Student Online Personal Protection Act: operator prohibitions and duties

The Student Online Personal Protection Act binds the operator of an Internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K through 12 school purposes and was designed and marketed for K through 12 school purposes.

Section 10 bars an operator from knowingly engaging in targeted advertising on its own or any other service when the targeting is based on information the operator acquired because of the use of its service for K through 12 school purposes. Section 10 bars an operator from knowingly using information created or gathered by its service to amass a profile about a student, except in furtherance of K through 12 school purposes.

Section 10 bars an operator from knowingly selling or renting a student's information, including covered information. The sale bar does not apply to the purchase, merger, or other acquisition of an operator by another entity if the operator or successor entity complies with the Act regarding previously acquired student information.

Except as section 20 provides, section 10 bars an operator from knowingly disclosing covered information unless the disclosure furthers the K through 12 school purposes of the service, ensures legal and regulatory compliance or guards against liability, responds to judicial process, protects the safety or integrity of users or the security of the service, serves a school, educational, or employment purpose the student or parent requests, or is made to a third party under section 10(4)(F).

Section 10 permits an operator to disclose covered information to a third party if the operator contractually prohibits the third party from using it for any other purpose, prohibits further disclosure, and requires the third party to maintain security procedures as section 15 requires. Section 10 does not prohibit an operator's use of information for maintaining, developing, supporting, improving, or diagnosing its site, service, or application.

Section 20 permits an operator to use or disclose a student's covered information where federal or State law requires the disclosure, for legitimate research purposes that State or federal law requires or allows if the information is not used for advertising or to amass a profile for purposes other than K through 12 school purposes, and to a State or local educational agency, including schools and school districts, for K through 12 school purposes as State or federal law permits.

Section 25 does not prohibit an operator from using covered information that is not associated with an identified student to improve educational products or to demonstrate the effectiveness of its products or services, or from recommending educational, learning, or employment content or services that are not determined by payment or other consideration from a third party.

Section 15 requires an operator to implement and maintain reasonable security procedures and practices that meet or exceed industry standards. Section 15 requires an operator to delete a student's covered information within a reasonable time when the school or school district requests deletion, unless a student or his or her parent consents to keeping it.

Section 15 requires an operator to publicly disclose material information about its collection, use, and disclosure of covered information, including by publishing a terms of service agreement, privacy policy, or similar document. Section 15 requires an operator that seeks covered information from a school, school district, or the State Board of Education to enter into a written agreement with it before the information is transferred, except for a nonpublic school.

Any written agreement entered into, amended, or renewed must list the categories of covered information, state the product or service, state that the operator acts as a school official under the Family Educational Rights and Privacy Act, describe how breach costs will be allocated, and state that the operator must delete or transfer covered information that is no longer needed.

The agreement must also state that the school will publish it on its website or, without a website, make it available for public inspection at its administrative office, and the school and operator may agree to redact provisions other than the listing of covered information, the product or service, and the school official statement. The written agreement may be created in electronic form and signed with an electronic or digital signature, or may be a click wrap agreement.

Section 15 requires an operator, except for a nonpublic school, to give the school a list of the third parties or affiliates to which it currently discloses or has disclosed covered information, updated at the beginning of each State fiscal year and each calendar year. The Act does not apply to general audience Internet websites, online services, online applications, or mobile applications, even if login credentials created for an operator's service may be used to access them.

Violations are unlawful practices for which the Attorney General may take appropriate action under the Consumer Fraud and Deceptive Business Practices Act. Section 10 was last amended by Public Act 101-516, effective July 1, 2021.