Law / United States / 
Texas
Texas student information: duties of operators of websites and applications used for a school purpose
Tex. Educ. Code secs. 32.151 to 32.157
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Security, Retention, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you operate a website, online service, online application or mobile application that you know is used primarily for a school purpose and was designed and marketed for one, do not knowingly engage in targeted advertising on any service based on information you acquired through that school use (Tex. Educ. Code sec. 32.152(a)(1)).
- Do not use information created or gathered by your service to create a profile about a student unless the profile is created for a school purpose (Tex. Educ. Code sec. 32.152(a)(2)).
- Do not sell or rent any student's covered information, except as section 32.152(c) provides (Tex. Educ. Code sec. 32.152(a)(3)).
- If you disclose covered information to a third party that provides a service for a school purpose on your behalf, contract with the third party to prohibit any other use of the information and require it to implement and maintain reasonable procedures designed to prevent disclosure (Tex. Educ. Code sec. 32.153(d)).
- Implement and maintain reasonable security procedures and practices designed to protect covered information from unauthorized access, deletion, use, modification or disclosure (Tex. Educ. Code sec. 32.155(a)).
- If a school district requests deletion of a student's covered information under its control, delete it not later than the 60th day after the request, or as the contract or terms of service specify, unless the student or parent consents to your maintaining it (Tex. Educ. Code sec. 32.156).
These lines are LexLint's reading of the law's text, as of .
What this law does
An operator is the operator of a website, online service, online application or mobile application, to the extent operating in that capacity, with actual knowledge that it is used primarily for a school purpose and was designed and marketed for a school purpose.
Covered information is personally identifiable information, or information linked to it, that is not publicly available and that a student or parent provides to an operator, an employee of a school district or campus provides to an operator, or an operator gathers, for a school purpose and that personally identifies a student.
An operator may not knowingly engage in targeted advertising based on information acquired through the school use of its service, use information it creates or gathers to create a profile about a student unless the profile is created for a school purpose, or, except as section 32.152(c) provides, sell or rent any student's covered information.
An operator may disclose covered information to a third party it has contracted with to provide a service for a school purpose, and the contract must prohibit the third party from using covered information for any other purpose and the operator must require the third party to implement and maintain reasonable procedures and practices designed to prevent disclosure.
An operator must implement and maintain reasonable security procedures and practices designed to protect any covered information from unauthorized access, deletion, use, modification or disclosure.
If a school district requests deletion of a student's covered information under its control and maintained by the operator, the operator must delete it not later than the 60th day after the request, or as the contract or terms of service specify, unless the student or the student's parent consents to the operator's maintenance of the information. Subchapter D does not apply to general audience websites, online services, online applications or mobile applications.
Subchapter D was added by Acts 2017, 85th Legislature, chapter 355 (House Bill 2087), effective . Section 32.155 was amended by Acts 2021, 87th Legislature, chapter 806 (House Bill 1525), effective .
When LexLint raises it
When your app profile says your app serves under-18s.