CO HB1108

Schools and school districts must obtain written consent from a minimum of 85% of parents or legal guardians before conducting surveys, assessments, analyses, or evaluations that collect specified personal information from students.

Parents or legal guardians must receive written notice at least two weeks before data collection, including details about what records will be examined, who will access the information, the stated purposes for collection, and assurances that data will not be further processed in incompatible ways.

School districts must ensure collected data are accurate and current, kept only as long as necessary, adequate and relevant to stated purposes, with appropriate safeguards for long-term storage and protection from exposure or loss.

Students who reach age 18 may request in writing that the school district immediately destroy all data related to their record, except information contained in their academic achievement record.

Parents or legal guardians may provide written notification at any time prohibiting the school district from sharing any student data, separately or in aggregate, with vendors or entities outside the school district.