Law / United States / 
North Carolina
Student online privacy protection: operators of K-12 school sites, services and applications
In force since .
A sensitive categories rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Prohibition, Security, Retention
- Audit expectation
- none
What it requires
- If you operate a website, online service, online application, or mobile application that you know is used primarily for K-12 school purposes and was designed and marketed for those purposes, do not knowingly engage in targeted advertising on it, and do not target advertising elsewhere using information you acquired through its use for K-12 school purposes (G.S. 115C-401.2(b)(1)).
- Do not knowingly use information, including persistent unique identifiers, that your site, service, or application creates or gathers to amass a profile about a student, except in furtherance of K-12 school purposes (G.S. 115C-401.2(b)(2)).
- Do not knowingly sell or rent a student's information, including covered information, except in an acquisition of your company by an entity that complies with the section for information already acquired, or as a national assessment provider that secures the express written consent of the parent or of a student at least 13 years of age, given in response to clear and conspicuous notice, solely to provide access to employment, educational scholarships or financial aid, and postsecondary educational opportunities (G.S. 115C-401.2(b)(3)).
- Disclose covered information only for the purposes the section lists, and when you disclose it to a subcontractor, bind the subcontractor by contract not to use it for any purpose other than providing the contracted service, not to disclose it to subsequent third parties, and to implement and maintain reasonable security procedures and practices (G.S. 115C-401.2(b)(4)).
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect it from unauthorized access, destruction, use, modification, or disclosure (G.S. 115C-401.2(c)(1)).
- Delete a student's covered information within 45 days if the K-12 school or local board of education requests deletion or notifies you that services are complete, unless a student at least 13 years of age, a parent, or a guardian gives express written consent, in response to clear and conspicuous notice, to keeping it (G.S. 115C-401.2(c)(2)).
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
North Carolina Attorney General: may receive a report of an alleged violation from a parent, K-12 school, teacher, local board of education, or the State Board of Education, and may bring a civil action seeking injunctive and other equitable relief (G.S. 115C-401.2(g)).
What record it asks for
Logging duty
An operator may keep a student's covered information past a deletion request only on the express written consent of the student at least 13 years of age, the parent, or the guardian, and a national assessment provider may sell only on such consent, so an operator relying on either holds that written consent. The section names no log contents, no retention period for a record, no audit and no reader of a record.
- Kind
- Implicit
- As of
- Provision
- 115C-401.2(c)(2) (keeping covered information past a deletion request rests on express written consent)
- Trigger
- consent_or_optout
What this law does
Section 115C-401.2 binds an operator, meaning the operator of a website, online service, online application, or mobile application with actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for those purposes.
An operator may not knowingly engage in targeted advertising on its own site, service, or application, or target advertising on any other site, service, or application based on information it acquired because of the use of its site, service, or application for K-12 school purposes. An operator may not knowingly use information, including persistent unique identifiers, to amass a profile about a student except in furtherance of K-12 school purposes.
An operator may not knowingly sell or rent a student's information, including covered information.
An operator may disclose covered information to a subcontractor if the operator contractually prohibits the subcontractor from using any covered information for any purpose other than providing the contracted service, prohibits the subcontractor from disclosing covered information to subsequent third parties, and requires the subcontractor to implement and maintain reasonable security procedures and practices.
An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information and protect it from unauthorized access, destruction, use, modification, or disclosure.
An operator must delete a student's covered information within 45 days if the K-12 school or local board of education requests deletion or notifies the operator of completion of services, unless a student at least 13 years of age, a parent, or a guardian gives express written consent to keeping it. The section does not apply to general audience websites, online services, online applications, or mobile applications.
A parent, K-12 school, teacher, local board of education, or the State Board of Education may report an alleged violation to the Attorney General, who may bring a civil action seeking injunctive and other equitable relief, and the section creates no private right of action. Session Law 2016-11 enacted the section and became effective on .
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .