Existing law, the California Consumer Privacy Act of 2018 (CCPA), imposes various obligations on businesses with respect to personal information, as defined. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

The CCPA requires a business to inform consumers of the categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. Existing law, the Student Online Personal Information Protection Act, prohibits an operator, as defined, from, among other things, disclosing a K12 students personal information, except as specified. Existing law, the Student Test Taker Privacy Protection Act, prohibits a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services and in other specified circumstances.

This bill, beginning July 1, 2027, would require a business providing those proctoring services to a school district, county office of education, or charter school for classroom- or course-based exams to use end-to-end encryption, as defined, for those purposes. The bill would define end-to-end encryption for these purposes to mean a security method where data is encrypted on the senders device and remains encrypted until it reaches the intended recipients device and is unreadable by any other party, including the business providing proctoring services.

The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), imposes various obligations on businesses with respect to personal information, as defined. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

The CCPA requires a business to inform consumers of the categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. Existing law, the Student Online Personal Information Protection Act, prohibits an operator, as defined, from, among other things, disclosing a K12 students personal information, except as specified. Existing law, the Student Test Taker Privacy Protection Act, prohibits a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services and in other specified circumstances.

This bill, beginning July 1, 2027, would require a business providing those proctoring services to a school district, county office of education, or charter school for classroom- or course-based exams to use end-to-end encryption, as defined, for those purposes. The bill would define end-to-end encryption for these purposes to mean a security method where data is encrypted on the senders device and remains encrypted until it reaches the intended recipients device and is unreadable by any other party, including the business providing proctoring services.

The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), imposes various obligations on businesses with respect to personal information, as defined. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

The CCPA requires a business to inform consumers of the categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. Existing law, the Student Online Personal Information Protection Act, prohibits an operator, as defined, from, among other things, disclosing a K12 students personal information, except as specified. Existing law, the Student Test Taker Privacy Protection Act, prohibits a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services and in other specified circumstances.

This bill bill, beginning July 1, 2027, would require a business providing those proctoring services to a school district, county office of education, or charter school for classroom- or course-based exams to use end-to-end encryption, as defined, for those purposes. The bill would define end-to-end encryption for these purposes to mean a security method where data is encrypted on the senders device and remains encrypted until it reaches the intended recipients device and is unreadable by any other party, including the business providing proctoring services.

The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), imposes various obligations on businesses with respect to personal information, as defined. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

The CCPA requires a business to inform consumers of the categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. Existing law, the Student Online Personal Information Protection Act, prohibits an operator, as defined, from, among other things, disclosing a K12 students personal information, except as specified. Existing law, the Student Test Taker Privacy Protection Act, prohibits a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services and in other specified circumstances.

This bill would require a business providing those proctoring services to a school district, county office of education, or charter school for classroom- or course-based exams to use end-to-end encryption, as defined, for those purposes. The bill would define end-to-end encryption for these purposes to mean a security method where data is encrypted on the senders device and remains encrypted until it reaches the intended recipients device and is unreadable by any other party, including the business providing proctoring services.

The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), imposes various obligations on businesses with respect to personal information, as defined. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.

The CCPA requires a business to inform consumers of the categories of personal information to be collected and the purposes for which the categories of personal information are collected or used and whether that information is sold or shared. Existing law, the Student Online Personal Information Protection Act, prohibits an operator, as defined, from, among other things, disclosing a K12 students personal information, except as specified. Existing law, the Student Test Taker Privacy Protection Act, prohibits a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services and in other specified circumstances.

This bill would require a business providing those proctoring services to a school district, county office of education, or charter school for classroom- or course-based exams to use end-to-end encryption, as defined, for those purposes. The bill would define end-to-end encryption for these purposes to mean a security method where data is encrypted on the senders device and remains encrypted until it reaches the intended recipients device and is unreadable by the business providing proctoring services.

The California Privacy Rights Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

 UNFINISHED BUSINESS  

Bill No: SB 930

Author: Reyes (D)

Amended: 7/2/26

Vote: 21

SENATE PRIV., DIGITAL TECH. & CONS. PROT. COMMITTEE: 9-0, 4/6/26

AYES: Cabaldon, Jones, Gonzalez, McNerney, Ochoa Bogh, Padilla, Reyes, Umberg, Wiener

SENATE FLOOR: 37-0, 4/27/26

AYES: Allen, Alvarado-Gil, Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Cervantes, Choi, Cortese, Dahle, Durazo, Grayson, Grove, Hurtado, Jones, Laird, Limón, McGuire, McNerney, Menjivar, Niello, Ochoa Bogh, Padilla, Pérez, Reyes, Richardson, Seyarto, Smallwood-Cuevas, Stern, Strickland, Umberg, Valladares, Wahab, Weber Pierson, Wiener

NO VOTE RECORDED: Caballero, Gonzalez, Rubio

ASSEMBLY FLOOR: 75-0, 8/6/26 - See last page for vote

SUBJECT: Student Test Taker Privacy Protection Act: end-to-end encryption

SOURCE: First Day Foundation

Los Amigos de la Comunidad

DIGEST:

This bill requires a business providing proctoring services to a local educational agency, as provided, to use end-to-end encryption (E2EE), as defined, in providing those services to protect personal information.

Assembly Amendments

delay the operative date of the changes to July 1, 2027.

ANALYSIS:

Existing law:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (California Constitution (Cal. Const)., article (art.) I, § 1.)
2. Prohibits a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services, as specified. (Business & Professions Code § 22588(a).)
3. Provides that the above restriction does not prohibit a business from collecting, using, retaining, or disclosing personal information if doing so is necessary for specified purposes, including to comply with federal or state laws or a court order or subpoena. (Business & Professions Code § 22588(b)).
4. Establishes the California Consumer Privacy Act (CCPA), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. It does not apply to government entities or nonprofits. (Civil Code § 1798.100 et seq.)

This bill:

1. Requires a business providing proctoring services to a local educational agency for classroom or course-based exams to use E2EE to provide those proctoring services, starting July 1, 2027.
2. Provides the following definitions:
   1. “End-to-end encryption” or “EE2E” means a security method where data is encrypted on the sender’s device and remains encrypted until it reaches the intended recipient’s device and is unreadable by any other party, including the business providing proctoring services.
   2. “Local educational agency” means a school district, county office of education, or charter school.

Background

Proctoring software collects sensitive information, such as video, audio, and screen data, but most current systems lack robust encryption safeguards. E2EE ensures that data is encrypted on the student’s device and remains protected during transmission and storage, accessible only to authorized school personnel—not to the proctoring vendor itself, or any other party. Current law allows proctoring companies to use the data to provide the necessary proctoring services.

This bill fortifies the Student Test Taker Privacy Protection Act by requiring that businesses providing proctoring services to specified educational institutions use E2EE to provide those services. E2EE is defined as a security method where data is encrypted on the sender’s device and remains encrypted until it reaches the intended recipient’s device and is unreadable by any other party, including the business providing proctoring services.

This bill is sponsored by First Day Foundation and Los Amigos de la Comunidad. This bill is supported by a number of groups, including the Center for Digital Democracy, the Alameda County Office of Education, and Oakland Privacy. No timely opposition has been received.

Comments

Proctoring software collects sensitive information, such as video, audio, and screen data. Unfortunately, most current proctoring systems lack robust encryption safeguards to protect such sensitive student data. This bill attempts to address that gap by amending the Student Test Taker Privacy Protection Act to require a business providing proctoring services to a local educational agency for classroom or course-based exams to use E2EE to provide those proctoring services.

According to IBM:

End-to-end encryption (E2EE) is a secure communication process that encrypts data before transferring it to another endpoint. Data stays encrypted in transit and is decrypted on the recipient’s device. Messaging apps, SMS, and other communications services rely on E2EE to protect messages from unauthorized access.

End-to-end encryption (E2EE) is widely considered the most private and secure method for communicating over a network.

Similar to other encryption methods, E2EE transforms readable plaintext into unreadable ciphertext by using cryptography. This process helps to mask sensitive information from unauthorized users and ensures that only the intended recipients—with the correct decryption key—can access sensitive data.^[1]

E2EE ensures that data is encrypted on the student’s device and remains protected during transmission and storage. The data is accessible only to authorized school personnel, but not to the proctoring vendor itself.

According to the author:

In the wake of the COVID-19 pandemic, schools across California rapidly adopted online learning platforms and virtual assessments both inside and outside the classroom. Due to their flexibility and efficiency, these digital tools remain widely used, transforming our K-12 education system. Unfortunately, some third-party proctoring companies have collected sensitive student data far beyond what is necessary to administer exams, including biometric information, browsing history, and recordings from students' homes. This excessive data collection raises serious privacy and security concerns.

Existing laws such as the California Consumer Privacy Act and the Family Educational Rights and Privacy Act provide important privacy protections. However, as technology evolves and becomes more deeply embedded in education, additional safeguards are necessary to ensure those protections remain meaningful in practice.

SB 930 strengthens existing law by requiring proctoring companies to implement end-to-end encryption for online assessments. This ensures sensitive student data is protected from unauthorized access, reduces the risk of breaches, and reinforces the principle that students should be able to pursue their education without sacrificing their privacy. Protecting student data is a matter of educational equity, and as technology advances, so must California’s commitment to keeping our youth safe.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 8/7/26)

First Day Foundation (co-source)

Los Amigos de la Comunidad (co-source)

Alameda County Office of Education

California Teachers Association

Center for Digital Democracy

Oakland Privacy

Proctorio, Inc.

Wonder Wood Ranch

OPPOSITION: (Verified 8/7/26)

None received

ARGUMENTS IN SUPPORT: The Center for Digital Democracy writes:

Privacy is a fundamental right, and for students it is also a matter of data justice. Young people are required to use digital systems that collect highly sensitive information, often without meaningful choice, creating structural risks and imbalances that demand stronger protections.

Online proctoring technologies highlight these concerns. They collect video, audio, biometric, and behavioral data, yet current safeguards remain inadequate. Students should not have to accept intrusive surveillance in order to participate in their education.

SB 930 takes an important privacy by design approach by requiring end-to-end encryption for online assessments. By ensuring that student data is encrypted on the student’s device and remains inaccessible to proctoring vendors, the bill builds protection directly into the system and reduces the risk of misuse or breach from the outset.

This is a necessary step to rebalance power, limit unnecessary data access, and ensure that educational technology respects students’ rights in practice.

ASSEMBLY FLOOR: 75-0, 8/6/26

AYES: Addis, Aguiar-Curry, Ahrens, Alanis, Alvarez, Arambula, Ávila Farías, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Carrillo, Castillo, Chen, Connolly, Davies, DeMaio, Dixon, Ellis, Gabriel, Garcia, Gipson, Jeff Gonzalez, Mark González, Hadwick, Haney, Harabedian, Hart, Hoover, Irwin, Jackson, Johnson, Kalra, Krell, Lackey, Lee, Lowenthal, Macedo, McKinnor, Muratsuchi, Nguyen, Ortega, Pacheco, Papan, Patel, Patterson, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Michelle Rodriguez, Rogers, Blanca Rubio, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Ta, Tangipa, Valencia, Wallis, Ward, Wicks, Wilson, Zbur, Rivas

NO VOTE RECORDED: Elhawary, Flora, Fong, Sanchez

Prepared by: Christian Kurpiewski / P., D.T., & C.P. / (916) 651-1548, Bill Herms / P., D.T., & C.P. / (916) 651-1548

8/7/26 13:37:15

**** END ****

1. What is end-to-end encryption (E2EE)? IBM, https://www.ibm.com/think/topics/end-to-end-encryption [as of July 29, 2026]. ↑

SENATE THIRD READING

STR Bill Id:SB 930

Author:(Reyes)

As Amended Ver:July 02, 2026

Majority vote

SUMMARY

Requires a business providing proctoring services to a local educational agency for classroom- or course-based exams to use end-to-end encryption to provide those services.

Major Provisions

1. Defines the following terms:
2. "End-to-end encryption" or "(E2EE)" means a security method where data is encrypted on the sender's device and remains encrypted until it reaches the intended recipient's device and is unreadable by any other party, including the business providing proctoring services.
3. "Local educational agency" means a school district, county office of education, or charter school.
4. Requires a business providing proctoring services to a local educational agency for classroom- or course-based exams to use end-to-end encryption to provide those services.

COMMENTS

Background. During the COVID-19 pandemic, schools increasingly relied on remote proctoring tools capable of collecting sensitive information such as biometric data, identification documents, browsing history, video and audio recordings, and information about a student's surroundings. While student privacy is protected under both federal and state law, recent reports of data breaches and security vulnerabilities involving educational technology companies have heightened concerns that vendors continue to retain large amounts of sensitive student information.

What this bill would do. This bill would require businesses providing proctoring services to local educational agencies for classroom- or course-based exams to use end-to-end encryption to provide such services. By ensuring that data transmitted through proctoring software is unreadable to the proctoring service provider, this bill seeks to mitigate the risk of unauthorized access, interception, or misuse of sensitive student information.

Analysis. During the COVID-19 pandemic, academic institutions turned to online proctoring services to monitor students taking online exams. These services sought to deter cheating, uphold academic integrity, and support students through identity verification, video and audio monitoring, student device controls, live remote proctoring, and automated proctoring through artificial intelligence. As the prevalence of online proctoring services has increased, students have raised concerns regarding the breadth of personal information collected.

The privacy of students is afforded special protection under both state and federal law. The Family Educational Rights and Privacy Act (FERPA) provides that in order to receive federal funding, schools must offer certain rights to parents of students and to students over the age of 18, including the right to inspect and review the student's education records and the right to request that the school correct records that are inaccurate or misleading. California law provides similar protections for education records and expands on these protections by specifically addressing privacy in the context of educational technology. In 2014, the K-12 Pupil Online Personal Information Protection Act (POPIPA), was established following the passage of SB 1177 (Steinberg), Chapter 839, Statutes of 2014. POPIPA regulates operators of internet websites, online services, online applications, and mobile applications with actual knowledge that the site, service, or application is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes. In 2016, AB 2799 (Chau), Chapter 620, Statutes of 2016 expanded these protections to children enrolled in preschool or prekindergarten. SB 1172 (Pan), Chapter 720, Statutes of 2022 expanded on FERPA and POPIPA by requiring businesses providing proctoring services in educational settings to collect, use, retain, and disclose only the PI strictly necessary to provide those services.

Encryption is the process of transforming readable information into an unreadable form using an encryption algorithm – a set of rules or calculations – and a cryptographic key. End-to-end encryption, or E2EE, is a method of securing communications so that only the sender and intended recipient can read the content. When information is sent, it is encrypted on the sender's device and remains encrypted while it travels through servers, networks, service providers, and any other intermediaries. Once the information reaches the intended recipient's device, it is decrypted using the appropriate cryptographic key. As a result, intermediaries generally cannot access or interpret the content of the communication.

This bill, builds on the framework established by SB 1172 by additionally requiring businesses providing proctoring services to local educational agencies for classroom- or course-based exams to use end-to-end encryption to provide those services. The bill's definition of "end-to-end encryption" specifically requires that data be unreadable by the business providing proctoring services.

According to the Author

"In the wake of the COVID-19 pandemic, schools across California rapidly adopted online learning platforms and virtual assessments both inside and outside the classroom. Due to their flexibility and efficiency, these digital tools remain widely used, transforming our K–12 education system. Unfortunately, some third-party proctoring companies have collected sensitive student data far beyond what is necessary to administer exams, including biometric information, browsing history, and recordings from students' homes. This excessive data collection raises serious privacy and security concerns."

"Existing laws such as the California Consumer Privacy Act and the Family Educational Rights and Privacy Act provide important privacy protections. However, as technology evolves and becomes more deeply embedded in education, additional safeguards are necessary to ensure those protections remain meaningful in practice."

"SB 930 strengthens existing law by requiring proctoring companies to implement end-to-end encryption for online assessments. This ensures sensitive student data is protected from unauthorized access, reduces the risk of breaches, and reinforces the principle that students should be able to pursue their education without sacrificing their privacy. Protecting student data is a matter of educational equity, and as technology advances, so must California's commitment to keeping our youth safe."

Arguments in Support

The California Teachers Association writes:

SB 930 takes an important privacy by design approach by requiring end-to-end encryption for online assessments. By ensuring that student data is encrypted on the student's device and remains inaccessible to proctoring vendors, the bill builds protection directly into the system and reduces the risk of misuse or breach from the outset.

Proctoring service provider Proctorio writes:

Proctorio supports SB 930 because it establishes a clear and uniform baseline for protecting student data across the proctoring industry. We believe that strong privacy protections and educational innovation must go hand in hand, and that clear statutory standards benefit students, families, educators, and providers alike.

The Alameda County Office of Education writes:

We feel that the requirements of this bill are reasonable and reflect best practices for ensuring students' data privacy.

Arguments in Opposition

No opposition on file.

FISCAL COMMENTS

As currently in print, this bill is keyed nonfiscal.

VOTES

SENATE FLOOR: 37-0-3

YES: Allen, Alvarado-Gil, Archuleta, Arreguín, Ashby, Becker, Blakespear, Cabaldon, Cervantes, Choi, Cortese, Dahle, Durazo, Grayson, Grove, Hurtado, Jones, Laird, Limón, McGuire, McNerney, Menjivar, Niello, Ochoa Bogh, Padilla, Pérez, Reyes, Richardson, Seyarto, Smallwood-Cuevas, Stern, Strickland, Umberg, Valladares, Wahab, Weber Pierson, Wiener

ABS, ABST OR NV: Caballero, Gonzalez, Rubio

ASM PRIVACY AND CONSUMER PROTECTION: 15-0-0

YES: Bauer-Kahan, Macedo, Bryan, DeMaio, Hoover, Irwin, Lowenthal, McKinnor, Ortega, Patterson, Pellerin, Petrie-Norris, Ward, Wicks, Wilson

ASM EDUCATION: 8-0-1

YES: Patel, Hoover, Alvarez, Bonta, Castillo, Lowenthal, Pellerin, Zbur

ABS, ABST OR NV: Garcia

UPDATED

VERSION: July 02, 2026

CONSULTANT: Slater Sharp / P. & C.P. / (916) 319-2200 FN: 0003293

Date of Hearing: July 1, 2026

ASSEMBLY COMMITTEE ON EDUCATION

Darshana R. Patel, Chair

SBPCA Bill Id:SB 930

Author:(Reyes) – As Amended Ver:March 25, 2026

SENATE VOTE: 37-0

SUBJECT: Student Test Taker Privacy Protection Act: end-to-end encryption

[Note: This bill was double referred to the Assembly Committee on Privacy and Consumer Protection and was heard by that Committee as it relates to issues under its jurisdiction.]

SUMMARY: Requires a business providing exam proctoring services to a local educational agency (LEA) to use end-to-end encryption (E2EE), subject to existing requirements for compliance with law enforcement activities. Specifically, this bill:

1. Defines the following to mean:
   1. Proctoring services includes, but is not limited to, services offered by a business to observe, monitor, or administer an exam;
   2. E2EE means a security method where data is encrypted on the sender’s device and remains encrypted until it reaches the intended recipient’s device and is unreadable by any other party, including the business providing proctoring services; and
   3. LEA means a school district, county office of education, or charter school.
2. Requires a business that is proctoring classroom- or course-based exams in a kindergarten through 12^th grade setting to use E2EE encryption in their proctoring services, such that only the intended recipient, and not the business providing proctoring services, may access the data.
3. Requires the provisions of this bill to be consistent with the California Privacy Rights Act of 2020, enacted by Proposition 24 (2020).

EXISTING LAW:

1. Establishes the Student Test Taker Privacy Protection Act. Requires a business providing proctoring services in an educational setting to collect, use, retain, and disclose only the personal information strictly necessary to provide those services, except as necessary to do any of the following:
   1. To comply with federal, state, or local law;
   2. To comply with a court order or subpoena;
   3. To comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, or local agency authorized by law to conduct that inquiry or investigation, or authorized to serve a subpoena or summons, as applicable;
   4. To cooperate with a law enforcement agency concerning conduct or activity that the business reasonably and in good faith believes to violate federal, state, or local law;
   5. To cooperate with a government agency request for emergency access to a consumer’s personal information if a natural person is at imminent risk of death or serious physical injury, provided that all of the following are met:
      
      1. The request is approved by a high-ranking agency officer for emergency access to a consumer’s personal information;
         
      2. The request is based on the agency’s good faith determination that it has a lawful basis to access the information on a nonemergency basis; and
         
      3. The agency agrees to petition a court for an appropriate order within three days and to destroy the information if that order is not granted.
   6. To exercise or defend a legal claim. (Business and Professions Code (BPC) 22588)
2. Establishes the California Consumer Privacy Act, which grants consumers certain rights regarding their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. Specifies that compliance obligations in respecting these rights are the responsibility of businesses. Exempts government entities or nonprofits from compliance. (Civil Code (CIV) 1798.100)
3. Establishes the Children’s Online Privacy Protection Act (COPPA). Requires an operator of a website or online service that is directed to a child, or knowingly collecting personal information from a child, to provide notice of the information that is collected and how it is used, and to give parents the opportunity to refuse further information collection from the child. (15 U.S.C. Sec. 6502.)
4. Establishes the K-12 Pupil Online Personal Information Protection Act. Prohibits the operator of a website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes, from engaging in specified activities, including:
   1. Engaging in targeted advertising based on any information that the operator has acquired because of the use of that operator’s site, service, or application;
   2. Using information created or gathered by the operator to amass a profile about a K-12 student except in furtherance of K-12 purposes;
   3. Sell a student’s information; and
   4. Disclose covered information, as defined, except under specified circumstances. (BPC 22584)

FISCAL EFFECT: This bill has been keyed non-fiscal by the Office of Legislative Counsel.

COMMENTS:

Need for the bill. According to the author, “In the wake of the COVID-19 pandemic, schools across California rapidly adopted online learning platforms and virtual assessments both inside and outside the classroom. Due to their flexibility and efficiency, these digital tools remain widely used, transforming our K–12 education system. Unfortunately, some third-party proctoring companies have collected sensitive student data far beyond what is necessary to administer exams, including biometric information, browsing history, and recordings from students’ homes. This excessive data collection raises serious privacy and security concerns.

SB 930 strengthens existing law by requiring proctoring companies to implement end-to-end encryption for online assessments. This ensures sensitive student data is protected from unauthorized access, reduces the risk of breaches, and reinforces the principle that students should be able to pursue their education without sacrificing their privacy. Protecting student data is a matter of educational equity, and as technology advances, so must California’s commitment to keeping our youth safe.”

Online proctoring. The use of computer-based test-taking for K12 students has been rising in recent years, especially in the wake of the COVID-19 pandemic. Many state testing requirement are now met through online platforms, including the California Assessment of Student Performance and Progress (CAASPP).

Importantly, SB 930 defines “proctoring” to include any business that observes, monitors, or administers an exam. This is a broad definition that likely captures the majority of digital test taking in California.

What is end to end encryption? E2EE ensures that data that is transmitted or stored digitally can only be viewed by the sender and the intended recipient. According to the Electronic Frontiers Foundation:

If used correctly, end-to-end encryption can help protect the contents of your messages, text, and files from being read by anyone except their intended recipients. End-to-end encryption tools make messages unreadable to eavesdroppers on the network, as well as to service providers themselves. They can also prove a message came from a specific person and was not altered.

Once complicated to set up, end-to-end encryption tools are far more usable than they used to be… Here’s how encryption works when sending a secret message:

1. A clearly readable message is first encrypted into a scrambled message that is incomprehensible to anyone looking at it (“hello mum” turns into “OhsieW5ge+osh1aehah6”).
2. The encrypted message is sent over the internet, where, if they’re watching, eavesdroppers would only see the scrambled message (“OhsieW5ge+osh1aehah6”).
3. When it arrives at its destination, the intended recipient, and only the intended recipient, has some way of decrypting it back into the original message (“OhsieW5ge+osh1aehah6” is turned back into “hello mum”).

In the context of student test taking, the sender of the data is the student and the intended recipient is presumably a school administrator. Ensuring that all relevant school employees are able to access student results in a timely and efficient manner will be an important aspect of SB 930 implementation.

E2EE can be accomplished through multiple methods, such as Advanced Encryption Standard (AES) and Post Quantum Standard (PQS), which each offer different levels of protection. SB 930 does not specify which form of data encryption must be applied to student assessments, which may allow the bill to remain relevant as new forms of encryption become available. However, given that some encryption methods are less secure than others, future legislation may wish to consider requiring stricter encryption standards to protect student data.

Data privacy concerns in online education. Recent and ongoing lawsuits demonstrate the security concerns online education services pose to students:

• In 2025, parents of four California students sued i-Ready (and parent company Curriculum Associates) for allegedly collecting and sharing student information without consent (M.C. v. Curriculum Associates). i-Ready is accused of selling student names, ID numbers, grade levels, responses to academic questions, and IP addresses to third-party vendors, including Google. The case is currently ongoing.
• In 2026, PowerSchool (parent company of Naviance) agreed to a $17.25 million settlement after a class action lawsuit accused them of transmitting private communications between students and teachers, along with student names, ID numbers, graduation years, and demographic information, to the companies Google, Microsoft, and Heap (Q.J. v. PowerSchool Holdings LLC, et a.l). Attorneys in the case likened PowerSchool’s activities to wiretapping and eavesdropping.
• In 2025, Illuminate Education agreed to a $5.1 million settlement with California, Connecticut, and New York after misrepresenting its privacy practices and failing to protect student data. Under the agreement, Illuminate must also implement a robust data security system, including encryption practices. Another lawsuit, filed in May 2026, alleges that Illuminate collects student medical information, which was inadvertently released in a recent data breach (J.M. v. Illuminate Education).
• In 2020, a complaint was filed with the Department of Justice regarding data malpractice from exam proctoring companies (EPIC Complaint in Online Test Proctoring Companies). For example, the company ProctorU was accused of maintaining a “Hall of Fame” compilation video of students accused of cheating, and was criticized by the University of California Santa Barbara Faculty Association for collecting and sharing student information, including social security numbers, behavioral characteristics, faceprints and retina scans, IP addresses and search history, medical information, and employment information, among other items.

In these examples, providers of online education services released student information to outside entities. Under the E2EE required by SB 930, online proctoring companies would be unable to view or access student information, which could eliminate their ability to share it.

However, these examples illustrate that data breaches go beyond K12 proctoring services. Future legislation may wish to consider extending the E2EE requirements to all online education services, both for the K12 and higher education spaces.

Existing protections for students online are difficult to enforce. In 2014, as digital education tools began to proliferate, SB 1177 (Steinberg, Chapter 839, Statutes of 2014) established POPIPA. POPIPA restricts the use and disclosure of the personally identifiable information or materials of K-12 students. Under POPIPA, businesses that operate online websites, services, or applications (including mobile applications) that are primarily designed or used for K12 purposes cannot use or sell a student’s personal information.

Despite passing POPIPA, data breaches and lawsuits revealed that education technology companies continued to collect and share student information (see above examples). In response, the Legislature passed the Student Test Taker Privacy Protection Act (SB 1172 (Pan), Chapter 720, Statues of 2022). The Act prohibited proctoring companies from collecting, using, retaining, and disclosing any personal information from test takers beyond what was strictly necessary to provide the proctoring services. The statute also includes some exemptions, such as complying with orders from law enforcement agencies or in emergency settings.

However, the enforcement mechanisms available under POPIPA and the Test Taker Protection Act are primarily lawsuits, which can be filed only after the harm has occurred. Under the encryption requirements in SB 930 companies would likely be unable to access student data at all, thereby acting as a preventative method rather than a reactive one. For this reason, supporters of SB 930 argue that it is a needed supplement to existing student privacy laws.

Arguments in support. According to the Los Angelos County Office of Education, “As educational institutions continue to expand the use of online and hybrid testing environments, protecting student information has become increasingly important. Students routinely provide sensitive personal information through digital assessment platforms, making strong cybersecurity safeguards essential to maintaining trust, privacy, and compliance with state data protection laws.

By requiring end-to-end encryption for online test proctoring services, SB 930 strengthens protections for student data and reduces the risk of unauthorized access to personal information during assessments. Ensuring that information remains encrypted from the sender’s device until it reaches the intended recipient provides an important safeguard against data breaches and unauthorized disclosure.

The bill promotes safer digital learning environments for both students and staff by establishing a clear security standard for vendors providing assessment-related services. While implementation may require some vendors to enhance their existing security capabilities, the requirement aligns with widely recognized industry best practices and supports local educational agencies in meeting evolving expectations related to student privacy and cybersecurity.

As technology continues to play a greater role in teaching, learning, and assessment, strengthening protections for student data is essential to ensuring secure and effective educational environments.”

Arguments in Support. According to the First Day Foundation, “California has long been a national leader in privacy protection, from the California Consumer Privacy Act to the California Privacy Rights Act. SB 930 continues this legacy by extending strong protections to our K-12 students, who should not have to surrender intimate details about their home life, their appearance, their disabilities, or their online activity to a private company simply to take an exam. SB 930 also protects school districts from the legal and financial risks associated with third-party data breaches. This is a common-sense safeguard that benefits students, families, and schools alike.”

Recommended Committee Amendments. Staff recommends that the bill be amended as follows:

1. Include an implementation date of July 1, 2027.

Related legislation. SB 1172 (Pan), Chapter 720, Statutes of 2022, created the Pupil Test Taker Privacy Protection Act, which restricts the personal information that a business providing educational proctoring services can collect, use, retain, and disclose.

AB 375 (Chau), Chapter 55, Statutes of 2018, established the California Consumer Privacy Act, which grants consumers certain rights regarding their personal information.

SB 1177 (Steinberg), Chapter 839, Statutes of 2014, established POPIPA to restrict the use and disclosure of information about K-12 students.

REGISTERED SUPPORT / OPPOSITION:

Support

Alameda County Office of Education

California Teachers Association

First Day Foundation

Immigrants Rising

Los Amigos De LA Comunidad, INC.

Los Angeles County Office of Education

Oakland Privacy

Wonder Wood Ranch

Opposition

None on file

Analysis Prepared by: Sarah Cate Hawthorne / ED. / (916) 319-2087

Date of Hearing: June 16, 2026

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

SBPCA Bill Id:SB 930

Author:(Reyes) – As Amended Ver:March 25, 2026

SENATE VOTE: 37-0

SUBJECT: Student Test Taker Privacy Protection Act: end-to-end encryption

SYNOPSIS

During the COVID-19 pandemic, schools increasingly relied on remote proctoring tools capable of collecting sensitive information such as biometric data, identification documents, browsing history, video and audio recordings, and information about a student’s surroundings. While student privacy is protected under both federal and state law, recent reports of data breaches and security vulnerabilities involving educational technology companies have heightened concerns that vendors continue to retain large amounts of sensitive student information.

SB 930 requires businesses providing proctoring services to local educational agencies for classroom- or course-based exams to use end-to-end encryption to provide such services. By ensuring that data transmitted through proctoring software is unreadable to the proctoring service provider, this bill seeks to mitigate the risk of unauthorized access, interception, or misuse of sensitive student information.

SB 930 is sponsored by the First Day Foundation and Los Amigos de la Comunidad. It is supported by a variety of educators, privacy advocates, and proctoring service providers, including the California Teachers Association, Oakland Privacy, and Proctorio. The bill has no registered opposition.

If passed by this committee, the bill will next be heard by the Assembly Education Committee.

EXISTING LAW:

1. Defines the following terms:
   1. “Personal information” to mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. States that personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:
      
      1. Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
         
      2. Any personal information described in Section 1798.80(e).
         
      3. Characteristics of protected classifications under California or federal law.
         
      4. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
         
      5. Biometric information.
         
      6. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.
         
      7. Geolocation data.
         
      8. Audio, electronic, visual, thermal, olfactory, or similar information.
         
      9. Professional or employment-related information.
         
      10. Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act. (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
          
      11. Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
          
      12. Sensitive personal information. (Civ. Code § 1798.140(v).)
          
   2. “Proctoring services” to include, but not be limited to, services offered by a business to observe, monitor, or administer an exam. (Bus. & Prof. Code § 22588.)
2. Requires, pursuant to the federal Family Educational and Rights and Privacy Act (FERPA), that in order to receive federal funding, schools must offer certain rights to parents of students and to students over the age of 18, including the right to inspect and review the student’s education records, as defined, and the right to request that the school correct records that are inaccurate or misleading; and must place certain restrictions on the disclosure of any information from a student’s education record without written consent from the parent or adult student, except under specified circumstances. (20 U.S.C. Sec. 1232g.)
3. Requires, pursuant to the federal Children’s Online Privacy Protection Act (COPPA), that an operator of an internet website or online service directed to a child, as defined, or an operator of an internet website or online service that has actual knowledge that it is collecting PI from a child, to provide notice of what information is being collected and how that information is being used, and to give the parents of the child the opportunity to refuse to permit the operator’s further collection of information from the child. (15 U.S.C. Sec. 6502.)
4. Establishes the K-12 Pupil Online Personal Information Protection Act (POPIPA), which prohibits the operator of an internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes, from engaging in specified activities with respect to their site, service, or application, including:
   1. Engaging in targeted advertising on the operator’s site, service or application, or targeting advertising on any other site, service, application when the targeting of the advertising is based on any information that the operator has acquired because of the use of that operator’s site, service, or application.
   2. Using information created or gathered by the operator’s site, service, or application, to amass a profile about a K-12 student except in furtherance of K-12 purposes.
   3. Sell a student’s information.
   4. Disclose covered information, as defined, except under specified circumstances. (Bus. & Prof. Code § 22584.)
5. Requires, pursuant to POPIPA, that an operator implement reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification, or disclosure; and delete a student’s covered information if the school or district requests deletion of data under the control of the school or district. (Bus. & Prof. Code § 22584(d).)
6. Pursuant to the Early Learning Personal Information Protection Act (ELPIPA), extends specified POPIPA protections to children enrolled in preschool or prekindergarten courses of instruction. (Bus. & Prof. Code § 22586.)
7. Prohibits an operator of an internet website, online service, online application, or mobile application directed to minors from marketing or advertising specified products or services that cannot be legally purchased by minors if the operator has actual knowledge that the person to whom they are advertising is a minor; and prohibits an operator who has actual knowledge that a minor is using its website, online service, online application, or mobile application from knowingly using, disclosing, compiling, or allowing a third party to use, disclose, or compile, the PI of a minor with actual knowledge that the use, disclosure, or compilation is for the purpose of marketing or advertising products or services to that minor for a specified product. (Bus. & Prof. Code § 22580.)
8. Establishes the California Consumer Privacy Act of 2018 (CCPA) and provides various rights to consumers pursuant to the act. Subject to various general exemptions, a consumer has, among other things:
9. The right to know what personal information (PI) a business collects about consumers, as specified, including the categories of third parties with whom the business shares PI.
10. The right to know what PI a business sells about consumers, as specified, including the categories of PI that the business sold about the consumer and the categories of third parties to whom the PI was sold, by category or categories of PI for each third party to whom the PI was sold.
11. The right to access the specific pieces of information a business has collected about the consumer.
12. The right to delete information that a business has collected from the consumer.
13. The right to opt-out of the sale of the consumer’s PI if over 16 years of age, and the right to opt-in if the consumer is a minor (as exercised by the parent if the minor is under 13, or as exercised by the minor if the minor is between ages 13 and 16).
14. The right to equal service and price, despite exercising any of these rights. (Civ. Code § 1798.100 et seq.)
15. Pursuant to the CCPA, permits any consumer whose non-encrypted and non-redacted PI is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of the business’s violation of the duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to institute a civil action to recover specified damages, injunctive or declaratory relief, and any other relief the court deems proper. (Civ. Code § 1798.150.)
16. Requires a business providing proctoring services in an educational setting to collect, use, retain, and disclose only the personal information strictly necessary to provide those services, except as necessary to do any of the following:
    1. To comply with federal, state, or local law.
    2. To comply with a court order or subpoena.
    3. To comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, or local agency authorized by law to conduct that inquiry or investigation, or authorized to serve a subpoena or summons, as applicable.
    4. To cooperate with a law enforcement agency concerning conduct or activity that the business reasonably and in good faith believes to violate federal, state, or local law.
    5. To cooperate with a government agency request for emergency access to a consumer’s personal information if a natural person is at imminent risk of death or serious physical injury, provided that all of the following are met:
       
       1. The request is approved by a high-ranking agency officer for emergency access to a consumer’s personal information.
          
       2. The request is based on the agency’s good faith determination that it has a lawful basis to access the information on a nonemergency basis.
          
       3. The agency agrees to petition a court for an appropriate order within three days and to destroy the information if that order is not granted.
    6. To exercise or defend a legal claim. (Bus. & Prof. Code § 22588.)

THIS BILL:

1. Defines the following terms:
2. “End-to-end encryption” or “E2EE” to mean a security method where data is encrypted on the sender’s device and remains encrypted until it reaches the intended recipient’s device and is unreadable by any other party, including the business providing proctoring services.
3. “Local educational agency” to mean a school district, county office of education, or charter school.
4. Requires a business providing proctoring services to a local educational agency for classroom- or course-based exams in an educational setting to use end-to-end encryption to provide those services.

COMMENTS:

1. Author’s statement. According to the author:

In the wake of the COVID-19 pandemic, schools across California rapidly adopted online learning platforms and virtual assessments both inside and outside the classroom. Due to their flexibility and efficiency, these digital tools remain widely used, transforming our K–12 education system. Unfortunately, some third-party proctoring companies have collected sensitive student data far beyond what is necessary to administer exams, including biometric information, browsing history, and recordings from students’ homes. This excessive data collection raises serious privacy and security concerns.

Existing laws such as the California Consumer Privacy Act and the Family Educational Rights and Privacy Act provide important privacy protections. However, as technology evolves and becomes more deeply embedded in education, additional safeguards are necessary to ensure those protections remain meaningful in practice.

SB 930 strengthens existing law by requiring proctoring companies to implement end-to-end encryption for online assessments. This ensures sensitive student data is protected from unauthorized access, reduces the risk of breaches, and reinforces the principle that students should be able to pursue their education without sacrificing their privacy. Protecting student data is a matter of educational equity, and as technology advances, so must California’s commitment to keeping our youth safe.

1. Background. End-to-end encryption. Encryption is the process of transforming readable information into an unreadable form using an encryption algorithm – a set of rules or calculations – and a cryptographic key. End-to-end encryption, or E2EE, is a method of securing communications so that only the sender and intended recipient can read the content. When information is sent, it is encrypted on the sender’s device and remains encrypted while it travels through servers, networks, service providers, and any other intermediaries. Once the information reaches the intended recipient’s device, it is decrypted using the appropriate cryptographic key. As a result, intermediaries generally cannot access or interpret the content of the communication.

Student privacy. The privacy of students is afforded special protection under both state and federal law. The Family Educational Rights and Privacy Act (FERPA) provides that in order to receive federal funding, schools must offer certain rights to parents of students and to students over the age of 18, including the right to inspect and review the student’s education records and the right to request that the school correct records that are inaccurate or misleading. FERPA also predicates the provision of federal funds to a school on compliance with certain restrictions on disclosing any information from a student’s education record without written consent from the parent or adult student, except under specified circumstances. FERPA defines “education records” to include records, files, documents and other materials which contain information directly related to a student and are maintained by an educational agency or institution, or by a person acting for such agency or institution.

California law provides similar protections for education records, and expands on these protections by specifically addressing privacy in the context of educational technology. In 2014, the K-12 Pupil Online Personal Information Protection Act (POPIPA), was established following the passage of SB 1177 (Steinberg). POPIPA regulates operators of internet websites, online services, online applications, and mobile applications with actual knowledge that the site, service, or application is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes. In 2016, AB 2799 (Chau), expanded these protections to children enrolled in preschool or prekindergarten. Under these laws, operators are prohibited from knowingly targeting advertising via the operator’s service, or targeted advertising via another site or service when the targeting is based upon information that the operator acquired via the operator’s service; using information created or gathered by the operator’s service to amass a profile about a K-12 student except in furtherance of K-12 school purposes; selling a student’s information; or disclosing certain types of personally identifiable information, except under specified circumstances.

SB 1172 (Pan, 2022) expanded on FERPA and POPIPA by requiring businesses providing proctoring services in educational settings to collect, use, retain, and disclose only the PI strictly necessary to provide those services. Consumers whose PI is collected, used, retained, or disclosed in violation of the bill are able to bring civil actions against proctoring service providers.

Proctoring services. During the COVID-19 pandemic, academic institutions turned to online proctoring services to monitor students taking online exams. These services sought to deter cheating, uphold academic integrity, and support students through identity verification, video and audio monitoring, student device controls, live remote proctoring, and automated proctoring through artificial intelligence. As the prevalence of online proctoring services has increased, students have raised concerns regarding the breadth of personal information collected. Electronic Frontier Foundation and Privacy Rights Clearinghouse, co-sponsors of SB 1172, describe the issue in a letter of support for that measure:

California’s students [face] serious privacy risks from remote proctoring software. Remote proctoring companies collect biometric data such as facial recognition templates and fingerprints, citizenship data and medical information, browsing history, and video and audio of a user’s surroundings. This information is not necessary to administer an examination, and needlessly places students’ privacy at risk . . . The use of proctoring software has risen 500 percent over the course of the pandemic.

A 2020 Consumer Reports article offers further explanation:

An analysis of Proctortrack software leaked in a databreach this fall suggests that the company ignored basic data security practices. That raises the possibility that private, sensitive information on students was leaked. In addition, security and legal experts worry that colleges don’t do enough to ensure online proctoring companies safeguard the personal data they collect.

Videos of students taking tests may have been accessible to unauthorized employees at Proctortrack, along with facial recognition data, contact information, digital copies of ID cards, and more, according to Patrick Jackson, the chief technology officer for the cybersecurity firm Disconnect, who analyzed Proctortrack’s leaked source code on behalf of Consumer Reports. After the software leaked, the information could have been accessed by criminals, as well.^[1]

1. What this bill would do. SB 930 builds on the framework established by SB 1172 by additionally requiring businesses providing proctoring services to local educational agencies for classroom- or course-based exams to use end-to-end encryption to provide those services. The bill’s definition of “end-to-end encryption” specifically requires that data be unreadable by the business providing proctoring services. Oakland Privacy, writing in support of the measure, explains the bill’s importance:

Now that education has largely, although not entirely, returned to in-person pedagogy, new problems are emerging. Among them are several well-publicized and large-scale hacks of educational software companies including Powerschool^[2], and Illuminate^[3]. What these hacks reveal is that despite standing California laws designed to minimize the amount of personal information collected by ed tech companies (SOPIPA et al), the companies seem to have a lot of student information on hand, and significant vulnerability to cybersecurity incidents.

By mandating end to end encryption, Senate Bill 930 seeks to eliminate the risks of company non-compliance to students in the event of hacking or interception by making the transmittals of data points from proctoring software unreadable by the software’s manufacturer, and presumably, all others.

ARGUMENTS IN SUPPORT:

The California Teachers Association writes:

SB 930 takes an important privacy by design approach by requiring end-to-end encryption for online assessments. By ensuring that student data is encrypted on the student’s device and remains inaccessible to proctoring vendors, the bill builds protection directly into the system and reduces the risk of misuse or breach from the outset.

Proctoring service provider Proctorio writes:

Proctorio supports SB 930 because it establishes a clear and uniform baseline for protecting student data across the proctoring industry. We believe that strong privacy protections and educational innovation must go hand in hand, and that clear statutory standards benefit students, families, educators, and providers alike.

The Alameda County Office of Education writes:

We feel that the requirements of this bill are reasonable and reflect best practices for ensuring students' data privacy.

REGISTERED SUPPORT / OPPOSITION:

Support

First Day Foundation (Co-Sponsor)
Los Amigos De LA Comunidad, INC. (Co-Sponsor)
Alameda County Office of Education
California Catholic Conference
California Teachers Association
Immigrants Rising
Los Angeles County Office of Education
Oakland Privacy
Proctorio, INC.
Wonder Wood Ranch

Opposition

None on file.

Analysis Prepared by: Slater Sharp / P. & C.P. / (916) 319-2200

1. Thomas Germain, “Poor Security at Online Proctoring Company May Have Put Student Data at Risk,” Consumer Reports, Dec. 10, 2020, https://www.consumerreports.org/digital-security/poor-security-at-online-proctoring-company-proctortrack-may-have-put-student-data-at-risk-a8711230545/ ↑

2. Kevin Collier, “Children's data hacked after school software firm missed basic security step, internal report says,” NBC News, (Jan. 31, 2025), https://www.nbcnews.com/tech/security/powerschool-hack-data-breach-protect-student-school-teacher-safe-rcna189029. ↑

3. Insurance Journal, “California Gets $3.2M Settlement From Software Company for Breached Student Data,” (Nov. 10, 2025), https://www.insurancejournal.com/news/west/2025/11/10/846901.htm. ↑

 THIRD READING  

Bill No: SB 930

Author: Reyes (D)

Amended: 3/25/26

Vote: 21

SENATE PRIV., DIGITAL TECH. & CONS. PROT. COMMITTEE: 9-0, 4/6/26

AYES: Cabaldon, Jones, Gonzalez, McNerney, Ochoa Bogh, Padilla, Reyes, Umberg, Wiener

SUBJECT: Student Test Taker Privacy Protection Act: end-to-end encryption

SOURCE: First Day Foundation

Los Amigos de la Comunidad

DIGEST:

This bill requires a business providing proctoring services to a local educational agency, as provided, to use end-to-end encryption (E2EE), as defined, in providing those services to protect personal information.

ANALYSIS:

Existing law:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (California Constitution (Cal. Const)., article (art.) I, § 1.)
2. Prohibits a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services, as specified. (Business & Professions Code § 22588(a).)
3. Provides that the above restriction does not prohibit a business from collecting, using, retaining, or disclosing personal information if doing so is necessary for specified purposes, including to comply with federal or state laws or a court order or subpoena. (Business & Professions Code § 22588(b)).
4. Establishes the California Consumer Privacy Act (CCPA), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. It does not apply to government entities or nonprofits. (Civil Code § 1798.100 et seq.)

This bill:

1. Requires a business providing proctoring services to a local educational agency for classroom or course-based exams to use E2EE to provide those proctoring services.
2. Provides the following definitions:
   1. “End-to-end encryption” or “EE2E” means a security method where data is encrypted on the sender’s device and remains encrypted until it reaches the intended recipient’s device and is unreadable by any other party, including the business providing proctoring services.
   2. “Local educational agency” means a school district, county office of education, or charter school.

Background

Proctoring software collects sensitive information, such as video, audio, and screen data, but most current systems lack robust encryption safeguards. E2EE ensures that data is encrypted on the student’s device and remains protected during transmission and storage, accessible only to authorized school personnel—not to the proctoring vendor itself, or any other party. Current law allows proctoring companies to use the data to provide the necessary proctoring services.

This bill fortifies the Student Test Taker Privacy Protection Act by requiring that businesses providing proctoring services to specified educational institutions use E2EE to provide those services. E2EE is defined as a security method where data is encrypted on the sender’s device and remains encrypted until it reaches the intended recipient’s device and is unreadable by any other party, including the business providing proctoring services.

This bill is sponsored by First Day Foundation and Los Amigos de la Comunidad. The bill is supported by a number of groups, including the Center for Digital Democracy, the Alameda County Office of Education, and Oakland Privacy. No timely opposition has been received.

Comments

Proctoring software collects sensitive information, such as video, audio, and screen data. Unfortunately, most current proctoring systems lack robust encryption safeguards to protect such sensitive student data. This bill attempts to address that gap by amending the Student Test Taker Privacy Protection Act to require a business providing proctoring services to a local educational agency for classroom or course-based exams to use E2EE to provide those proctoring services.

According to IBM:

End-to-end encryption (E2EE) is a secure communication process that encrypts data before transferring it to another endpoint. Data stays encrypted in transit and is decrypted on the recipient’s device. Messaging apps, SMS, and other communications services rely on E2EE to protect messages from unauthorized access.

End-to-end encryption (E2EE) is widely considered the most private and secure method for communicating over a network.

Similar to other encryption methods, E2EE transforms readable plaintext into unreadable ciphertext by using cryptography. This process helps to mask sensitive information from unauthorized users and ensures that only the intended recipients—with the correct decryption key—can access sensitive data.^[1]

E2EE ensures that data is encrypted on the student’s device and remains protected during transmission and storage. The data is accessible only to authorized school personnel, but not to the proctoring vendor itself.

According to the author:

In the wake of the COVID-19 pandemic, schools across California rapidly adopted online learning platforms and virtual assessments both inside and outside the classroom. Due to their flexibility and efficiency, these digital tools remain widely used, transforming our K-12 education system. Unfortunately, some third-party proctoring companies have collected sensitive student data far beyond what is necessary to administer exams, including biometric information, browsing history, and recordings from students' homes. This excessive data collection raises serious privacy and security concerns.

Existing laws such as the California Consumer Privacy Act and the Family Educational Rights and Privacy Act provide important privacy protections. However, as technology evolves and becomes more deeply embedded in education, additional safeguards are necessary to ensure those protections remain meaningful in practice.

SB 930 strengthens existing law by requiring proctoring companies to implement end-to-end encryption for online assessments. This ensures sensitive student data is protected from unauthorized access, reduces the risk of breaches, and reinforces the principle that students should be able to pursue their education without sacrificing their privacy. Protecting student data is a matter of educational equity, and as technology advances, so must California’s commitment to keeping our youth safe.

FISCAL EFFECT: Appropriation: No Fiscal Com.: No Local: No

SUPPORT: (Verified 4/7/26)

First Day Foundation (co-source)

Los Amigos de la Comunidad (co-source)

Alameda County Office of Education

Center for Digital Democracy

Oakland Privacy

Proctorio, Inc.

Wonder Wood Ranch

OPPOSITION: (Verified 4/7/26)

None received

ARGUMENTS IN SUPPORT: The Center for Digital Democracy writes:

Privacy is a fundamental right, and for students it is also a matter of data justice. Young people are required to use digital systems that collect highly sensitive information, often without meaningful choice, creating structural risks and imbalances that demand stronger protections.

Online proctoring technologies highlight these concerns. They collect video, audio, biometric, and behavioral data, yet current safeguards remain inadequate. Students should not have to accept intrusive surveillance in order to participate in their education.

SB 930 takes an important privacy by design approach by requiring end-to-end encryption for online assessments. By ensuring that student data is encrypted on the student’s device and remains inaccessible to proctoring vendors, the bill builds protection directly into the system and reduces the risk of misuse or breach from the outset.

This is a necessary step to rebalance power, limit unnecessary data access, and ensure that educational technology respects students’ rights in practice.

Prepared by: Christian Kurpiewski / P., D.T., & C.P. / (916) 651-1548, Bill Herms / P., D.T., & C.P. / (916) 651-1548

4/8/26 16:35:54

**** END ****

1. What is end-to-end encryption (E2EE)? IBM, https://www.ibm.com/think/topics/end-to-end-encryption [as of March 29, 2026]. ↑

SENATE PRIVACY, DIGITAL TECHNOLOGIES, AND CONSUMER PROTECTION COMMITTEE

Senator Christopher Cabaldon, Chair

2025-2026 Regular Session

Bill No: SB 930 (Author:Reyes)

Version: March 25, 2026

Hearing Date: April 6, 2026

Fiscal: No

Urgency: No

Consultant: BH

SUBJECT

Student Test Taker Privacy Protection Act: end-to-end encryption.

DIGEST

This bill requires a business providing proctoring services to a local educational agency, as provided, to use end-to-end encryption, as defined, in providing those services to protect personal information.

EXECUTIVE SUMMARY

Proctoring software collects sensitive information, such as video, audio, and screen data, but most current systems lack robust encryption safeguards. End-to-end encryption (E2EE) ensures that data is encrypted on the student’s device and remains protected during transmission and storage, accessible only to authorized school personnel—not to the proctoring vendor itself, or any other party. Current law allows proctoring companies to use the data to provide the necessary proctoring services.

This bill fortifies the Student Test Taker Privacy Protection Act by requiring that businesses providing proctoring services to specified educational institutions use E2EE to provide those services. E2EE is defined as a security method where data is encrypted on the sender’s device and remains encrypted until it reaches the intended recipient’s device and is unreadable by any other party, including the business providing proctoring services.

This bill is sponsored by First Day Foundation and Los Amigos de la Comunidad. The bill is supported by a number of groups, including the Center for Digital Democracy, the Alameda County Office of Education, and Oakland Privacy. No timely opposition has been received by the Committee.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Provides, pursuant to the California Constitution, that all people have inalienable rights, including the right to pursue and obtain privacy. (Cal. Const., art. I, § 1.)
2. Prohibits a business providing proctoring services in an educational setting from collecting, retaining, using, or disclosing personal information except to the extent necessary to provide those proctoring services, as specified. (Bus. & Prof. Code § 22588(a).)
3. Provides that the above restriction does not prohibit a business from collecting, using, retaining, or disclosing personal information if doing so is necessary for specified purposes, including to comply with federal or state laws or a court order or subpoena. (Bus. & Prof. Code § 22588(b)).
4. Establishes the California Consumer Privacy Act (CCPA), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. It does not apply to government entities or nonprofits. (Civ. Code § 1798.100 et seq.)

This bill:

1. Requires a business providing proctoring services to a local educational agency for classroom or course-based exams to use E2EE to provide those proctoring services.
2. Provides the following definitions:
   1. “End-to-end encryption” or “EE2E” means a security method where data is encrypted on the sender’s device and remains encrypted until it reaches the intended recipient’s device and is unreadable by any other party, including the business providing proctoring services.
   2. “Local educational agency” means a school district, county office of education, or charter school.

COMMENTS

1. Tests are important

For a student, tests represent a hurdle that must be cleared to advance their academic, professional or personal lives. Test proctors are important as they provide test security, fidelity and data assessment for the testing process. The rise of online testing has provided students with greater flexibility and access to testing opportunities like never before. Online proctored testing, or remote proctoring, is the practice of monitoring students taking such online exams with software and services. The purpose is to deter cheating, uphold academic integrity, and support students. These goals are accomplished through various methods, including identity verification, video and audio monitoring, locking other functions of a student’s computer, live remote proctoring, automated proctoring using AI, or some hybrid model. These services exploded during the COVID-19 pandemic.

Like all technological advances, the benefits come with drawbacks, especially with regard to individuals’ privacy. Online exams have exposed significant vulnerabilities in the protection of student personal data.

In response to rising concerns, SB 1172 (Pan, Ch. 720, Stats. 2022) created the Student Test Taker Privacy Protection Act. That law requires a business providing proctoring services in an educational setting to collect, use, retain, and disclose only the personal information strictly necessary to provide that service. However, it provides a series of exemptions from that requirement and does not provide for consumer enforcement.

1. Enhancing student privacy protections

Proctoring software collects sensitive information, such as video, audio, and screen data. Unfortunately, most current proctoring systems lack robust encryption safeguards to protect such sensitive student data. This bill attempts to address that gap by amending the Student Test Taker Privacy Protection Act to require a business providing proctoring services to a local educational agency for classroom or course-based exams to use E2EE to provide those proctoring services.

According to IBM:

End-to-end encryption (E2EE) is a secure communication process that encrypts data before transferring it to another endpoint. Data stays encrypted in transit and is decrypted on the recipient’s device. Messaging apps, SMS, and other communications services rely on E2EE to protect messages from unauthorized access.

End-to-end encryption (E2EE) is widely considered the most private and secure method for communicating over a network.

Similar to other encryption methods, E2EE transforms readable plaintext into unreadable ciphertext by using cryptography. This process helps to mask sensitive information from unauthorized users and ensures that only the intended recipients—with the correct decryption key—can access sensitive data.^[1]

E2EE ensures that data is encrypted on the student’s device and remains protected during transmission and storage. The data is accessible only to authorized school personnel, but not to the proctoring vendor itself.

According to the author:

In the wake of the COVID-19 pandemic, schools across California rapidly adopted online learning platforms and virtual assessments both inside and outside the classroom. Due to their flexibility and efficiency, these digital tools remain widely used, transforming our K-12 education system. Unfortunately, some third-party proctoring companies have collected sensitive student data far beyond what is necessary to administer exams, including biometric information, browsing history, and recordings from students' homes. This excessive data collection raises serious privacy and security concerns.

Existing laws such as the California Consumer Privacy Act and the Family Educational Rights and Privacy Act provide important privacy protections. However, as technology evolves and becomes more deeply embedded in education, additional safeguards are necessary to ensure those protections remain meaningful in practice.

SB 930 strengthens existing law by requiring proctoring companies to implement end-to-end encryption for online assessments. This ensures sensitive student data is protected from unauthorized access, reduces the risk of breaches, and reinforces the principle that students should be able to pursue their education without sacrificing their privacy. Protecting student data is a matter of educational equity, and as technology advances, so must California’s commitment to keeping our youth safe.

The Center for Digital Democracy writes in support:

Privacy is a fundamental right, and for students it is also a matter of data justice. Young people are required to use digital systems that collect highly sensitive information, often without meaningful choice, creating structural risks and imbalances that demand stronger protections.

Online proctoring technologies highlight these concerns. They collect video, audio, biometric, and behavioral data, yet current safeguards remain inadequate. Students should not have to accept intrusive surveillance in order to participate in their education.

SB 930 takes an important privacy by design approach by requiring end-to-end encryption for online assessments. By ensuring that student data is encrypted on the student’s device and remains inaccessible to proctoring vendors, the bill builds protection directly into the system and reduces the risk of misuse or breach from the outset.

This is a necessary step to rebalance power, limit unnecessary data access, and ensure that educational technology respects students’ rights in practice.

SUPPORT

First Day Foundation (co-sponsor)

Los Amigos de la Comunidad (co-sponsor)

Alameda County Office of Education

Center for Digital Democracy

Oakland Privacy

Proctorio, Inc.

Wonder Wood Ranch

OPPOSITION

None received

**************

1. What is end-to-end encryption (E2EE)? IBM, https://www.ibm.com/think/topics/end-to-end-encryption [as of March 29, 2026]. ↑