HB3606 - Student Online Personal Protection Act Amendments

• Operators of educational websites, apps, and services must implement and maintain security procedures meeting industry standards to protect student data from unauthorized access, use, or disclosure.

• Operators are prohibited from engaging in targeted advertising based on student information, selling or renting student data, and using student information to build profiles except for K-12 school purposes.

• Schools must enter into written agreements with operators before sharing student data, with agreements containing specific provisions about data use, breach liability allocation, and third-party disclosures.

• Schools are required to publicly post information about their data practices, operator agreements, security breaches, and parent rights, and must notify parents within 30 days of any data breaches affecting students.

• Parents have the right to inspect and copy their child's data held by schools, operators, or the State Board; request corrections to inaccurate information; and require deletion of student data unless legally required to maintain it.