Serves schools or universities, in Illinois

105 ILCS 5/28-21 · Read the law's page

• If you publish a printed textbook or electronic textbook that is furnished at public expense under sections 28-14 through 28-19 of the School Code and was first published after July 19, 2006, expect the State Board of Education to require you to furnish an accessible electronic file set of the contracted print material to the National Instructional Materials Access Center, for conversion to an accessible format for a child with a print disability (105 ILCS 5/28-21).
• Make the file set an accessible electronic file, one that conforms to the specifications of the national file format adopted by the United States Department of Education (105 ILCS 5/28-21).
• If you are the State Board of Education, require each publisher of a textbook furnished at public expense and first published after July 19, 2006 to furnish that accessible electronic file set to the National Instructional Materials Access Center (105 ILCS 5/28-21).

105 ILCS 75/5, 75/10 and 75/15 · Read the law's page

• If you are a post-secondary school, do not request or require a student or the student's parent or guardian to provide a password or other related account information to gain access to the student's account or profile on a social networking website, and do not demand access to it in any manner (105 ILCS 75/10(a)).
• You may adopt lawful policies governing use of your electronic equipment and monitor use of your electronic equipment and electronic mail without requesting or requiring a password or account information, and you may investigate and require a student to share reported content where there is specific information that activity on the student's account violates a school disciplinary rule or policy (105 ILCS 75/10(b) and (d)).
• If you are an elementary or secondary school, notify the student and the student's parent or guardian, in your disciplinary rules, policies, or handbook or by similar means, that you may not request or require a password or other related account information to gain access to the student's social networking account or profile, and that you may conduct an investigation and require the student to share reported content if there is specific information about activity that violates a school disciplinary rule or policy (105 ILCS 75/15).

105 ILCS 85/15(5) and 85/27(a)(5) and (d) · Read the law's page

• If you are an operator, notify the school of any breach of the students' covered information within the most expedient time possible and without unreasonable delay, no later than 30 calendar days after you determine that a breach has occurred (105 ILCS 85/15(5)).
• If you are a school, notify the parent of each student whose covered information is involved in a breach no later than 30 calendar days after you receive the operator's notice or determine that a breach has occurred, stating the date or date range, a description of the compromised information, contact information for the operator and school, the toll-free numbers, addresses and websites for consumer reporting agencies and the Federal Trade Commission, and that the parent may obtain fraud alert and security freeze information from them; where a law enforcement agency has asked in writing for a delay because notice would interfere with a criminal investigation, give the notice as soon as it no longer would (105 ILCS 85/27(d)).for a public body
• Post a list of breaches of covered information stating the number of students involved, the date or estimated date range, and for an operator breach the operator's name, updated no later than 30 calendar days after the start of a fiscal year and of a calendar year; the list may omit a breach involving fewer than 10% of your enrollment, one for which parent notice is not required, one that occurred before July 1, 2021, and one posted within the previous 5 years (105 ILCS 85/27(a)(5)).when it serves a public body

105 ILCS 85/26 · Read the law's page

• If you are a school, do not sell, rent, lease, or trade covered information (105 ILCS 85/26(1)).
• Do not share, transfer, disclose, or provide access to a student's covered information to an entity or individual other than the student's parent, school personnel, appointed or elected school board members or local school council members, or the State Board, without a written agreement, unless the disclosure is to law enforcement officials as State or federal law permits to protect the safety of users or the security of the operator's service, is required by court order or State or federal law, or ensures legal or regulatory compliance; this paragraph does not apply to nonpublic schools (105 ILCS 85/26(2)).for a public body

105 ILCS 85/33 · Read the law's page

• Collect a student's covered information only for K through 12 school purposes, do not process it further in a manner incompatible with those purposes, and keep it adequate, relevant, and limited to what is necessary for those purposes (105 ILCS 85/33(a) and (b)).
• If you are a school, let the parent of a student enrolled in the school inspect and review the student's covered information, whether the school, the State Board, or an operator holds it, and give a paper or electronic copy on request; give an electronic copy when asked unless you do not keep the information electronically and reproducing it would be unduly burdensome, charge no more than the State Board's schedule for a paper copy, and deny no parent a copy for inability to pay; a nonpublic school is excepted (105 ILCS 85/33(c)(1) and (2)).
• If you are a school, correct a factual inaccuracy in covered information you hold and confirm the correction with the parent within 90 calendar days after the request; if an operator or the State Board holds the information, notify it of the correction and confirm the correction with the parent within 10 business days after it confirms (105 ILCS 85/33(c)(3)).
• If you are an operator or the State Board, when a school notifies you of a correction, correct the factual inaccuracy and confirm the correction with the school within 90 calendar days after receiving the notice (105 ILCS 85/33(c)(3)(B)).

105 ILCS 85/5, 85/10 and 85/15 · Read the law's page

• If you operate a website, online service, online application or mobile application that you know is used primarily for K through 12 school purposes and was designed and marketed for those purposes, do not knowingly engage in targeted advertising on it or on any other service based on information acquired through its K through 12 school use (105 ILCS 85/10(1)).
• Do not knowingly use information your service creates or gathers to amass a profile about a student, except in furtherance of K through 12 school purposes, and do not knowingly sell or rent a student's information, including covered information (105 ILCS 85/10(2) and (3)).
• Disclose covered information only for the purposes section 10(4) lists; to disclose it to a third party, contractually prohibit the third party from using it for any other purpose and from further disclosure, and require the third party to maintain reasonable security procedures (105 ILCS 85/10(4)(F)).
• Implement and maintain reasonable security procedures and practices that meet or exceed industry standards, and delete a student's covered information within a reasonable time when the school or school district requests deletion, unless the student or parent consents to keeping it (105 ILCS 85/15(1) and (2)).
• Publicly disclose material information about your collection, use, and disclosure of covered information, including by publishing a terms of service agreement, privacy policy, or similar document (105 ILCS 85/15(3)).
• Before you receive covered information from a school, school district, or the State Board of Education, enter into a written agreement with it (a click wrap agreement qualifies; a nonpublic school is excepted) that lists the categories of covered information, states the product or service, states that you act as a school official under the Family Educational Rights and Privacy Act, allocates breach costs, requires you to delete or transfer covered information no longer needed, and requires the school to publish the agreement (105 ILCS 85/15(4)).
• Give the school a list of the third parties or affiliates to which you currently disclose or have disclosed covered information, updated by the beginning of each State fiscal year and each calendar year; a nonpublic school is excepted (105 ILCS 85/15(6)).

105 ILCS 5/10-20.75 and 5/34-18.72 · Read the law's page

• If you supply third party online curriculum that an Illinois school district makes available to enrolled students or the public through the Internet, expect the district to require it to comply with Level AA of the Web Content Accessibility Guidelines 2.1 or any revised version (105 ILCS 5/10-20.75; 105 ILCS 5/34-18.72).
• If you are an Illinois school district, require that third party online curriculum you make available to enrolled students or the public through the Internet comply with Level AA of the Web Content Accessibility Guidelines 2.1 or any revised version (105 ILCS 5/10-20.75(b); 105 ILCS 5/34-18.72(b)).

105 ILCS 5/22-110, formerly 105 ILCS 5/27-23.7 (P.A. 104-0338, eff. July 1, 2026; section renumbered by P.A. 104-0391) · Read the law's page

• This Act binds each school district, charter school, and non-public, non-sectarian elementary or secondary school through its policy on bullying; it names no duty for a software vendor or other provider.
• Create, maintain, and implement a policy on bullying that includes the statutory definition of bullying, file it with the State Board of Education, review and re-evaluate it every 2 years, and file the updated policy by September 30 of the subject year.
• Treat the posting or distribution by electronic means of an unauthorized digital replica of an individual as cyber-bullying, beginning with the 2026-2027 school year, when the posting or distribution creates any of the effects the definition of bullying lists.
• Include in the policy procedures for informing the parents or guardians of all students involved within 24 hours after the school's administration is made aware of the incident, and for promptly investigating each report, making all reasonable efforts to complete the investigation within 10 school days.

105 ILCS 10/6 and 10/9 · Read the law's page

• If you are a public school, do not release, transfer, disclose or otherwise disseminate school student records or the information in them except as section 6(a) lists, including to a person the parent has designated in prior specific dated written consent that advised the parent of the right to inspect, copy, and challenge the records (105 ILCS 10/6(a)).
• Make and keep, as part of the school student record, a record of each release stating the nature and substance of the information released, the name and signature of the official records custodian, the requester, capacity and purpose, the date, and a copy of any consent (105 ILCS 10/6(c)).
• If you receive school student records under section 6, other than as the student, a parent or, if applicable, the Department's Office of Education and Transition Services, do not permit any other person to have access to the information without the parent's prior consent obtained as section 6(a)(8) requires (105 ILCS 10/6(d)).