CO SB204

Creates "Student and Teacher Data Privacy and Security Act" establishing limits on student and teacher data collection by education institutions and state agencies without written consent.

Permits collection of basic information (name, address, grades, test scores, enrollment, immunization records) without consent, but requires written consent for medical, mental health, biometric records, and data collected through affective computing or predictive modeling.

Prohibits commercial use of student/teacher data, predictive modeling, video classroom monitoring without written consent, interagency disclosure to non-education agencies, and data disclosure outside Colorado with limited exceptions.

Establishes transparency requirements for data systems including public website disclosure of data types maintained, purposes, and procedures; requires annual notification to parents and educators; mandates data destruction within 5 years of student graduation or withdrawal.

Sets penalties of up to $1,000 for first violation, $5,000 for second, and $10,000 for subsequent violations by contractors or third parties; does not create private right of action against schools or state agencies.