Law / United States / 
Florida
Student Online Personal Information Protection Act
Officially Student Online Personal Information Protection Act: operators of K-12 sites, services and applications
In force since .
A sensitive categories rule binding public and private bodies.
- Enforcement body
- Florida Department of Legal Affairs
- Obligation class
- Prohibition, Security, Retention
- Audit expectation
- none
As of .
What it requires
- If you operate a website, online service, online application or mobile application that you know is used primarily for K-12 school purposes, or that is designed and marketed for those purposes, do not knowingly use persistent identifiers or covered information to target advertising on your service or any other.
- Do not use covered information to amass a profile of a student except in furtherance of K-12 school purposes, and do not share, sell or rent a student's information, including covered information.
- Disclose covered information only for the purposes the section lists, such as furthering the K-12 school purpose without onward disclosure, complying with law or a court order, or to a third party bound by contract to use it only for the contracted service, not to disclose it further, and to maintain reasonable security.
- Collect no more covered information than is reasonably necessary, maintain reasonable security procedures and practices, and, unless a parent or guardian expressly consents to retention, delete covered information at the end of the course or program and within 90 days after the student is no longer enrolled in a school within the district, upon notice by the school district.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 1006.1494(7) makes a violation a violation of the Florida Deceptive and Unfair Trade Practices Act, part II of chapter 501. Section 501.2075 of that part sets a civil penalty of not more than $10,000 for each willful violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
What this law does
Section 1006.1494 binds an operator of an Internet website, online service, online application or mobile application with actual knowledge that it is used primarily for K-12 school purposes, or that was designed and marketed for K-12 school purposes.
Under section 1006.1494, an operator may not knowingly engage in targeted advertising based on information acquired through the K-12 service, use covered information to amass a profile of a student except in furtherance of K-12 school purposes, share, sell or rent a student's information, or disclose covered information except for the purposes the section lists.
Under section 1006.1494, an operator must collect no more covered information than is reasonably necessary, maintain reasonable security procedures and practices, and, unless a parent or guardian expressly consents to retention, delete covered information at the conclusion of the course or program and no later than 90 days after the student is no longer enrolled in a school within the district, upon notice by the school district.
Section 1006.1494 does not apply to general audience Internet websites, online services, online applications or mobile applications. A violation of section 1006.1494 is a deceptive and unfair trade practice under the Florida Deceptive and Unfair Trade Practices Act, and the Department of Legal Affairs is the sole entity authorized to bring an enforcement action.
When LexLint raises it
When your app profile says your app serves under-18s.