Law / United States / 
California
Early Learning Personal Information Protection Act (ELPIPA)
Also known as ELPIPA.
Cal. Bus. and Prof. Code sections 22586 and 22587
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Retention, Security
As of .
What it requires
- If you operate a site, service or application that you know is used primarily for preschool or prekindergarten purposes and was designed and marketed for them, do not knowingly engage in targeted advertising on it, and do not target advertising elsewhere using information you acquired through its use (section 22586(b)(1)).
- Do not knowingly use information created or gathered by your site, service or application to amass a profile about a pupil, except in furtherance of preschool or prekindergarten purposes (section 22586(b)(2)).
- Do not knowingly sell a pupil's information, including covered information, except in the acquisition of your company by another entity that remains bound by the section (section 22586(b)(3)).
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information (section 22586(d)(1)).
- Delete a pupil's covered information if the preschool, prekindergarten or district requests deletion of data under its control (section 22586(d)(2)).
These lines are LexLint's reading of the law's text, as of .
What this law does
The Early Learning Personal Information Protection Act binds the operator of an internet website, online service, online application or mobile application with actual knowledge that it is used primarily for preschool or prekindergarten purposes and was designed and marketed for those purposes. Business and Professions Code section 22586(b)(1) bars an operator from knowingly engaging in targeted advertising on its site, service or application.
Section 22586(b)(3) bars an operator from knowingly selling a pupil's information, including covered information. Under section 22586(d)(1), an operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information. Under section 22586(d)(2), an operator must delete a pupil's covered information if the preschool, prekindergarten or district requests deletion of data under its control.
Business and Professions Code section 22587 made the Early Learning Personal Information Protection Act operative on . Section 22586 as currently in force was amended by Statutes 2024, chapter 935 (AB 801), effective .
When LexLint raises it
When your app profile says your app serves under-18s.