Law / United States / 
Pennsylvania
Senate Bill 378, Student Data Privacy and Protection Act, limits on a third party's use of student data, biometric identifiers and targeted marketing
Pa. S.B. 378, secs. 524, 525, 527 (PN 1528)
In committee, dated , as of .
A sensitive categories rule binding public and private bodies.
Where it has got to
The text described here is Printer's Number 1528, as amended in the Senate Education Committee. That print is PN 1528, published .
Locally, this stage is reported as amended from the Senate Education Committee, first consideration, laid on the table.
The stage above is recorded at www.palegis.us.
Referred to the Senate Education Committee on (Printer's No. 240). Reported as amended (Printer's No. 1528) and given first consideration on . Laid on the table pursuant to Senate Rule 9 on . No later action recorded. The 2025-2026 session runs through .
What it requires
- Senate Bill 378 (Printer's No. 1528) is a pending bill and does not currently bind anyone; the lines below describe what it would ask if enacted in that form.
- If you contract with a public school district, charter school, regional charter school, cyber charter school, intermediate unit or area career and technical school, use personally identifiable student data received under the contract strictly to provide the contracted product or service, unless a student or the student's parent affirmatively chooses to disclose it for a secondary purpose (proposed section 527(a)).
- Do not use student data or information from an educational record obtained under that contract to conduct targeted marketing, to sell it, or to exchange it for goods, services or applications (proposed section 527(b)(1), (3) and (4)).
- Do not create a student profile from that data except as the contract with the educational entity allows or in furtherance of the educational entity's purposes (proposed section 527(b)(2)).
- Do not disclose student data or information from an educational record except as the chapter provides, and do not impede a student or parent from downloading, exporting or saving the student's data (proposed section 527(b)(5) and (6)).
- Do not collect a biometric identifier on a student, such as a retina or iris scan, fingerprint, voice print or facial geometry, except as required by law (proposed section 524).
- Do not release or use student data for targeted marketing unless the release is absolutely necessary for education progression (proposed section 525).
These lines are LexLint's reading of the law's text.
What this law does
As reported from the Senate Education Committee (Printer's No. 1528), Senate Bill 378 would add Chapter 5 to Part I of Title 24 and limit what a third party may do with student data, a third party being a person that contracts with an educational entity to provide a good or service, including a subcontractor.
A third party would have to use personally identifiable student data received under the contract strictly to provide the contracted product or service, unless a student or the student's parent affirmatively chooses to disclose it for a secondary purpose.
A third party could not conduct targeted marketing, create a student profile except as the contract allows or in furtherance of the educational entity's purposes, sell student data or information from an educational record, exchange it for goods, services or applications, or disclose it except as the chapter provides. An educational entity or third party could not collect a biometric identifier on a student except as required by law.
The prohibited uses listed in section 527(b) do not apply to nonprofit organizations engaging in activities to provide students with higher education, scholarship or other educational opportunities, and under section 530 the chapter would not apply to nonprofit organizations using student data for legitimate educational interests, including activities to provide students higher education and scholarship opportunities.
Targeted marketing, as the bill defines it, does not include advertising to a student at an online location based on the student's current visit to that location or a single search query without collection and retention of the student's online activities over time.
Section 527(d) would let a third party use student data for adaptive learning or customized student learning purposes and to allow or improve the operability and functionality of its internal application, recommend content or services relating to learning or employment within its internal application where the recommendation is not motivated by payment or other consideration from another party, market an educational application or product to a parent or guardian if it did not use student data to develop the product, and disclose and use personally identifiable information and aggregate student data solely for research purposes compatible with the context in which the information was collected.
A third party would share student data as requested by law enforcement, as authorized by law or court order (section 529). The chief data privacy officer within the Department of Education could investigate compliance with the chapter and would have access to all records, reports, audits, reviews, documents, papers, recommendations and other materials available to the educational entity or third party under investigation (section 511(c)).
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .