CA AB1159

Amends the K-12 Pupil Online Personal Information Protection Act (KOPIPA) and Early Learning Personal Information Protection Act (ELPIPA) to expand coverage to operators or entities working on their behalf that design or market websites, apps, or online services for educational purposes

Prohibits operators from using covered student information, including persistent unique identifiers, to train generative artificial intelligence systems or develop AI systems

Creates the Higher Education Student Information Protection Act (HESIPA) to extend similar privacy protections to students enrolled in higher education institutions, operative July 1, 2027

Authorizes students (or parents/guardians) who suffer actual damages from operator noncompliance to bring civil actions seeking the greater of actual damages or $500 per violation, plus injunctive relief, punitive damages, and attorney's fees

Requires operators to provide 45-day written notice before filing suit and allows operators to cure violations within 30 days to avoid individual claims