Serves K-12 schools, in Georgia

O.C.G.A. Sec. 20-2-666 · Read the law's page

• Do not knowingly use student data for behaviorally targeted advertising, on your own site, service or application or on another, without the explicit written consent of the student's parent or guardian or of an eligible student (Code Section 20-2-666(a)(1)).
• Do not knowingly use information you gather, including persistent unique identifiers, to amass a profile about a student, except in furtherance of K-12 school purposes or with that consent (Code Section 20-2-666(a)(2)).
• Do not sell a student's data without that consent; an entity that acquires your company stays bound by the section for the student data it acquires (Code Section 20-2-666(a)(3)).
• Disclose student personally identifiable data only with the explicit written or electronic consent of a student over the age of 13 or the student's parent or guardian, given after clear and conspicuous notice, or under one of the exceptions in Code Section 20-2-666(a)(4)(A) to (G).
• When you disclose student data to a service provider under that exception, bind the provider by contract to use the data only for the contracted service, to impose the same restrictions on its own service providers, and to implement and maintain reasonable security procedures and practices (Code Section 20-2-666(a)(4)(F)).
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the student data to protect it from unauthorized access, destruction, use, modification or disclosure (Code Section 20-2-666(b)(1)).
• Delete a student's data within a reasonable timeframe not to exceed 45 days if the school or local board of education requests deletion of data under its control (Code Section 20-2-666(b)(2)).