Student Data Privacy, Accessibility, and Transparency Act, restrictions on operators

The operator provisions bind an entity that runs a website, online service, online application or mobile application with actual knowledge that it is used for K-12 school purposes and was designed and marketed for those purposes, to the extent it operates in that capacity, and that collects, maintains or uses student personally identifiable information in digital or electronic form.

Student data is information about a K-12 student who is a resident of Georgia, collected and maintained at the individual student level, including the student's name, contact details, identifiers, assessment results, transcript, attendance, sex, race and ethnicity, disability status, socioeconomic information, food purchases, and emails, text messages, documents, search activity, photos, voice recordings and geolocation information, and it includes what a student, parent or school employee creates or provides to an operator, or an operator gathers, through use of its site, service or application for K-12 school purposes.

Without the explicit written consent of the student's parent or guardian, or of an eligible student, an operator may not knowingly use student data for behaviorally targeted advertising, whether on its own site, service or application or on another. Targeted advertising does not include advertising to a student at an online location based on the student's current visit to that location or a single search query, without collection and retention of the student's online activities over time.

Under the same consent rule, an operator may not knowingly use information it gathers, including persistent unique identifiers, to amass a profile about a student except in furtherance of K-12 school purposes. Under the same consent rule, an operator may not sell a student's data, and the prohibition does not apply to the purchase, merger or other acquisition of an operator by another entity.

An operator may not disclose student personally identifiable data without explicit written or electronic consent from a student over the age of 13 or a student's parent or guardian, given in response to clear and conspicuous notice, unless a disclosure exception in the paragraph applies.

An operator may disclose student personally identifiable data to a service provider under that exception only if the operator contractually prohibits the provider from using the data for any purpose other than the contracted service, requires the provider to impose the same restrictions on its own service providers, and requires the provider to implement and maintain reasonable security procedures and practices.

An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the student data to protect it from unauthorized access, destruction, use, modification or disclosure. An operator must delete a student's data within a reasonable timeframe not to exceed 45 days if the school or local board of education requests deletion of data under its control.

Notwithstanding the consent rule for disclosure, and so long as it does not engage in targeted advertising, profiling or sale, an operator may disclose student data where another federal or state law requires it, for legitimate research as state or federal law requires or allows, or to a state agency, local board of education or school for K-12 school purposes as state or federal law permits.

The section does not stop an operator from using student data, including personally identifiable data, to maintain, deliver, develop, support, evaluate, improve or diagnose its site, service or application, within its other sites intended for school or student use to evaluate and improve educational products, for adaptive or customized learning, for recommendation engines and responses to a student's request that are not determined by payment from a third party, or to ensure legal or regulatory compliance.

An operator may also use or share aggregate or de-identified data to develop and improve its own or other educational sites, services or applications and to demonstrate the effectiveness of its products or services, including in their marketing. The section does not apply to general audience Internet websites, online services, online applications or mobile applications, even if login credentials created for an operator's site, service or application may be used to access them.

The section imposes no duty on the provider of an app store or other electronic marketplace to review or enforce the compliance of the applications it offers, or on a provider of an interactive computer service as defined in Section 230 of Title 47 of the United States Code to review or enforce compliance by third-party content providers.

The Act took effect on July 1, 2016, and a provision of it that conflicts with a term of a contract in effect before that date does not apply to the parties to that contract until the contract expires or is amended or renewed.