Law / United States / 
Utah
Higher Education Student Data Protection: use limits, return or deletion, and sale and targeted advertising bans for a third-party contractor of an institution or the Utah Board of Higher Education
Utah Code 53H-14-505 and 53H-14-506
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Prohibition, Retention
What it requires
- If you are a third-party contractor of a Utah public college, university or technical college, or of the Utah Board of Higher Education, use personally identifiable student data received under the contract strictly for providing the contracted product or service within the negotiated contract terms (Utah Code 53H-14-505(1)).
- Do not sell student data, except through a purchase of or merger with you that leaves you in compliance, do not collect, use or share student data inconsistently with your contract with the education entity, and do not use student data for targeted advertising (Utah Code 53H-14-505(6)).
- At the completion of an unrenewed contract, on the education entity's request, return or delete the personally identifiable student data under the entity's control unless a student or a minor student's parent consents to your keeping it (Utah Code 53H-14-505(5)).
- As authorized by law or court order, share student data as law enforcement requests (Utah Code 53H-14-505(3)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Utah Code 53H-14-506(4): an individual who knowingly or intentionally permits unauthorized collecting, sharing, or use of student data may be found guilty of a class A misdemeanor.
Penalty structure
Utah Code 53H-14-506(1)(b): a third-party contractor that knowingly or recklessly permits unauthorized collecting, sharing, or use of student data may be required by the board to pay a civil penalty of up to $25,000.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 25,000
Who enforces it
Enforcement body
Utah Board of Higher Education, which may require a third-party contractor to pay the civil penalty (Utah Code 53H-14-506(1)(b)).
What this law does
A third-party contractor is a person who is not an institution or an employee of an institution and who, under a contract with an education entity, collects or receives student data to provide a product or service, if the product or service is not related to school photography, yearbooks, graduation announcements, or a similar product or service.
A third-party contractor must use personally identifiable student data received under a contract with an education entity strictly for the purpose of providing the contracted product or service within the negotiated contract terms. A third-party contractor may not sell student data, collect, use, or share student data inconsistently with its contract with the education entity, or use student data for targeted advertising.
A person may obtain student data through the purchase of, merger with, or other acquisition of a third-party contractor if the contractor remains in compliance with the section. At the completion of a contract that has not been renewed, a third-party contractor must, on the education entity's request, return or delete all personally identifiable student data under the entity's control, unless a student or a minor student's parent consents to the maintenance of the data.
As authorized by law or court order, a third-party contractor must share student data as requested by law enforcement. The section does not apply to the use of a general audience application, to student data shared in accordance with the education entity's directory information policy, or to the providing of Internet service.
A third-party contractor that knowingly or recklessly permits unauthorized collecting, sharing, or use of student data may be required by the board to pay a civil penalty of up to $25,000, and may be required to pay an institution's cost of notifying parents and students and any expense the institution incurs as a result. An individual who knowingly or intentionally permits unauthorized collecting, sharing, or use of student data may be found guilty of a class A misdemeanor.
A student or a minor student's parent may bring an action against a third-party contractor for damages caused by a knowing or reckless violation of section 53H-14-505, and the court may award the parent or student damages and costs. Senate Bill 1001 of the 2025 First Special Session renumbered section 53B-28-505 as section 53H-14-505. Senate Bill 226 of the 2022 General Session enacted the Higher Education Student Data Protection part. Senate Bill 226 of the 2022 General Session took effect on .
When LexLint raises it
When your app profile says your app serves colleges and universities.
Back to the example · Lint your app
Page updated .