Serves schools or universities, in Michigan

MCL 380.1704(4), (5) · Read the law's page

• If you publish a textbook that a Michigan school district has adopted for instructional use, furnish the department an electronic version of it on request when the book is for a literary subject, or for a nonliterary subject when technology exists to convert it directly to a format compatible with Braille translation software (MCL 380.1704(5)).
• Do not charge more for that electronic version than you charge for the print or electronic media version of the textbook (MCL 380.1704(5)).

MCL 390.1541 to 390.1543 · Read the law's page

• If you publish a textbook that a Michigan college or university, public or private, including a junior or community college, has adopted for instructional use, furnish the college or university an electronic version of it on request when the book is for a literary subject, or for a nonliterary subject when technology exists to convert it directly to a format compatible with braille translation software (MCL 390.1543).
• Do not charge more for that electronic version than you charge for the print or electronic media version of the textbook (MCL 390.1543).

MCL 37.272, 37.274, 37.276 to 37.278 · Read the law's page

• If you are an educational institution (a public or private school, school district, school system or other institution, or its agent), do not request a student or prospective student to grant access to, allow observation of, or disclose information that allows access to or observation of a personal internet account (MCL 37.274(a)).
• Do not expel, discipline, fail to admit or otherwise penalize a student or prospective student for refusing to grant, allow or disclose access to a personal internet account (MCL 37.274(b)).
• If you act as an agent of an educational institution, the same prohibitions bind you, because the Act defines an educational institution to include its agent (MCL 37.272(b)).

MCL 380.1136 · Read the law's page

• If you are a school district, intermediate school district, public school academy, educational management organization or authorizing body, do not sell or otherwise provide to a for-profit business entity any personally identifiable information that is part of a pupil's education records, except to an educational management organization under a management agreement, as necessary for standardized testing, or as necessary to a person providing educational or educational support services to the pupil under a contract (MCL 380.1136(2)(a)).for a public body
• If you are an educational management organization that receives pupil education records, do not sell or otherwise provide them to any other person except as section 1136 permits (MCL 380.1136(4)).
• If you are the department or the center for educational performance and information (CEPI), do not sell any information that is part of a pupil's education records, and ensure any contract that gives a vendor access to education records requires the vendor to protect their privacy and sets express penalties for noncompliance (MCL 380.1136(1)(a) and (e)).for a public body
• If you are the department or CEPI, keep posted on your website an inventory of all pupil data elements you collect with a description of each, post a notice of any additional pupil data element at least 30 days before you begin collecting it, with the reasons, and disclose pupil information only under a publicly available policy that states the criteria for disclosure (MCL 380.1136(1)(b) to (d)).when it serves a public body
• If you are the department or CEPI and you provide a pupil's personally identifiable education-record information to anyone other than the pupil's school, district, authorizing body, preschool, postsecondary institution or parent, tell the parent of a pupil under 18 or a tax dependent, on written request, within 30 days and without charge, the data fields disclosed, each recipient and the reason (MCL 380.1136(1)(f), (g)).when it serves a public body
• If you are a school district, intermediate school district, public school academy or authorizing body, disclose to a pupil's parent or legal guardian, within 30 days of a written request and without charge, the personally identifiable information you hold about the pupil and, subject to the exemptions in subsection (3), the specific information disclosed, each recipient and the reason for the disclosure (MCL 380.1136(2)(b) to (d)).when it serves a public body
• If you are a school district, intermediate school district, public school academy or authorizing body, develop a list of directory-information uses and an opt-out form, present the form to each pupil's parent or legal guardian within the first 30 days of the school year, and leave out of the opted-out uses the directory information of a pupil whose parent or guardian signs the form (MCL 380.1136(6)).for a public body
• Do not disclose the confidential address of a pupil if the pupil or the pupil's parent or legal guardian has obtained an address confidentiality program participation card and the parent or legal guardian gives notice in the form and manner the department prescribes (MCL 380.1136(7)).for a public body

MCL 388.1291, 388.1293, 388.1295 · Read the law's page

• If you operate a website, online service or app that you know is used primarily for K-12 school purposes and was designed and marketed for those purposes, do not engage in targeted advertising on that service, and do not target advertising on any other service based on information you acquired through its K-12 school use (MCL 388.1295(1)(a)).
• Do not use information created or gathered by that service to amass a profile about a student except in furtherance of K-12 school purposes (MCL 388.1295(1)(b)).
• Do not sell or rent a student's information, including covered information, other than in the purchase, merger or other acquisition of your business by another entity that complies with the Act for previously acquired student information (MCL 388.1295(1)(c)).
• Disclose covered information only for the purposes MCL 388.1295(1)(d) lists or in the circumstances MCL 388.1295(3) allows, and pass it to a service provider only under a contract that bars other uses, bars onward disclosure and requires reasonable security procedures and practices (MCL 388.1295(1)(d)(vi)).
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information (MCL 388.1295(2)(a)).
• Delete a student's covered information when the K-12 school or school district asks you to delete covered information under its control (MCL 388.1295(2)(b)).