Law / United States / California

AB 1159 (2026), student personal information (KOPIPA, ELPIPA and the Higher Education Student Information Protection Act)

AB 1159 (Ch. 182, Stats. 2026), Cal. Bus. and Prof. Code Sections 22584 to 22587.2

A sensitive categories rule binding private bodies.

Obligation class

Prohibition, Retention, Security

As of 17 October 2026.

What it requires

• If you operate a site, service or application, or work on behalf of an operator, that you know is used for K-12 school purposes and that is designed or marketed for them, do not engage in targeted advertising on it, and do not target advertising elsewhere using information you acquired through its use (Business and Professions Code Section 22584(a)(10), (b)(1)).NIST Privacy FrameworkCT.PO-P1
• Do not use covered information, including persistent unique identifiers, created or gathered by your site, service or application to train a generative artificial intelligence system or service or to develop an artificial intelligence system (Section 22584(b)(5)).NIST Privacy FrameworkCT.PO-P1
• Do not collect, use, retain or disclose covered information relating to a pupil's reproductive or sexual health, immigration status, or sexual orientation or gender identity (Section 22584(b)(6)).NIST Privacy FrameworkCT.PO-P1
• Do not use covered information to amass a profile about a pupil except in furtherance of K-12 school purposes, and do not sell a pupil's information except in an acquisition of your company or under a written contract that meets the section's conditions (Section 22584(b)(2), (3)).NIST Privacy FrameworkCT.PO-P1
• Disclose covered information only as Section 22584(b)(4) permits, and when you disclose it to a service provider, bind the provider by contract not to use it for any other purpose, not to disclose it to later third parties, and to maintain reasonable security procedures and practices (Section 22584(b)(4)(E)).NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkID.DE-P3
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information (Section 22584(d)(1)).NIST Privacy FrameworkPR.DS-P5
• Delete a pupil's covered information when the school or local educational agency requests deletion, and delete a former pupil's covered information that the California Consumer Privacy Act does not cover when the parent, education rights holder or guardian, or the former pupil if 18 or older, requests it and the pupil has been out of enrollment for at least 60 days (Section 22584(d)(2), (3)).NIST Privacy FrameworkCT.PO-P3
• Retain covered information only as long as reasonably necessary for the purpose it was collected, and keep a written data retention policy, available on request to a pupil, parent, guardian, education rights holder or K-12 personnel, stating the purposes, the retention purpose and a deletion timeframe (Section 22584(d)(4), (5)).NIST Privacy FrameworkGV.PO-P1NIST Privacy FrameworkCT.DM-P5
• If your service is used for preschool or prekindergarten purposes, Section 22586 sets parallel prohibitions and duties, and bars any sale of a child's information other than in an acquisition of your company (Section 22586(b)(3)).NIST Privacy FrameworkCT.PO-P1
• If your service is used for higher education purposes, Section 22587 sets parallel prohibitions and duties from July 1, 2027, and also bars collecting, using, retaining or disclosing a student's precise geolocation information (Sections 22587(b)(6), 22587.2).NIST Privacy FrameworkCT.PO-P1

These lines are LexLint's reading of the law's text, as of 17 October 2026.

In the frameworks

NIST AI RMF

• MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.

NIST Privacy Framework

• ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
• GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
• CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
• CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
• CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
• CT.DM-P5Data are destroyed according to policy.

1 more

• PR.DS-P5Protections against data leaks are implemented.

NIST CSF 2.0

• GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
• ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
• PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected

FINOS AIGF

• AIR-PREV-005System Acceptance Testing
• AIR-PREV-007Legal and Contractual Frameworks for AI Systems
• AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
• AIR-PREV-012Role-Based Access Control for AI Data
• AIR-PREV-014Encryption of AI Data at Rest
• AIR-PREV-017AI Firewall Implementation and Management

4 more

• AIR-PREV-020MCP Server Security Governance
• AIR-DET-001AI Data Leakage Prevention and Detection
• AIR-DET-004AI System Observability
• AIR-DET-021Agent Decision Audit and Explainability

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

If you get it wrong

Who enforces it

When LexLint raises it

When your app profile says your app serves under-18s or trains models.

Back to the example  ·  Lint your app