Law / United States / 
New Jersey
Online education services and student educational records: operator duties for student covered information
Online education services and student educational records, N.J. Stat. §§ 56:8-215 to 56:8-221
In force.
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Security, Retention, Disclosure
As of .
What it requires
- If you operate a website, online service, online application or mobile application used primarily for K-12 school purposes and designed and marketed for K-12 school purposes, do not knowingly use information created or gathered by your service to amass a profile about a student for any purpose other than K-12 school purposes (N.J.S.A. 56:8-216(a)(1)).
- Do not knowingly sell or rent a student's information, including covered information, subject to the exceptions in the section (N.J.S.A. 56:8-216(a)(2)).
- Do not knowingly disclose covered information unless the disclosure falls within an exception in the section, for example a disclosure to a third party you bind by contract to use it only for the contracted service, not to disclose it further, and to maintain reasonable security (N.J.S.A. 56:8-216(a)(3)).
- Do not knowingly engage in targeted advertising on your service, or on any other Internet website, online service, online computer application or mobile application, based on information your service acquired because of its use for K-12 school purposes (N.J.S.A. 56:8-216(a)(4)).
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect it from unauthorized access, destruction, use, modification or disclosure (N.J.S.A. 56:8-217(a)-(b)).
- Delete covered information at the request of a K-12 school or school district overseeing the student's education through the service, or of a student who has reached the age of majority, unless the student after reaching majority, or a parent or guardian, requests that you maintain it (N.J.S.A. 56:8-217(c)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
A violation is an unlawful practice under the Consumer Fraud Act, P.L.1960, c.39 (C.56:8-1 et seq.); the Director of the Division of Consumer Affairs in the Department of Law and Public Safety adopts the rules, in consultation with the Commissioner of Education.
What this law does
An operator is the operator of an online education service with actual knowledge that the service is used primarily for K-12 school purposes and is designed and marketed for K-12 school purposes. An online education service is an Internet website, online service, online computer application or mobile application that is used primarily for K-12 school purposes and is designed and marketed for K-12 school purposes.
P.L.2019, c.494 does not apply to general audience Internet websites, online services, online applications or mobile applications, even if login credentials created for an operator's website, service or application may be used to access them. An operator may not knowingly use information created or gathered by its service to amass a profile about a student for any purpose other than K-12 school purposes.
An operator may not knowingly sell or rent a student's information, including covered information. An operator may not knowingly disclose covered information unless the disclosure falls within one of the exceptions the section lists.
An operator may not knowingly engage in targeted advertising on its service, or on any other Internet website, online service, online computer application or mobile application if the targeted advertising is based on information its service acquired because of the use of the service for K-12 school purposes.
An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and protect that information from unauthorized access, destruction, use, modification or disclosure.
An operator must delete covered information at the request of a K-12 school or a school district overseeing the student's education through the service, or of a student who has reached the age of majority, unless the student, parent or guardian requests that the operator maintain it. Section 6 of P.L.2019, c.494 makes it an unlawful practice under the Consumer Fraud Act for an operator of an online education service to violate the act or any rule adopted under it.
P.L.2019, c.494 takes effect immediately but remains inoperative for 180 days following the date of enactment. P.L.2019, c.494 was approved on .
When LexLint raises it
When your app profile says your app serves under-18s.