Law / United States / 
Kansas
Student Online Personal Protection Act, operator duties
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Security, Retention
- Audit expectation
- none
What it requires
- If your website, online service or app is used primarily, and was designed and marketed, for educational purposes and you know it, do not knowingly engage in targeted advertising on it, and do not target advertising on another educational online product using student information or persistent unique identifiers you acquired through it (section 72-6333(a)(1)).
- Do not knowingly use student information or persistent unique identifiers from the product to amass a profile about a student, except in furtherance of educational purposes (section 72-6333(a)(2)).
- Do not knowingly sell or rent student information to a third party, except as part of the assets transferred when another entity buys or merges with you, in which case the successor must comply as though it were an operator (section 72-6333(a)(3)).
- Disclose student information only for the purposes section 72-6333(a)(4) lists, and when you disclose it to a service provider, bind the provider by contract not to use it for any other purpose, not to disclose it to later third parties, and to maintain reasonable security procedures and practices (section 72-6333(a)(4)(E)).
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the student information (section 72-6333(b)(1)).
- Delete student information within a reasonable period of time when the school district asks, unless the student or the student's parent or legal guardian asks that it be kept (section 72-6333(b)(2)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
The Kansas Attorney General or any district attorney, by an action in a court of competent jurisdiction seeking injunctive relief against an operator in possession of student information (K.S.A. 72-6334).
What record it asks for
Logging duty
The Act bars targeted advertising, profiling and sale of student information and requires reasonable security and deletion on the school district's request. It names no log, no record the operator keeps, no retention period and no reader of a record, and it states no territorial clause.
- Kind
- None
- As of
What this law does
The Student Online Personal Protection Act binds an operator, meaning the operator of a website, online service or application that is used primarily, and was designed and marketed, for educational purposes, where the operator has actual knowledge of that use. The term operator does not include a school district or a school district employee acting on behalf of the district, or a national assessment provider that is administering a college and career readiness assessment.
Section 72-6333(a)(1) bars an operator from knowingly engaging in targeted advertising on its educational online product. Targeted advertising does not include advertising to a student based on the student's current visit to an online location, or in response to the student's request for information or feedback, without retaining the student's online activities or requests over time to target later advertisements.
Section 72-6333(a)(2) bars an operator from knowingly using information created or gathered through its educational online product to amass a profile about a student, except in furtherance of educational purposes. Section 72-6333(a)(3) bars an operator from knowingly selling or renting student information to a third party, except as part of the assets transferred in the purchase, merger or other acquisition of the operator.
Section 72-6333(a)(4) bars an operator from knowingly disclosing student information except for the purposes it lists, which include legitimate research under the direction of a school district or the state department of education, a request by a school district or state agency for educational purposes, disclosure to law enforcement or a court to protect the safety or integrity of users or others or the security of the product, and a request by the student or the student's parent or legal guardian for educational or employment purposes.
Section 72-6333(a)(4)(E) permits an operator to disclose student information to a service provider only if the operator contractually prohibits the provider from using it for any other purpose and from disclosing it to later third parties, and requires the provider to maintain reasonable security procedures and practices.
Section 72-6333(b) requires an operator to implement and maintain reasonable security procedures and practices, and to delete student information within a reasonable period of time on request by the school district, unless the student or the student's parent or legal guardian requests that it continue to be maintained.
Section 72-6333(c) does not prohibit an operator from using student information to maintain, develop, support, improve or diagnose its educational online product, from using or sharing student information that is not associated with an identified student to improve educational products or to demonstrate their effectiveness, from using recommendation engines to suggest related content or services within the product, or from responding to a student's request for information or feedback, provided no recommendation or response is determined in whole or in part by payment or other consideration from a third party.
Section 72-6333(d)(2) provides that the section does not limit an operator's ability to use student information for adaptive learning or customized student learning purposes. Section 72-6333(d)(3) provides that the section does not apply to general audience websites, online services, online applications or mobile applications.
Under section 72-6333(e), amassing a profile does not include the collection and retention of account information that remains under the control of the student, the student's parent or legal guardian or the school district. The Attorney General or any district attorney may sue to enjoin an operator in possession of student information from disclosing it in violation of the Act, under section 72-6334.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .