Law / United States / 
Arizona
Student data privacy: duties of an operator of a site, service or application used for school purposes
In force since .
A sensitive categories rule binding private bodies.
- Enforcement body
- Arizona Attorney General
- Obligation class
- Prohibition, Security, Retention
- Audit expectation
- none
What it requires
- If you operate a website, online service, online application or mobile application that you know is used primarily for school purposes and was designed and marketed for school purposes, do not knowingly engage in targeted advertising on it or on any other site, service or application based on information, including persistent unique identifiers, you acquired because of its use for school purposes (A.R.S. 15-1046(A)(1)).
- Do not knowingly use information created or gathered by your site, service or application to amass a profile about a student except in furtherance of school purposes, and do not knowingly sell or rent a student's information, including covered information (A.R.S. 15-1046(A)(2) and (3)).
- Disclose or use covered information only for a purpose section 15-1046(A)(4) permits; to disclose it to a third party, contractually prohibit the third party from using it for any purpose other than providing the contracted service, prohibit onward disclosure to subsequent third parties, and require the third party to implement and maintain reasonable security procedures and practices (A.R.S. 15-1046(A)(4)(f)).
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, designed to protect it from unauthorized access, destruction, use, modification or disclosure (A.R.S. 15-1046(C)(1)).
- Delete a student's covered information within a reasonable time period if the public school requests deletion of covered information under the control of the public school, unless the student or the student's parent or guardian consents to its maintenance (A.R.S. 15-1046(C)(2)).
- Give prominent notice before making material changes to your privacy policies (A.R.S. 15-1046(C)(3)).
These lines are LexLint's reading of the law's text.
What record it asks for
Logging duty
Section 15-1046 prohibits specified uses of covered information and requires security procedures, deletion on a school's request and notice of privacy policy changes. The section names no duty to create, keep or produce a log or record.
- Kind
- None
- As of
What this law does
Section 15-1046 binds an operator, meaning the operator of an internet website, online service, online application or mobile application with actual knowledge that it is used primarily for school purposes and was designed and marketed for school purposes. An operator may not knowingly engage in targeted advertising on any site, service or application based on information it acquired because of the use of its site, service or application for school purposes.
An operator may not sell or rent a student's information, including covered information. An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information. An operator must delete a student's covered information within a reasonable time period if the public school requests deletion, unless the student or the student's parent or guardian consents to the maintenance of the covered information.
The section does not apply to general audience internet websites, online services, online applications or mobile applications. A violation is an unlawful practice under section 44-1522, and the attorney general may investigate and take appropriate action. Senate Bill 1314, chapter 180 of the Laws of 2017, added section 15-1046.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .