Law / United States / 
Nebraska
Student Online Personal Protection Act: operators of K-12 sites, services and applications
Student Online Personal Protection Act, Neb. Rev. Stat. §§ 79-2,153 to 79-2,155
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Security, Retention
- Audit expectation
- none
As of .
What it requires
- If you operate a website, online service, online application or mobile application you know is used primarily for elementary, middle or high school purposes and was designed and marketed for them, do not knowingly engage in targeted advertising based on information, including covered information and persistent unique identifiers, you acquired through school use of your site, service or application (Neb. Rev. Stat. 79-2,155(1)(a)).
- Do not knowingly use covered information, including persistent unique identifiers, to amass a profile about a student except in furtherance of school purposes (79-2,155(1)(b)).
- Do not knowingly sell or rent a student's covered information, except in a business acquisition where the successor complies with the section or for a national assessment provider that has the express written consent of the student or parent or guardian (79-2,155(1)(c)).
- Do not knowingly disclose covered information except for the purposes 79-2,155(1)(d) lists, including a third party you contractually bar from other uses and from further disclosure and require to maintain reasonable security procedures and practices (79-2,155(1)(d)(vi)).
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information to protect it from unauthorized access, destruction, use, modification or disclosure (79-2,155(3)(a)).
- Delete a student's covered information within a reasonable time if the school, school district or other school entity requests deletion of information under its control, unless a student or parent or guardian consents to maintaining it (79-2,155(3)(b)).
These lines are LexLint's reading of the law's text, as of .
What this law does
An operator may not knowingly engage in targeted advertising based on information, including covered information and persistent unique identifiers, acquired through the use of its site, service or application for school purposes.
An operator may not knowingly use covered information to amass a profile about a student except in furtherance of school purposes, may not knowingly sell or rent a student's covered information, and may not knowingly disclose covered information except for the purposes the section lists.
An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and must delete a student's covered information within a reasonable time when the school or school district requests deletion, unless a student or parent or guardian consents to maintenance of the information. The section does not apply to general audience websites, services or applications.
When LexLint raises it
When your app profile says your app serves under-18s.