Law / United States / 
Iowa
Student online personal information protection: operators of kindergarten through grade twelve sites, services and applications
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Security, Retention
- Audit expectation
- none
As of .
What it requires
- If you operate an internet site, online service, online application or mobile application that you know is used primarily for kindergarten through grade twelve school purposes and was designed and marketed for them, do not knowingly engage in targeted advertising based on information, including covered information and persistent unique identifiers, that you acquired through that K-12 use (Iowa Code 279.71(2)(a)(1)).
- Do not knowingly use information created or gathered by your site, service or application to amass a profile about a student except in furtherance of kindergarten through grade twelve school purposes (279.71(2)(a)(2)).
- Do not knowingly sell or rent a student's information, including covered information, other than on an acquisition of the operator by an entity that complies with the section or to a national assessment provider with the express written consent of the parent or student (279.71(2)(a)(3)).
- Do not knowingly disclose covered information except for a purpose subsection 2(a)(4) lists, such as furthering the K-12 school purpose, legal compliance, judicial process, safety or security, a school, educational or employment purpose the student or parent requests, or to a third party you bind by contract to the section's limits (279.71(2)(a)(4)).
- Implement and maintain security procedures and practices consistent with current industry standards and applicable law, appropriate to the nature of the covered information, to protect it from unauthorized access, destruction, use, modification or disclosure (279.71(3)(a)).
- Delete a student's covered information as soon as reasonably practicable when the school district or attendance center requests deletion of covered information under its control, unless the student, parent or guardian consents to keeping it (279.71(3)(b)).
These lines are LexLint's reading of the law's text, as of .
What this law does
Section 279.71 of the Iowa Code defines an operator as the operator of an internet site, online service, online application or mobile application with actual knowledge that it is used primarily for kindergarten through grade twelve school purposes and was designed and marketed for such purposes.
Section 279.71 bars an operator from knowingly engaging in targeted advertising based on information acquired through use of its site, service or application for kindergarten through grade twelve school purposes, and from knowingly using such information to amass a profile about a student except in furtherance of those purposes. Paragraph 2(a)(3) of section 279.71 lists selling or renting a student's information, including covered information, among the acts that paragraph 2(a) bars.
Paragraph 2(a)(4) of section 279.71 bars disclosure of covered information unless it is made for a purpose the paragraph lists.
Subsection 3 of section 279.71 requires an operator to implement and maintain security procedures and practices consistent with current industry standards and applicable law, and to delete a student's covered information as soon as reasonably practicable when the school district or attendance center requests deletion, unless the student or parent or guardian consents to keeping it.
Section 279.71 does not apply to general audience internet sites, online services, online applications or mobile applications, even if login credentials created for an operator's site, service or application may be used to access them. House File 2354 of the 2018 session added the student online personal information protection section to the Iowa Code.
When LexLint raises it
When your app profile says your app serves under-18s.