COMMENTS

1. Need for the bill. According to the author, “As a father with 4 young children, the protection of their privacy is of utmost importance. Most schools have multiple platforms that students need to download or use as part of their curriculum. The individual schools or districts have so many things on their plates and ultimately, this bill will alleviate some of the burden put on the school and district staff while managing student’s information. This bill will give control over student’s personal information to their parents and guardians where it belongs.”
2. New Technology “Clouds” Student Data Privacy. The issue of privacy has become a priority for all stakeholders in the education community, as technology continues to advance. The rise of new technologies like cloud computing and software-as-a-service (SaaS) has heightened concerns about student data privacy. As technology delivers promising devices and applications to enhance learning.

For the purposes of digital storage, management, and retrieval of student records, or for digital educational software, many districts choose to have their student information system vendered to ensure the security and privacy of students.

Online providers, including website operators, online service and app providers, may collect data, often tracking a student online and using it to target advertising or profit from the data. While it may seem obvious that such commercial uses of data collected about student online usage should not be allowed, providers of free online services and apps are typically for-profit businesses that must generate revenue to pay employees and add new features to their apps or services.

1. Gaps In Data Privacy Still Exist Despite Student and Data Protection Laws. Statute currently provides protections for students and Californians to ensure individuals are in control of what information is shared and used.

The Family Education Rights Protections Act

FERPA is a federal law that protects "education records," which are records directly related to a student and maintained by an educational agency or institution or a party acting for the agency or institution. FERPA gives parents the right to view their children's academic records, request changes to their child's education records, and prevent schools from sharing personal information from a student's education records with a third party unless the student's parent has given written consent. Districts must inform parents of these rights annually, and parents who believe that their FERPA rights may have been violated can file a complaint with the USDOE.

Under current law, school districts can enter into agreements with third parties to offer services and providers for digital storage, management, and retrieval of student records and digital educational software. Each contract must contain specific provisions regarding the security, use, ownership, and control of student records. These details are typically located in a vendors terms of services.

Student Online Personal Information Protection Act

In September 2014, California Governor Jerry Brown signed SB 1177 (Steinberg, Chapter 839, Statutes of 2014), which established SOPIPA. SOPIPA places the responsibility of safeguarding student data directly on the education technology service providers. It explicitly prohibits them from selling student data, using it for targeted advertising to students or their families, or creating profiles on students for non-educational purposes. Additionally, the law mandates that online service providers ensure the security of any data they collect and delete student information when requested by a school or district.

California Consumer Protection Act

In 2018, the California Legislature enacted the CCPA, which granted consumers certain rights regarding their personal information. These rights include the right to know what personal information is collected and sold about them, request specific categories and pieces of personal information, and opt-out of the sale of their personal information for minors under 16 years of age. In 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. The CCPA and CPRA have become the most comprehensive laws in the country for protecting consumers' rights to privacy. The CPPA was created to implement and enforce the CCPA and CPRA, updating existing regulations and adopting new ones.

According to the Assembly Committee on Privacy and Consumer Protection, “In general, state law in the form of SOPIPA mirrors FERPA and the control of online personal information lies within the hands of schools and/or administrators and they control how that data is used. This right to control personal information about students and their families is not extended by SOPIPA to the student, parent, or guardian. As a result, the student has limited control over their educational records stored by online service providers. In addition, information that is obtained directly from a student or teacher by the vendor is not protected, even if it is the same information that would otherwise be protected if it is obtained from school records. However, despite the gaps in FERPA, and SOPIPA, California has some of the most robust privacy protection laws in the nation under the CCPA. Unfortunately, despite the cumulative protections in SOPIPA, FERPA and the CCPA, it remains unclear whether the personal data collected by educational technology vendors is covered when it comes to a consumer’s right to protect their private information.”

The rise of online education programs and mobile applications has raised concerns about potentially misusing student information, even data FERPA protects. There is uncertainty regarding whether educational technology companies operating under contracts with school districts are subject to the CCPA, as they are contracted with a government entity not bound by the CCPA.

This bill aims to address this issue by specifying that if the CCPA does not cover the business and the data it collects, then privacy protections similar to those under the CCPA would apply under SOPIPA.

1. Related Legislation.

AB 375 (Chau, Chapter 55, Statutes of 2018) establishes the CCPA, which provides consumers the right to access their personal information that is collected by a business, the right to delete it, the right to know what personal information is collected, the right to know whether and what personal information is being sold or disclosed, the right to stop a business from selling their information, and the right to equal service and price.

SB 1177 (Steinberg, Chapter 839, Statutes of 2014) establishes the SOPIPA to restrict the use and disclosure of information about K-12 students.

AB 1584 (Buchanan, Chapter 800, Statutes of 2014) authorizes a LEA, pursuant to a policy adopted by its governing board, to enter into a contract with third parties to provide services, including cloud-based services, for the digital storage, management, and retrieval of pupil records, and to provide digital educational software, provided the contract includes specific provisions about the security, use, ownership, and control of the pupil records.

SUPPORT

California County Superintendents

PERK Advocacy

OPPOSITION

None received

-- END --

ASSEMBLY THIRD READING

ATR Bill Id:AB 801

Author:(Joe Patterson)

As Amended Ver:January 12, 2024

Majority vote

SUMMARY

Requires an operator of an internet website, online service, online application, or mobile application to delete a student's information, as defined, at the request of the student's parent or guardian, if the student is no longer attending a school or school district.

Major Provisions

1. Defines "covered information" to mean personally identifiable information or materials provided to the operator of an internet website, online service, online application, or mobile application for K-12 school purposes.
2. States that "covered information" does not include mandatory pupil records described in the California Code of Regulations, or any official records, files, and data directly related to a pupil and maintained by the school or local educational agency (LEA), including, but not limited to, records encompassing all the material kept in the pupil's cumulative folder, such as general identifying data, records of attendance and of academic work completed, records of achievement and results of evaluative tests, health data, disciplinary status, test protocols, and individualized education programs (IEPs).
3. Defines "California Consumer Privacy Act (CCPA)-excluded covered information" or "CCPA-excluded covered information" to mean covered information that is not subject to the California Consumer Privacy Act of 2018.
4. Requires an operator, pursuant to the Student Online Personal Information Protection Act (SOPIPA), to delete a student's CCPA-excluded covered information if a pupil's parent, guardian, or education rights holder, or (in the case of a current or former pupil 18 years of age or older) the pupil themselves requests an operator to delete the covered information under the operator's control if the pupil is no longer enrolled in the local educational agency.
5. Requires an operator, pursuant to the Early Learning Personal Information Protection Act (ELPIPA), to delete a pupil's CCPA-excluded covered information if a pupil's parent, guardian, or education rights holder, or (in the case of a former pupil 18 years of age or older) the pupil themselves requests an operator to delete the covered information under the operator's control if the pupil is no longer enrolled in the preschool, prekindergarten, or district.

COMMENTS

This bill is intended to ensure that students, parents and guardians have the ability to require that third-party vendors delete identifying information related to the student if they are no longer enrolled in the school.

Schools contract with many technology vendors for different purposes. While no research could be identified which provides a current assessment of local educational agencies' (LEAs') technology vendor use, it is clear that LEAs use technology for many purposes, and often contract with multiple private vendors to do so. Examples include:

1. Student information systems to manage information about enrollment, attendance, course completion and transcripts, and compliance information.
2. Systems for management of curriculum, and instruction, and assessment, such as course management, online course material and instructional programs, and formative and interim assessments.
3. Systems for state reporting of student data to numerous state data systems which collect information on attendance, academic and other student outcomes, student demographics, and teacher assignment.
4. Systems for administration of state assessments in various subjects.
5. Systems for management of personnel, including course assignments.
6. Systems for local data collection (i.e. school climate and parent surveys).
7. Teacher-initiated systems, for curriculum, instruction, assessment, and behavior.

Growth in use of electronic learning creates privacy challenges. In the spring of 2020 when the COVID-19 pandemic struck, schools around the world were forced to abruptly shut down, quickly moving over one billion students out of their classrooms. As a result, education changed dramatically, with the increased use of e-learning, whereby teaching is done remotely and on digital platforms. As children have returned to the classroom, it appears that the expansion in the use of technology in education will largely remain.

Since the enactment of the federal Family Educational Rights and Privacy Act (FERPA) in 1974, there have been significant changes in the way that students are taught, including the increased use of technology. The author points to the following observation by the U.S. Department of Education:

Schools can use digital resources in a variety of ways to support teaching and learning. Electronic grade books, digital portfolios, learning games, and real-time feedback on teacher and student performance, are a few ways that technology can be utilized to power learning. (U.S. Dept. of Ed., Office of Elementary & Secondary Ed., Use of Technology in Teaching and Learning (Sep. 3, 2013), available at https://oese.ed.gov/archived/oii/use-of-technology-in-teaching-and-learning/.)

In general, state law in the form of Student Online Personal Information Protection Act (SOPIPA) mirrors FERPA: the control of online personal information lies within the hands of schools and/or administrators and they control how that data is used. This right to control personal information about students and their families is not extended by SOPIPA to the student, parent, or guardian. As a result, the student has limited control over any educational records which may be stored by online service providers. In addition, information that is obtained directly from a student or teacher by the vendor is not protected, even if it is information that would otherwise be protected if it were obtained from school records. However, despite the gaps in FERPA and SOPIPA, California has some of the most robust privacy protection laws in the nation under the California Consumer Privacy Act (CCPA). Unfortunately, despite the cumulative protections in SOPIPA, FERPA, and the CCPA, it remains unclear whether the personal data collected by educational technology vendors is covered when it comes to a consumer's right to protect their private information.

The growing use of online educational programs and mobile applications has led to an increasing flow of personal information directly from students and teachers to operators of educational programs and applications. If these operators are not covered by the CCPA, there are no restrictions on how they may use this information, other than restrictions that the operators may impose on themselves in their privacy policies and Terms of Service (TOS). A review of several privacy policies revealed the following common features:

1. The company reserves the right to disclose or forward student information to other companies.
2. The company assumes no responsibility for the mishandling of information.
3. The company reserves the right to unilaterally change its privacy policy at any time.

A 2014 article in Politico warns that "Students shed streams of data about their academic progress, work habits, learning styles and personal interests as they navigate educational websites. All that data has potential commercial value: It could be used to target ads to the kids and their families, or to build profiles on them that might be of interest to employers, military recruiters or college admissions officers." The article pointed out that "Kathleen Styles, the [U.S.] Education Department's chief privacy officer [at the time], acknowledged in an interview that much of [student information] is likely not protected by FERPA—and thus can be commercialized by the companies that hold it." (Simon, The big biz of spying on little kids, Politico (May 15, 2014), available at https://www.politico.com/story/2014/05/data-mining-your-children-106676.)

In short, the use of online education programs and mobile applications has opened a back door through which student information—even information that is otherwise protected by FERPA—can be freely accessed and used by the company collecting it. In addition, it is unclear whether an educational technology business operating under a contract with a school district is bound by the CCPA because even though it may meet the definition of a "business" under the CCPA, it is under contract to a government entity that is not bound by the CCPA. This bill addresses this problem by clarifying that in the event the business and the data it is collecting is not covered by the CCPA, then privacy protections similar to those under the CCPA would apply under SOPIPA.

According to the Author

As a father with 4 young children, the protection of their privacy is of utmost importance. Most schools have multiple platforms that students need to download or use as part of their curriculum. The individual schools or districts have so many things on their plates and ultimately, this bill will alleviate some of the burden put on the school and district staff while managing student's information. This bill will give control over student's personal information to their parents and guardians where it belongs.

Arguments in Support

Protection of the Educational Rights of Kids writes: "We support AB 801 because Protection of the Educational Rights of Kids, PERK, cares about protecting students and their personal and covered information. The state has made it possible to provide technology to all students, and it is important that the state take steps to ensure protections for these children, especially pertaining to student privacy. Cybersecurity cannot be overlooked, and this bill will make sure students' covered information is protected from unauthorized use, disclosure, and will be appropriately deleted."

Arguments in Opposition

None on file.

FISCAL COMMENTS

As currently in print this bill is keyed non-fiscal by the Legislative Counsel.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 11-0-0

YES: Gabriel, Joe Patterson, Bauer-Kahan, Bennett, Essayli, Vince Fong, Irwin, Lowenthal, Papan, Wicks, Wilson

ASM EDUCATION: 7-0-0

YES: Muratsuchi, Ortega, Alvarez, Bonta, Flora, Hoover, McCarty

UPDATED

VERSION: Januray 12, 2024

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0002578

Date of Hearing: January 10, 2024

ASSEMBLY COMMITTEE ON EDUCATION

Al Muratsuchi, Chair

ABPCA Bill Id:AB 801 (

Author:Joe Patterson) – As Amended Ver:March 23, 2023

[Note: This bill is double referred to the Assembly Privacy and Consumer Protection Committee and was heard by that Committee as it relates to issues under its jurisdiction.]

SUBJECT: Student privacy: online personal information

SUMMARY: Requires an operator of an internet website, online service, online application, or mobile application to delete a student’s information, as defined, at the request of the student’s parent or guardian, if the student is no longer attending a school or school district. Specifically, this bill:

1. Requires an operator, pursuant to the Student Online Personal Information Protection Act (SOPIPA), to delete a student’s California Consumer Privacy Act (CCPA)-excluded covered information if a student over 16 years of age, or the student’s parent or guardian in the case of a student who is under 16 years of age, requests an operator to delete the covered information under the operator’s control if the student is no longer attending the school or district. Requires, before deleting any information the operator to require documentation that the student no longer attends the school or district.
2. States that “covered information” does not include official records, files, and data directly related to a student and maintained by the school or local educational agency (LEA), including, but not limited to, records encompassing all the material kept in the student’s cumulative folder, including, but not limited to, general identifying data, records of attendance and of academic work completed, records of achievement and results of evaluative tests, health data, disciplinary status, test protocols, and individualized education programs (IEPs).
3. Defines “California Consumer Privacy Act-excluded covered information” or “CCPA-excluded covered information” to mean covered information that is not subject to the California Consumer Privacy Act of 2018.
4. Requires an operator, pursuant to the Early Learning Personal Information Protection Act (ELPIPA), to delete a student’s CCPA-excluded covered information if a student over 16 years of age, or the student’s parent or guardian in the case of a student who is under 16 years of age, requests an operator to delete the covered information under the operator’s control if the student is no longer attending the preschool, prekindergarten, or district. Requires, before deleting any information, the operator to require documentation that the student no longer attends the preschool, prekindergarten, or district.

EXISTING LAW:

1. Establishes the CCPA and provides various rights to consumers pursuant to the Act. Subject to various general exemptions, a consumer has, among other things: the right to know what personal information a business collects about consumers, including the categories of third parties with whom the business shares personal information; the right to know what personal information a business sells about consumers; and the right to delete information that a business has collected from the consumer. (Civil Code (CC) 1798.100 et seq.)
2. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes such information as: name, alias, postal address, unique personal identifier, email address, social security number, or other identifier, and internet activity information, including browsing history and search history. (20 U.S.C. 1232g; 34 C.F.R. Part 99) (CC 1798.140(v))
3. Establishes the California Privacy Protection Agency (CPPA), vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The agency is governed by a five-member board, with the chairperson and one member appointed by the Governor, and the three remaining members are appointed by the Attorney General, the Senate Rules Committee, and the Speaker of the Assembly. (CC 1798.199.10)
4. Prohibits a business from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of those who are between 13 and 16 years of age, or the consumers parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the information. (CC 1798.120)
5. Establishes the SOPIPA, which prohibits an operator of a website, online service, online application, or mobile application from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a K-12 student, selling a student’s information, or disclosing covered information, as provided. (Business and Professional Code (BPC) 22584-85)
6. Establishes the ELPIPA, which prohibits an operator of an Internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool or prekindergarten purposes from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a student, selling a student’s information, or disclosing covered information, as provided. (BPC 22586-22587)
7. Defines an “operator” to mean the operator of an internet web site, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes. (BPC 22584(a))
8. Defines “covered information” as personally identifiable information or materials, in any media or format that meets any of the following:
   1. It is created or provided by a student, or the student’s parent or legal guardian, to an operator in the course of the student’s, parents’, or legal guardian’s use of the operator’s site, service, or application for the school’s purposes.
   2. It is created or provided by an employee or agent of the preschool, prekindergarten, school district, LEA, or county office of education (COE), to an operator.
   3. It is gathered by an operator through the operation of a site, service, or application, as defined in number 7, and is descriptive of a student or otherwise identifies a student, including, but not limited to, information in the student’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocation information. (BPC 22584(i) and 22586(i))
9. Requires an operator of a commercial website or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its website to conspicuously post its privacy policy. (BPC 22575)
10. Protects, pursuant to the federal Family Educational Rights and Privacy Act (FERPA), the confidentiality of educational records meaning those records, files, documents, and other materials which, (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution by prohibiting the funding of schools that permit the release of those records. FERPA applies to all schools that receive funds under an applicable program of the U.S. Department of Education. Generally, schools must have written permission from the parent or eligible student in order to release any information from a student’s education record. FERPA’s prohibition only applies to the school itself and contains various exemptions allowing the data to be released without the written consent of the parents. (20 U.S.C. 1232g(b)(1))
11. Requires, pursuant to the federal Children’s Online Privacy Protection Act (COPPA), that an operator of an internet website or online service directed to a child, as defined, or an operator of an internet website or online service that has actual knowledge that it is collecting personal information from a child, to provide notice of what information is being collected and how that information is being used, and to give the parents of the child the opportunity to refuse to permit the operator’s further collection of information from the child. (15 U.S.C. 6502)
12. Defines “pupil record” to mean information relative to an individual pupil gathered within or without the school system and maintained within the school system, regardless of the physical form in which it is maintained. States that essential in this definition is the idea that any information which is maintained for the purpose of second party review is considered a pupil record. (5 California Code of Regulations (CCR) 430 and 432)
13. Defines “mandatory permanent pupil records” to mean those records which are maintained in perpetuity and which schools have been directed to compile by California statute, regulation, or authorized administrative directive. (5 CCR 430)
14. Authorizes an LEA, pursuant to a policy adopted by its governing board, to enter into a contract with third parties to provide services, including cloud-based services, for the digital storage, management, and retrieval of pupil records, and to provide digital educational software, provided the contract includes specific provisions about the security, use, ownership, and control of the pupil records. (Education Code (EC) 49073.1)
15. Requires, pursuant to the Individuals with Disabilities Education Act (IDEA), public agencies to inform parents when personally identifiable information collected, maintained, or used under this part is no longer needed to provide educational services to the child. Requires this information to be destroyed at the request of the parents. However, permits a permanent record of a student's name, address, and phone number, his or her grades, attendance record, classes attended, grade level completed, and year completed to be maintained without time limitation. (34 CFR 300.624)

FISCAL EFFECT: Unknown

COMMENTS:

Need for the bill. According to the author, “As a father with 4 young children, the protection of their privacy is of utmost importance. Most schools have multiple platforms that students need to download or use as part of their curriculum. The individual schools or districts have so many things on their plates and ultimately, this bill will alleviate some of the burden put on the school and district staff while managing student’s information. This bill will give control over student’s personal information to their parents and guardians where it belongs.

This bill is attempting to close any gaps in data privacy protection that may exist when it comes to information that is collected and stored by an operator of an online platform that is under contract with a school district. As stated by the Assembly Committee on Privacy and Consumer Protection, “The ambiguity arises when trying to determine whether a business that operates an online platform, under contract to a government entity, in this case a public school or school district, is exempt from the CCPA when it comes to personal information that is collected about students. If the business is exempt, under the SOPIPA and ELPIPA, the control of online personal information lies with schools and/or administrators and is not extended to the student, parent, or guardian. In the event that a student is no longer enrolled in a school or school district, this bill will allow those former students over the age of 16, or their parent or guardian if under the age of sixteen, to request that personal information be deleted from the platform.”

Status of personal data maintained by education technology vendors. According to the Assembly Committee on Privacy and Consumer Protection, “In general, state law in the form of SOPIPA mirrors FERPA and the control of online personal information lies within the hands of schools and/or administrators and they control how that data is used. This right to control personal information about students and their families is not extended by SOPIPA to the student, parent, or guardian. As a result, the student has limited control over their educational records stored by online service providers. In addition, information that is obtained directly from a student or teacher by the vendor is not protected, even if it is the same information that would otherwise be protected if it is obtained from school records. However, despite the gaps in FERPA and SOPIPA, California has some of the most robust privacy protection laws in the nation under the CCPA. Unfortunately, despite the cumulative protections in SOPIPA, FERPA and the CCPA, it remains unclear whether the personal data collected by educational technology vendors is covered when it comes to a consumer’s right to protect their private information.”

Schools contract with many technology vendors for different purposes. While no research could be identified which provides a current assessment of LEAs’ technology vendor use, it is clear that LEAs use technology for many purposes, and often contract with multiple private vendors to do so. A few examples include:

• Student information systems to manage information about enrollment, attendance, course completion and transcripts, and compliance information, among many other functions;
• Systems for management of curriculum, and instruction, and assessment, such as course management, online course material and instructional programs, and formative and interim assessments;
• Systems for state reporting of student data to numerous state data systems which collect information on attendance, academic and other student outcomes, student demographics, and teacher assignment;
• Systems for administration of state assessments in various subjects;
• Systems for management of personnel, including course assignments;
• Systems for local data collection (i.e. school climate and parent surveys); and
• Teacher-initiated systems, for curriculum, instruction, assessment, and behavior.

Given the many systems each LEA uses, the Committee may wish to consider that, should this bill be enacted, each LEA would need to assess which information, maintained by each vendor, would be subject to a parent request for deletion of student data.

Privacy of student records under FERPA and state education law. FERPA is a federal law which protects “education records,” which are generally defined as records that are directly related to a student and maintained by an educational agency or institution or by a party acting for the agency or institution.

FERPA grants parents the right to view their children’s educational records, seek amendment or correction of their child’s education records, and prohibits schools from disclosing personal information from a student’s education records to a third party unless the student’s parent has provided prior written consent. LEAs must annually notify parents of these rights, and parents who believe that their FERPA rights may have been violated may file a complaint with USDOE.

Additionally, state education law authorizes an LEA, pursuant to a policy adopted by its governing board, to enter into a contract with third parties to provide services, including cloud-based services, for the digital storage, management, and retrieval of pupil records, and to provide digital educational software, provided the contract includes specific provisions about the security, use, ownership, and control of the pupil records.

State regulations establish maintenance and disposal requirements for three types of student records, including some which must be maintained indefinitely. Current law requires student records for public schools be kept on file for each student enrolled in school, and requires school districts to maintain all mandatory permanent records, or an exact copy of the records, for every student enrolled in the district.

State regulations define “pupil record” to mean information relative to an individual pupil gathered within or without the school system and maintained within the school system, regardless of the physical form in which it is maintained. The regulations state that “essential in this definition is the idea that any information which is maintained for the purpose of second party review is considered a pupil record.”

These regulations establish three types of student records:

• "Mandatory Permanent Pupil Records" are those records which are maintained in perpetuity and which schools have been directed to compile by California statute, regulation, or authorized administrative directive.
• "Mandatory Interim Pupil Records" are those records which schools are directed to compile and maintain for stipulated periods of time and are then destroyed as per California statute, regulation, or authorized administrative directive.
• "Permitted Pupil Records" are those records having clear importance only to the current educational process of the student.

Additionally, the IDEA specifies requirements for the maintenance and disposal of records for students with IEPs. This law requires public agencies to inform parents when personally identifiable information collected, maintained, or used under this part is no longer needed to provide educational services to the child. Requires this information to be destroyed at the request of the parents. However, permits a permanent record of a student's name, address, and phone number, his or her grades, attendance record, classes attended, grade level completed, and year completed to be maintained without time limitation.

This bill conflicts with the requirements schools maintain records, which schools must and should maintain, such as transcripts and records of graduation, if they are maintained by operators. Accordingly, staff recommends that the bill be amended to exempt any mandatory records, as defined in these regulations, from the requirements of the bill.

Authority to make a request should rest with holder of educational rights. This bill authorizes a student 16 years of age or older to request that an operator delete specified information about that student. Under current law, only parents, guardians, and other individuals holding educational rights for the student may act on behalf of the student, until a student turns 18 years of age. Accordingly, staff recommends that the bill be amended to make the age at which a current or former student (in both K-12 and prekindergarten sections) may make such a request 18, instead of 16, and include education rights holders.

Records for students transferring between schools in a district should be maintained. This bill authorizes specified individuals to request that an operator delete specified information about a student when the student is no longer attending a school or district. This could result in the deletion of a student’s records when they are leaving one elementary school to attend another school in the same district. Staff recommends that the bill be amended to authorize a request only when a student ceases to be enrolled in an LEA, defined as a school district, county office of education (COE), a charter school, or the State Special Schools for the Deaf and the Blind;

Additional recommended Committee amendments. In addition to the amendments noted above, staff recommends that the bill be amended as follows:

1. Define LEA, for purposes of the requirements of this bill, to mean a school district, COE, a charter school, or the State Special Schools for the Deaf and the Blind;
2. Clarify that retention and disposal of records related to IEPs and Section 504 plans is governed by applicable federal law; and
3. Change references to students to pupils, and remove reference to 16 year old students enrolled in preschool.
4. Technical, re-ordering, and conforming changes.

Arguments in support. Protection of the Educational Rights of Kids writes, “We support AB 801 because Protection of the Educational Rights of Kids, PERK, cares about protecting students and their personal and covered information. The state has made it possible to provide technology to all students, and it is important that the state take steps to ensure protections for these children, especially pertaining to student privacy. Cybersecurity cannot be overlooked, and this bill will make sure students’ covered information is protected from unauthorized use, disclosure, and will be appropriately deleted.”

Related Legislation. AB 375 (Chau) Chapter 55, Statutes of 2018, establishes the CCPA, which provides consumers the right to access their personal information that is collected by a business, the right to delete it, the right to know what personal information is collected, the right to know whether and what personal information is being sold or disclosed, the right to stop a business from selling their information, and the right to equal service and price.

SB 2799 (Chau) Chapter 620, Statutes of 2016, establishes the Early Learning Personal Information Protection Act which prohibits operators of websites, online services, and mobile apps that are designed, marketed and used primarily for prekindergarten and preschool students, from using data about those students for targeting, marketing or profiling, and prohibits selling or disclosing a student’s information with limited exceptions.

SB 1177 (Steinberg) Chapter 839, Statutes of 2014, establishes the SOPIPA to restrict the use and disclosure of information about K-12 students.

AB 1584 (Buchanan) Chapter 800, Statutes of 2014 authorizes a local education agency (LEA), pursuant to a policy adopted by its governing board, to enter into a contract with third parties to provide services, including cloud-based services, for the digital storage, management, and retrieval of pupil records, and to provide digital educational software, provided the contract includes specific provisions about the security, use, ownership, and control of the pupil records.

REGISTERED SUPPORT / OPPOSITION:

Support

Protection of the Educational Rights of Kids

Opposition

None on file

Analysis Prepared by: Tanya Lieberman / ED. / (916) 319-2087

Date of Hearing: March 21, 2023

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Jesse Gabriel, Chair

ABPCA Bill Id:AB 801 (

Author:Joe Patterson) – As Introduced Ver:February 13, 2023

As Proposed to be Amended

SUBJECT: Student privacy: online personal information

SYNOPSIS

This author-sponsored bill is intended to close any gaps in data privacy protection that may exist when it comes to information that is collected and stored by an operator of an online platform that is under contract with a school.

The ambiguity arises when trying to determine whether a business that operates an online platform, under contract to a government entity, in this case a public school or school district, is exempt from the California Consumer Protection Act when it comes to personal information that is collected about students. If the business is exempt, under the Student Online Privacy Protection Act and Early Learning Personal Information Protection Act, the control of online personal information lies with schools and/or administrators and is not extended to the student, parent, or guardian. In the event that a student is no longer enrolled in a school or school district, this bill will allow those former students over the age of 16, or their parent or guardian if under the age of sixteen, to request that personal information be deleted from the platform.

There is no registered support or opposition to the bill.

If passed by this Committee, this bill will next be heard by the Assembly Education Committee.

SUMMARY: Requires an operator of an internet website, online service, online application, or mobile application used primarily for school purposes to delete any personally identifiable information or materials related to a student, that is not otherwise covered under the California Consumer Privacy Act (CCPA), at the request of a student, parent, or guardian if the child is no longer attending the school or district.

Specifically, this bill:

1. Requires an operator of an online platform, at the request of the student, parent or legal guardian, to delete a K-12 student’s covered information under the operator’s control if the student is no longer attending the school or district.
2. Requires an operator of an online platform, at the request of a former pupil, parent or legal guardian, to delete a preschool or prekindergarten pupils’ covered information under the operator’s control if the student is no longer attending the school or district.
3. Requires the operator to obtain documentation that the student or pupil no longer attends the school or district.
4. Defines “California Consumer Privacy Act excluded covered information” means “covered information” that is not subject to the California Consumer Privacy Act, Title 1.18.5, Civ. Code §§ 1798.100 et seq.

EXISTING LAW:

1. Establishes the California Consumer Privacy Act of 2018 (CCPA) and provides various rights to consumers pursuant to the Act. Subject to various general exemptions, a consumer has, among other things:
   1. The right to know what personal information a business collects about consumers, as specified, including the categories of third parties with whom the business shares persona information.
   2. The right to know what personal information a business sells about consumers, as specified, including the categories of personal information that the business sold about the consumer and the categories of third parties to whom the personal information was sold, by category or categories of personal information for each third party to whom the personal information was sold.
   3. The right to access the specific pieces of information a business has collected about the consumer.
   4. The right to delete information that a business has collected from the consumer.
   5. The right to opt-out of the sale of the consumer’s personal information if over 16 years of age, and the right to opt-in if the consumer is a minor (as exercised by the parent if the minor is under 13, or as exercised by the minor if the minor is between ages 13 and 16).
   6. The right to equal service and price, despite exercising any of these rights. (Civ. Code § 1798.100 et seq.)
2. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes such information as:
   1. A name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other identifier.
   2. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
   3. Biometric information.
   4. Internet activity information, including browsing history and search history.
   5. Geolocation data.
   6. Professional or employment-related information.
   7. Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. Part 99). (Civ. Code § 1798.140(v).)
3. Establishes the California Privacy Protection Agency (CPPA), vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The agency is governed by a five-member board, with the chairperson and one member appointed by the Governor, and the three remaining members are appointed by the Attorney General, the Senate Rules Committee, and the Speaker of the Assembly. (Civ. Code § 1798.199.10.)
4. Prohibits a business from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of those who are between 13 and 16 years of age, or the consumers parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the information. (Civ. Code § 1798.120.)
5. Establishes the Student Online Personal Information Protection Act (SOPIPA), which prohibits an operator of a website, online service, online application, or mobile application from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a K-12 student, selling a student’s information, or disclosing covered information, as provided. (Bus. & Prof. Code §§ 22584-85.)
6. Establishes the Early Learning Personal Information Protection Act (ELPIPA), which prohibits an operator of an Internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool or prekindergarten purposes from knowingly engaging in targeted advertising to students or their parents or legal guardians using covered information, as defined, amassing a profile of a student, selling a student’s information, or disclosing covered information, as provided. (Bus. & Prof. Code §§ 22586-22587.)
7. Defines an “operator” to mean the operator of an internet web site, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes.(Bus & Prof. Code § 22584(a).
8. Defines “covered information” as personally identifiable information or materials, in any media or format that meets any of the following:
   1. It is created or provided by a pupil, or the pupil’s parent or legal guardian, to an operator in the course of the pupil’s, parents’, or legal guardian’s use of the operator’s site, service, or application for the school’s purposes.
   2. It is created or provided by an employee or agent of the preschool, prekindergarten, school district, local educational agency, or county office of education, to an operator.
   3. It is gathered by an operator through the operation of a site, service, or application, as defined in number 7, and is descriptive of a pupil or otherwise identifies a pupil, including, but not limited to, information in the pupil’s educational record or email, first and last name, home address, telephone number, email address, or other information that allows physical or online contact, discipline records, test results, special education data, juvenile dependency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, student identifiers, search activity, photos, voice recordings, or geolocation information. (Bus. & Prof. Code §§ 22584(i) and 22586(i).)
9. Requires an operator of a commercial website or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its website to conspicuously post its privacy policy. (Bus. & Prof. Code § 22575.)
10. Protects, pursuant to the federal Family Educational Rights and Privacy Act (FERPA), the confidentiality of educational records meaning those records, files, documents, and other materials which, (i) contain information directly related to a student; and (ii) are maintained by an educational agency or institution or by a person acting for such agency or institution by prohibiting the funding of schools that permit the release of those records. FERPA applies to all schools that receive funds under an applicable program of the U.S. Department of Education. Generally, schools must have written permission from the parent or eligible student in order to release any information from a student’s education record. FERPA’s prohibition only applies to the school itself and contains various exemptions allowing the data to be released without the written consent of the parents. (20 U.S.C. § 1232g(b)(1).)
11. Requires, pursuant to the federal Children’s Online Privacy Protection Act (COPPA), that an operator of an internet website or online service directed to a child, as defined, or an operator of an internet website or online service that has actual knowledge that it is collecting personal information from a child to provide notice of what information is being collected and how that information is being used, and to give the parents of the child the opportunity to refuse to permit the operator’s further collection of information from the child. (15 U.S.C. § 6502.)

FISCAL EFFECT: As currently in print this bill is keyed non-fiscal.

COMMENTS: This bill is intended to ensure that students, parents and guardians have the ability to require that third-party vendors delete identifying information related to the student if they are no longer enrolled in the school.

1) Author’s statement. The author notes:

As a father with 4 young children, the protection of their privacy is of utmost importance. Most schools have multiple platforms that students need to download or use as part of their curriculum. The individual schools or districts have so many things on their plates and ultimately, this bill will alleviate some of the burden put on the school and district staff while managing student’s information. This bill will give control over student’s personal information to their parents and guardians where it belongs.

2) Growth in use of electronic learning creates privacy challenges. In the spring of 2020 when the COVID-19 pandemic struck, schools around the word were forced to abruptly shut down, quickly moving over one billion students out of their classrooms. As result, education has changed dramatically with the increased use of e-learning, whereby teaching is done remotely and on digital platforms. As children have returned to the classroom, it is assumed that the expansion in the use of technology in education will largely remain.

Prior to the pandemic and since the enactment of FERPA in 1974, educational institutions were already undergoing dramatic changes in the way that students are taught, including the increased use of technology. With respect to the use of technology and learning, according to information provided by the author, the Department of Education observes that:

Schools can use digital resources in a variety of ways to support teaching and learning. Electronic grade books, digital portfolios, learning games, and real-time feedback on teacher and student performance, are a few ways that technology can be utilized to power learning.

3) The California Consumer Protection Act (CCPA). In 2018, the Legislature enacted the California Consumer Protection Act (CCPA) (AB 375 (Chau, Chap. 55, Stats. 2018)), which gives consumers certain rights regarding their personal information, such as: (1) the right to know what personal information that is collected and sold about them; (2) the right to request the categories and specific pieces of personal information the business collects about them; and (3) the right to opt-out of the sale of their personal information, or opt-in, in the case of minors under 16 years of age. The CCPA was the byproduct of compromises made between business interests on one side, and consumer and privacy interests on the other, to provide a legislative alternative to a ballot initiative on the same subject.

Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. With the passage of the CCPA and the CPRA, California now has the most comprehensive laws in the country when it comes to protecting consumers’ rights to privacy.

In addition, Proposition 24 created the California Privacy Protection Agency (CPPA) in California, vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA and the CPRA. The Agency’s responsibilities include updating existing regulations, and adopting new regulations.

The California Attorney General’s Office published an initial set of regulations implementing the CCPA. The CPRA directed the new Agency to engage in further rulemaking on a variety of topics. Since this bill amends SOPIPA and states that the requirements only apply to businesses and data that is not currently covered by the CCPA, it ensures that the requirements of this bill will not contradict the CCPA or any regulations adopted during the CPPA’s rulemaking process.

To protect Californians from any future legislative efforts to weaken statutory protections in the CPRA, Proposition 24 provided that the CPRA’s contents may be amended by a majority vote of the Legislature only if the amendments are consistent with and further the purpose and intent of the CPRA, which is to further protect consumers’ rights, including the constitutional right of privacy. (Ballot Pamphlet., Primary Elec. (Nov. 3, 2020) text of Prop. 24, p. 74.) While this bill does not amend the contents of the CPRA, it is consistent with the intent by insuring that the constitutional right to privacy for students and their parents is protected, in the event it is ultimately determined that these educational technology companies are not subject to the restrictions outlined in the CPPA.

4) The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is the primary law that protects the privacy of pupil records. It applies to all educational institutions that receive federal funds. FERPA gives parents certain rights with respect to their children's education records. These rights transfer to the student when he or she reaches the age of 18 or attends a school beyond the high school level. Students to whom the rights have transferred are deemed “eligible students.”

• Parents or eligible students have the right to inspect and review the student's education records maintained by the school. Schools are not required to provide copies of records unless, for reasons such as great distance, it is impossible for parents or eligible students to review the records. Schools may charge a fee for copies.
• Parents or eligible students have the right to request that a school correct records which they believe to be inaccurate or misleading. If the school decides not to amend the record, the parent or eligible student then has the right to a formal hearing. After the hearing, if the school still decides not to amend the record, the parent or eligible student has the right to place a statement with the record setting forth his or her view about the contested information.
• Generally, schools must have written permission from the parent or eligible student in order to release any information from a student's education record.

5) Need for the bill. In general, state law in the form of SOPIPA mirrors FERPA and the control of online personal information lies within the hands of schools and/or administrators and they control how that data is used. This right to control personal information about students and their families is not extended by SOPIPA to the student, parent, or guardian. As a result, the student has limited control over their educational records stored by online service providers. In addition, information that is obtained directly from a student or teacher by the vendor is not protected, even if it is the same information that would otherwise be protected if it is obtained from school records. However, despite the gaps in FERPA and SOPIPA, California has some of the most robust privacy protection laws in the nation under the CCPA. Unfortunately, despite the cumulative protections in SOPIPA, FERPA and the CCPA, it remains unclear whether the personal data collected by educational technology vendors is covered when it comes to a consumer’s right to protect their private information.

The growing use of online educational programs and mobile applications has led to an increasing flow of personal information directly from students and teachers to developers of educational programs and applications, and there are no restrictions on how this information may be used, other than restrictions that developers may impose on themselves in their privacy policies and Terms of Service (TOS). A review of several privacy policies revealed the following common features:

• The company reserves the right to disclose or forward student information to other companies.
• The company assumes no responsibility for the mishandling of information.
• The company reserves the right to unilaterally change its privacy policy at any time.

An article in Politico from 2014 warned that “Students shed streams of data about their academic progress, work habits, learning styles and personal interests as they navigate educational websites. All that data has potential commercial value: It could be used to target ads to the kids and their families, or to build profiles on them that might be of interest to employers, military recruiters or college admissions officers.” The article pointed out that “Kathleen Styles, the [U.S.] Education Department's chief privacy officer [at the time], acknowledged in an interview that much of [student information] is likely not protected by FERPA—and thus can be commercialized by the companies that hold it.” (Simon. Data Mining Your Children (May 15, 2014) Politico, available at https://subscriber.politicopro.com/article/2014/05/data-mining-your-children-033883)

In short, the use of online education programs and mobile applications has opened a back door through which student information—even information that is otherwise protected by FERPA—can be freely accessed and used by the company collecting it. In addition, it is unclear whether an educational technology business operating under a contract with a school district is bound by the CCPA because even though it may meet the definition of a “business” under the CCPA, it is under contract to a government entity that is not bound by the CCPA. This bill addresses this problem by clarifying that in the event the business and the data it is collecting is not covered by the CCPA, then privacy protections similar to those under the CCPA would apply under SOPIPA.

6) Author’s Amendments. Author’s amendments to the bill, reflected in the analysis above, are set forth below:

SECTION 1. Section 22584

(d)(3) Delete a student’s California Consumer Privacy Act excluded covered information if the student, or the student’s parent or legal guardian a student over 16 years of age or the student’s parent or guardian, in the case of students who are less than 16 years of age, requests an operator to delete the covered information under the operator’s control if the student is no longer attending the school or district.

The intent of this amendment is to mirror the CCPA in establishing the age at which a person can make independent decisions regarding their private information.

(d)(4) The operator may shall require documentation that the student no longer attends the school or district.

This amendment is intended to insure that, prior to deleting data, an operator receives confirmation that the student is no longer enrolled.

(g)(4) Does not include those official records, files, and data directly related to a student and maintained by the school or local education agency, including, but not limited to, records encompassing all the material kept in the student’s cumulative folder such as general identifying data, records of attendance and of academic work completed, records of achievement and results of evaluative tests, health data, disciplinary status, test protocols, and individualized education programs.

This amendment is intended to clarify that information that is part of a student’s permanent education record is not inadvertently deleted.

(j) “California Consumer Privacy Act excluded covered information” means “covered information” that is not subject to the California Consumer Privacy Act Title 1.18.5. §§ 1798.100. et seq of the California Civil Code.

This amendment clarifies that in the event the business is not covered by the CCPA and/or the personal information is not covered because it belongs to the government entity, rather than the business, then a student, parent or guardian has the right to request that it be deleted under SOPIPA.

SECTION 2. Section 22586.

The same amendments outline above are repeated in this section of the bill so that they also apply under the ELPIPA.

7) Related Legislation. AB 375 (Chau, Chap. 55, Stats. 2018) established the California Consumer Privacy Act of 2018 which provides consumers the right to access their personal information that is collected by a business, the right to delete it, the right to know what personal information is collected, the right to know whether and what personal information is being sold or disclosed, the right to stop a business from selling their information, and the right to equal service and price.

SB 2799 (Chau, Chap. 620, Stats. 2016) establishes the Early Learning Personal Information Protection Act which prohibits operators of Internet Web sites, online services, and mobile apps that are designed, marketed and used primarily for prekindergarten and preschool pupils, from using data about those pupils for targeting, marketing or profiling, and prohibits selling or disclosing a pupil's information with limited exceptions.

SB 1177 (Steinberg, Chap. 839, Stats. 2014) established the Student Online Personal Information Protection Act to restrict the use and disclosure of information about K-12 students.

REGISTERED SUPPORT / OPPOSITION:

Support

None on file.

Opposition

None on file.

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200