Law / United States / 
Tennessee
Student Online Personal Protection Act: operators of K-12 online services
Tenn. Code Ann. secs. 49-1-702, 49-1-708
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Security, Retention
- Audit expectation
- none
As of .
What it requires
- As the operator of an Internet web site, online service, online application, or mobile application that you know is used primarily for K-12 school purposes and is designed and marketed for K-12 school purposes, do not knowingly engage in targeted advertising on your site, service, or application, or target advertising on any other site, service, or application based on information, including covered information and persistent unique identifiers, you acquired because of its use for K-12 school purposes (section 49-1-708(a)(1)).
- Do not knowingly use information, including persistent unique identifiers, created or gathered by your site, service, or application to amass a profile about a student except in furtherance of K-12 school purposes (section 49-1-708(a)(2)).
- Do not knowingly sell or rent a student's information, including covered information (section 49-1-708(a)(3)).
- Do not knowingly disclose covered information unless the disclosure is made in furtherance of the K-12 school purpose of your site, service, or application, to ensure legal and regulatory compliance or protect against liability, to respond to or participate in the judicial process, to protect the safety or integrity of users or the security of your site, service, or application, for a school, educational, or employment purpose requested by the student or the student's parent or guardian, or to a third party that you contractually bar from using covered information for any other purpose or from further disclosing it and that must maintain reasonable security procedures and practices (section 49-1-708(a)(4)).
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, designed to protect it from unauthorized access, destruction, use, modification, or disclosure (section 49-1-708(c)(1)).
- Delete a student's covered information within a reasonable time if the K-12 school or local education agency requests deletion of covered information under its control, unless a student or parent or legal guardian consents to its maintenance (section 49-1-708(c)(2)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Attorney general and reporter, who alone enforces the section in the attorney general's discretion as an unfair or deceptive act or practice under the Tennessee Consumer Protection Act of 1977 (section 49-1-708(g)(1)).
Settledness
- As of
What this law does
House Bill 1931, assigned Public Chapter Number 757 by the Secretary of State, enacts the Student Online Personal Protection Act and amends title 49 of the Tennessee Code. The Student Online Personal Protection Act defines an operator as the operator of an Internet web site, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K-12 school purposes and is designed and marketed for K-12 school purposes.
The Student Online Personal Protection Act defines covered information as personally identifiable information or material, or information linked to it, in any media or format that is not publicly available and is created by or provided to an operator by a student or the student's parent or legal guardian, created by or provided to an operator by an employee or agent of a K-12 school or a local education agency, or gathered by an operator through its site, service, or application for K-12 school purposes and personally identifies a student.
Section 3(a)(1) of the Student Online Personal Protection Act bars an operator from knowingly engaging in targeted advertising on its site, service, or application, or targeting advertising on any other site, service, or application based on any information, including covered information and persistent unique identifiers, that the operator has acquired because of the use of its site, service, or application for K-12 school purposes.
Section 3(a)(2) of the Student Online Personal Protection Act bars an operator from knowingly using information, including persistent unique identifiers, created or gathered by its site, service, or application to amass a profile about a student except in furtherance of K-12 school purposes. Section 3(a)(3) of the Student Online Personal Protection Act bars an operator from knowingly selling or renting a student's information, including covered information.
Section 3(a)(4) of the Student Online Personal Protection Act bars an operator from knowingly disclosing covered information unless the disclosure falls within the listed grounds, such as furtherance of the K-12 school purpose, legal and regulatory compliance, the judicial process, protecting safety or security, a school, educational, or employment purpose requested by the student or parent, or a third party that the operator contractually bars from using the information for any other purpose.
Section 3(c) of the Student Online Personal Protection Act requires an operator to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and to delete a student's covered information within a reasonable time if the K-12 school or local education agency requests deletion, unless a student or parent or legal guardian consents to its maintenance.
Section 3(g)(1) of the Student Online Personal Protection Act provides that any violation of the section constitutes an unfair or deceptive act or practice affecting the conduct of trade or commerce under the Tennessee Consumer Protection Act of 1977 and shall be enforced solely by the attorney general and reporter in the attorney general's discretion.
Section 3(g)(2) of the Student Online Personal Protection Act provides that in an action brought by the attorney general the court may award or impose any relief available under the Tennessee Consumer Protection Act of 1977. Section 4 of the Student Online Personal Protection Act provides that the act takes effect . Public Chapter 757 was signed by the Governor on . The House adopted Amendment 1 (HA0885) on .
The Senate substituted the House bill for its companion bill and passed it on . Amendment 1 (SA0883) to SB1900, the companion Senate bill, was withdrawn on . Education Administration and Planning Amendment 1 to HB1931 deletes all language after the caption and substitutes the Student Online Personal Protection Act.
Section 49-1-708 of the Tennessee Code, in the May 2021 archive copy, is headed Student online personal protection act and opens with the prohibition that an operator shall not knowingly engage in targeted advertising on the operator's site, service, or application. The history note of section 49-1-708 in the May 2021 archive copy of the Tennessee Code lists Acts 2016, chapter 757, section 3.
When LexLint raises it
When your app profile says your app serves under-18s.