Law / United States / 
Pennsylvania
House Bill 2785, required student data terms in a school entity's contract with a provider of artificial intelligence-related technology
Pa. H.B. 2785, sec. 807.2 (PN 4005)
In committee, dated , as of .
A sensitive categories rule binding public and private bodies.
Where it has got to
The text described here is Printer's Number 4005, as reported from the House Committee on Education, as amended. That print is PN 4005, published .
Locally, this stage is reported as amended from the House Education Committee, first consideration, laid on the table.
The stage above is recorded at www.palegis.us.
Introduced as Printer's No. 3917 and referred to the House Education Committee on . Reported as amended (Printer's No. 4005), given first consideration and laid on the table on . No later action recorded. The 2025-2026 session runs through .
What it requires
- House Bill 2785 (Printer's No. 4005) is a pending bill and does not currently bind anyone; the lines below describe what it would ask if enacted in that form.
- If you are a school entity that contracts with a third party providing artificial intelligence-related technology, programs or platforms, require the contract to bind the third party to all applicable Federal and State privacy and security laws, including FERPA, the Children's Internet Protection Act and the Children's Online Privacy Protection Act (proposed section 807.2(a)(1)).
- If you are such a school entity, require the contract to prohibit the sale and rental of data containing personally identifiable information of a student or school employe, and its use or disclosure to train, refine or build foundation models (proposed section 807.2(a)(2) and (3)).
- If you are such a school entity, require the contract to bind you and the third party to security measures that reasonably prevent unauthorized collection, disclosure and retention of that data, and to prohibit collection of a student's biometric information through the technology except as the law requires (proposed section 807.2(a)(4) and (5)).
- If you are such a school entity, require the contract to set procedures for the third party to permanently delete all sensitive data within 90 days of contract termination or your request, and to notify you of a breach of the security of data (proposed section 807.2(a)(6) and (7)).
- If you are a third party providing artificial intelligence-related technology, programs or platforms procured by a school entity, report to the Department of Education your contact information, each school entity you serve, the name and a brief description of each artificial intelligence-related program, platform or other technology you provide, including whether it is explicitly designed for educational use and whether it uses generative artificial intelligence, synthetic content, artificial intelligence chatbots or other artificial intelligence systems, and an attestation that each meets the contract terms (proposed section 807.2(c)).
These lines are LexLint's reading of the law's text.
What this law does
As reported from the House Education Committee (Printer's No. 4005), House Bill 2785 would add section 807.2 to the Public School Code of 1949 and require a school entity, meaning a school district, area career and technical school, intermediate unit, cyber charter school, charter school or regional charter school, that contracts with a third party providing artificial intelligence-related technology, programs or platforms to include seven terms in the contract.
The terms require compliance with Federal and State privacy and security laws including FERPA, the Children's Internet Protection Act and COPPA, bar the sale and rental of student and school employe personally identifiable information and its use to train, refine or build foundation models, require security measures, bar collection of a student's biometric information through the technology except as the law requires, require deletion of sensitive data within 90 days of contract termination or request, and require breach notice to the school entity.
The bill would also require each such third party to report its contact information, the school entities it serves and an attestation of compliance to the Department of Education. A third party is a for-profit or not-for-profit service provider that contracts with a school entity to provide instructional or noninstructional services, and the term does not include an individual.
The section would apply to contracts entered into on or after its effective date, the bill would take effect immediately, and the Department of Education would post guidelines for school entities and third parties within 180 days and review them annually.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .