Law / United States / 
Vermont
Student Privacy: operators of PreK-12 school sites, services and applications
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Security, Retention, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you operate an Internet website, online service, online application or mobile application with actual knowledge that it is used primarily for PreK-12 school purposes and was designed and marketed for them, do not knowingly engage in targeted advertising, on your service or any other, based on information, including covered information and persistent unique identifiers, you acquired because of the use of your service for PreK-12 school purposes.
- Do not knowingly use information, including a persistent unique identifier, created or gathered by your service to amass a profile about a student except in furtherance of PreK-12 school purposes. Retaining account information that stays under the control of the student, the student's parent or legal guardian, or the school is not amassing a profile.
- Do not knowingly sell, barter or rent a student's information, including covered information. The bar does not apply to the purchase, merger or other acquisition of the operator by another entity that complies with the subchapter for previously acquired student information.
- Do not knowingly disclose covered information unless the disclosure is made for a purpose section 2443a(a)(4) lists, namely furthering the PreK-12 school purposes of the service (the recipient may not further disclose it except to allow or improve operability and functionality of your service, and may not use it for an inconsistent purpose), legal and regulatory compliance or precautions against liability, judicial process, protecting the safety or integrity of users or the security of the service, a school, educational or employment purpose the student or parent requests, or a third party you bind by contract to use the data only for the contracted service, not to disclose it onward, and to maintain reasonable security. Section 2443c allows disclosure required by law, legitimate research as the law allows, and disclosure to a State or local educational agency for PreK-12 school purposes.
- Implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information and designed to protect it from unauthorized access, destruction, use, modification or disclosure.
- Delete, within a reasonable time and to the extent practicable, a student's covered information if the school or school district requests deletion of information under its control, unless the student or the student's parent or legal guardian consents to keeping it.
- Publicly disclose and provide the school with material information about your collection, use and disclosure of covered information, including by publishing a term of service agreement, privacy policy or similar document.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 2443f makes a violation of the subchapter an unfair and deceptive act in commerce in violation of section 2453 of title 9. Section 2458(b)(1) of chapter 63 lets the court, in an action by the Attorney General or a State's Attorney, impose a civil penalty of not more than $10,000.00 for each unfair or deceptive act or practice in commerce. The subchapter states no penalty of its own.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Vermont Attorney General and State's Attorneys, who may bring an action to restrain a practice declared unlawful by section 2453 of title 9 (9 V.S.A. section 2458); from section 2443f(b) also gives the Attorney General the authority to adopt rules, conduct civil investigations, enter into assurances of discontinuance and bring civil actions as provided under chapter 63, subchapter 1.
What this law does
An operator is the operator of an Internet website, online service, online application or mobile application with actual knowledge that it is used primarily for PreK-12 school purposes and was designed and marketed for PreK-12 school purposes.
An operator may not knowingly engage in targeted advertising on its site, service or application, or on any other, based on information, including covered information and persistent unique identifiers, acquired because of the use of its site, service or application for PreK-12 school purposes. An operator may not knowingly use information created or gathered by its site, service or application to amass a profile about a student, except in furtherance of PreK-12 school purposes.
An operator may not knowingly sell, barter or rent a student's information, including covered information, except in the purchase, merger or other acquisition of the operator by another entity that complies with the subchapter for previously acquired student information. An operator may not knowingly disclose covered information unless the disclosure is made for one of the purposes section 2443a(a)(4) lists and is proportionate to the identifiable information necessary to accomplish the purpose.
An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, delete a student's covered information within a reasonable time if the school or school district requests deletion, and publicly disclose and provide the school with material information about its collection, use and disclosure of covered information.
Subchapter 3A of chapter 62 of title 9 does not apply to general audience Internet websites, online services, online applications or mobile applications, even if login credentials created for an operator's site, service or application may be used to access them. Until , a person who violates a provision of chapter 62 of title 9 commits an unfair and deceptive act in commerce in violation of section 2453 of title 9.
From , section 2443f(b) gives the Attorney General the same authority to adopt rules, conduct civil investigations, enter into assurances of discontinuance and bring civil actions as chapter 63, subchapter 1 of title 9 provides.
When LexLint raises it
When your app profile says your app serves under-18s.