Law / United States / 
California
K-12 Pupil Online Personal Information Protection Act (KOPIPA)
Also known as KOPIPA, Student Online Personal Information Protection Act.
Cal. Bus. and Prof. Code sections 22584 and 22585
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Retention, Security
As of .
What it requires
- If you operate a site, service or application that you know is used primarily for K-12 school purposes and was designed and marketed for them, do not knowingly engage in targeted advertising on it, and do not target advertising elsewhere using information you acquired through its use (section 22584(b)(1)).
- Do not knowingly use information created or gathered by your site, service or application to amass a profile about a pupil, except in furtherance of K-12 school purposes (section 22584(b)(2)).
- Do not knowingly sell a pupil's information, including covered information, except in the acquisition of your company by another entity that remains bound by the section (section 22584(b)(3)).
- Disclose covered information only as section 22584(b)(4) permits, and when you disclose it to a service provider, bind the provider by contract not to use it for any other purpose, not to pass it to later third parties, and to maintain reasonable security procedures and practices (section 22584(b)(4)(E)).
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information (section 22584(d)(1)).
- Delete a pupil's covered information if the school or local educational agency requests deletion of data under its control, and delete covered information the Consumer Privacy Act does not cover when the parent or guardian, or a former pupil who is 18 or older, requests it after the pupil has been out of enrollment for at least 60 days (section 22584(d)(2) and (3)).
These lines are LexLint's reading of the law's text, as of .
What this law does
The K-12 Pupil Online Personal Information Protection Act binds the operator of an internet website, online service, online application or mobile application with actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for those purposes. Business and Professions Code section 22584(b)(1) bars an operator from knowingly engaging in targeted advertising on its site, service or application.
Section 22584(b)(2) bars an operator from knowingly using information it gathers to amass a profile about a pupil except in furtherance of K-12 school purposes. Business and Professions Code section 22584(b)(3) bars an operator from knowingly selling a pupil's information, including covered information. Under section 22584(d)(1), an operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information.
Under section 22584(d)(2)(A), an operator must delete a pupil's covered information if the school or local educational agency requests deletion of data under its control. Section 22584 does not apply to general audience internet websites, online services, online applications or mobile applications. Business and Professions Code section 22585 made the K-12 Pupil Online Personal Information Protection Act operative on . Section 22584 as currently in force was amended by Statutes 2024, chapter 935 (AB 801), effective .
When LexLint raises it
When your app profile says your app serves under-18s.