Law / United States / Washington

Student User Privacy in Education Rights Act, school service providers

RCW 28A.604.010 to 28A.604.060; chapter 277, Laws of 2015

In force since 1 Jul 2016.

A sensitive categories rule binding public and private bodies.

Instrument type

an act of a legislature

Obligation class

Prohibition, Disclosure, Consent, Security, Data subject rights

Audit expectation

none

What it requires

• This binds a school service provider, an entity that operates a website, mobile application or online service designed and marketed primarily for use in a K-12 school, used at the direction of teachers or other school employees, that collects, maintains or uses student personal information; a service designed and marketed for use by individuals or entities generally is not a school service even if also marketed to a K-12 school, and the students the chapter protects are students of K-12 schools in Washington (RCW 28A.604.010(1), (2) and (4)).
• Give clear and easy to understand information about the types of student personal information you collect and how you use and share it, and give prominent notice before making material changes to the privacy policy for the school service; where the service is offered to an educational institution or teacher, this information may be given to the institution or teacher (RCW 28A.604.020(1), (2) and (4)).
• Facilitate access to and correction of student personal information by students or their parent or guardian, either directly or through the educational institution or teacher (RCW 28A.604.020(3)).
• The notice, access and correction duties in RCW 28A.604.020(1) to (4) do not apply to the education data center established under RCW 43.41.400, but do apply to any subcontractors of the education data center (RCW 28A.604.020(5)); the chapter defines a school service provider as an entity without limiting it to private operators (RCW 28A.604.010(2)), so a public body that operates a school service is not outside it.
• Collect, use and share student personal information only for purposes authorized by the educational institution or teacher, or with the consent of the student or the student's parent or guardian (RCW 28A.604.030(1)).
• Do not sell student personal information; the prohibition does not apply to an acquisition of a school service provider or its assets by a successor entity that continues to be subject to the section (RCW 28A.604.030(2)).
• Do not use or share student personal information for targeted advertising to students, meaning advertisements selected from information obtained or inferred from a student's online behavior, use of applications or student personal information; advertising based on a student's current visit to an online location without collecting and retaining the student's online activities over time, and adaptive, personalized or customized learning, are not targeted advertising (RCW 28A.604.010(5) and 28A.604.030(3)).
• Do not use student personal information to create a personal profile of a student other than for supporting purposes authorized by the educational institution or teacher, or with consent of the student or the student's parent or guardian (RCW 28A.604.030(4)).
• Obtain consent before using student personal information in a manner materially inconsistent with your privacy policy or school contract in effect at the time of collection (RCW 28A.604.030(5)).
• Before giving a subcontractor student personal information under the exception in RCW 28A.604.030(6)(f), contractually prohibit it from using the information for any purpose other than the contracted service, prohibit onward disclosure beyond the listed exceptions, and require it to comply with the chapter.
• The purpose limit, the sale ban, the profiling limit and the consent duty in RCW 28A.604.030(1), (2), (4) and (5) may not apply to a use or disclosure that protects the security or integrity of the service, ensures legal or regulatory compliance or takes precautions against liability, responds to or participates in judicial process, protects the safety of users or others, or investigates a matter related to public safety; the targeted advertising ban is not among them (RCW 28A.604.030(6)(a) to (e)).
• Maintain a comprehensive information security program reasonably designed to protect the security, privacy, confidentiality and integrity of student personal information, using appropriate administrative, technological and physical safeguards (RCW 28A.604.040(1)).
• Delete student personal information within a reasonable period of time when the educational institution requests deletion of the data under its control, unless the student or parent has consented to retention or the student has moved to an institution that asked you to retain it (RCW 28A.604.040(2)).
• The chapter does not prohibit using student personal information for adaptive learning or personalized or customized education, for maintaining, developing, supporting, improving or diagnosing the service, or for recommendations and responses to a student's request that are not determined in whole or in part by payment or other consideration from a third party (RCW 28A.604.050).
• The chapter does not apply to general audience websites, mobile applications or online services, even where login credentials created for a school service can be used to reach them, and does not prohibit marketing educational products directly to parents where the marketing did not result from student personal information obtained through the school service (RCW 28A.604.901(2) and (5)).

These lines are LexLint's reading of the law's text.

What record it asks for

When LexLint raises it

When your app profile says your app serves K-12 schools.

Back to the example  ·  Lint your app

Page updated 9 November 2026.