AB 1159: Student personal information.

Existing law, the K12 Pupil Online Personal Information Protection Act (KOPIPA), generally protects the personal information of a student enrolled in a K12 course of instruction, defined as a pupil, by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K12 school purposes and was designed and marketed for K12 school purposes.

Existing law, the Early Learning Personal Information Protection Act (ELPIPA), generally protects the personal information of a child enrolled in a preschool or prekindergarten course of instruction, defined as a pupil, by prescribing requirements and prohibitions applicable to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for preschool or prekindergarten purposes and was designed and marketed for preschool and prekindergarten purposes.

This bill would instead apply the provisions of KOPIPA and ELPIPA to an operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used for the applicable school purposes and was designed or marketed for those purposes, as specified. The bill would, among other changes to KOPIPA and ELPIPA related to protecting the personal information of students, prohibit an operator from using covered information, as defined, including persistent unique identifiers, created or gathered by the operators site, service, or application to train a generative artificial intelligence system or service or develop an artificial intelligence system unless it is in the furtherance of the relevant type of school purpose and for the use and benefit of the school. system.

This bill would also enact the Higher Education Student Information Protection Act (HESIPA), which would generally protect the personal information of a student enrolled in a higher education institution, as defined, in a similar manner as KOPIPA and ELPIPA. The bill would make HESIPA operative on July 1, 2026. 2027.

This bill would authorize a pupil or student actually harmed by the noncompliance with KOPIPA, ELPIPA, or HESIPA to bring a civil action against the noncompliant operator, as prescribed.