Law / United States / 
Utah
HB 55 (2026), Privacy Compliance for Education Technology Vendors
Utah Code 53E-9-309, as amended by Laws of Utah 2026, ch. 18 (HB 55)
In force since .
A sensitive categories rule binding public and private bodies.
As of .
What it requires
- If you are a third-party contractor that receives personally identifiable student data under a contract with a Utah education entity, use that data strictly to provide the contracted product or service within the negotiated contract terms.NIST Privacy FrameworkCT.PO-P1
- Do not sell student data, use it for targeted advertising, or collect, use, or share it in a way that is inconsistent with your contract with the education entity.NIST Privacy FrameworkCT.PO-P1
- Accept contract terms that describe the education entity's statutory duty to terminate the contract after an uncured privacy violation and that prohibit any fee or financial liability for the termination.NIST Privacy FrameworkID.DE-P3
- Do not impose a fee, seek damages, or assert financial liability against an education entity that terminates your contract for unauthorized use of student data in violation of state or federal privacy law.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What this law does
A third-party contractor must use personally identifiable student data received under a contract with an education entity strictly to provide the contracted product or service within the negotiated contract terms. The contractor may not sell student data, may not collect, use, or share it inconsistently with the contract, and may not use it for targeted advertising.
Since , a contract with a third-party contractor must describe the education entity's statutory duty to terminate the contract after a privacy violation and prohibit any fee or financial liability for the termination. Within 30 days after discovering a contractor's unauthorized use of student data in violation of state or federal privacy law, the education entity or government agency must give the contractor notice of the violation and of the duty to terminate.
No sooner than 30 days after that notice, the entity must terminate the contract if the contractor does not remedy the violation and establish processes to prevent it from recurring. A contractor may not impose a fee, seek damages, or assert any financial liability against an entity that terminates the contract on that ground. The Governor signed HB 55 on . It amended the section as chapter 18 of the 2026 General Session. The amended section is effective .
When LexLint raises it
When your app profile says your app serves under-18s.