Law / United States / 
Virginia
School service providers and school-issued devices: student personal information
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Security, Retention, Prohibition
As of .
What it requires
- If you are a school service provider or school technology provider operating a school service or providing school-issued devices under a contract with a local school division in Virginia (or a school board or school providing school-issued devices independently), give clear and easy-to-understand information about the types of student personal information you collect and how you maintain, use or share it, keep a privacy policy for each school service or school-issued device, and give prominent notice before making material changes to it (section 22.1-289.01(B)(1) and (2)).
- Maintain a comprehensive information security program reasonably designed to protect the security, privacy, confidentiality and integrity of student personal information, with appropriate administrative, technological and physical safeguards, and require any successor entity or third party you contract with to abide by your privacy policy and security program before it accesses student personal information (section 22.1-289.01(B)(3) and (7)).
- Facilitate access to and correction of student personal information by the student or, if the student is under 18, the parent, and on request provide an electronic copy in a manner consistent with the functionality of the service or device (section 22.1-289.01(B)(4) and (10)).
- Collect, maintain, use and share student personal information only with the consent of the student or, if under 18, the parent, or for the purposes the contract with the school division authorizes, and obtain that consent (or, for information collected from someone other than the student, the school division's consent) before using it in a manner inconsistent with your privacy policy (section 22.1-289.01(B)(5) and (6)).
- On the request of the school or school division, delete student personal information within a reasonable time unless the student or parent consents to its maintenance, and delete student personal information stored on a returned school-issued device before the device is reissued or transferred (section 22.1-289.01(B)(8) and (9)).
- Do not knowingly use or share student personal information for targeted advertising to students, use or share it to create a personal profile of a student other than for authorized elementary and secondary school purposes, or sell it (except to a successor entity), and do not use a school-issued device, or let a school board or other entity use it, to access or monitor location-tracking features, audio or visual features or student interactions except as subdivision C 4 permits (section 22.1-289.01(C)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
- Open questions
- Does an online service used by schools but marketed to individuals generally, which the definition of "school service" excludes, fall outside every duty in the section even when a school division contracts for it?
What this law does
A school service is a website, mobile application or online service that is designed and marketed primarily for use in elementary or secondary schools, is used at the direction of school employees or by a school-affiliated entity, and collects and maintains, uses or shares student personal information. A school service provider is an entity that operates a school service under a contract with a local school division in the Commonwealth.
Each school service provider or school technology provider must provide clear information about the student personal information it collects, maintain a privacy policy, maintain a comprehensive information security program, and facilitate access to and correction of the information. Each provider must collect, maintain, use and share student personal information only with the consent of the student or, if under 18, the parent, or for the purposes the contract with the school division authorizes.
No provider may knowingly use or share student personal information for targeted advertising to students or sell it, except to a successor entity. A school service provider in operation on is not subject to the section until the contract to operate a school service is renewed. Chapter 728 of the 2015 Acts of Assembly added the section to Article 5 of Chapter 14 of Title 22.1 of the Code of Virginia. Chapter 728 of the 2015 Acts of Assembly took effect on .
Chapter 438 of the 2016 Acts of Assembly (House Bill 749) amended and reenacted section 22.1-289.01, relating to school service providers. House Bill 749 of the 2016 Regular Session defined targeted advertising and clarified that the section does not prohibit school service providers from disclosing student personal information to ensure legal or regulatory compliance, protect against liability, or protect the security or integrity of the school service.
The enrolled text of House Bill 749 of 2016 changes the definition of a school service from one designed and marketed solely for use in elementary or secondary schools to one designed and marketed primarily for that use. Chapter 439 of the 2016 Acts of Assembly (House Bill 750) amended section 22.1-289.01 in relation to school services and college and career readiness assessment.
Chapter 468 of the 2016 Acts of Assembly (House Bill 519) amended section 22.1-289.01 in relation to school-affiliated entities. Chapter 518 of the 2017 Acts of Assembly (Senate Bill 951) amended section 22.1-289.01 in relation to student access to collected personal information. Chapter 364 of the 2025 Acts of Assembly (Senate Bill 1486) established requirements for the protection of student personal information on school-issued devices. Chapter 364 of the 2025 Acts of Assembly took effect on .
When LexLint raises it
When your app profile says your app serves under-18s.