MA S364

Prohibits operators of educational websites, apps, and online services from engaging in targeted advertising to students, selling student information, or building profiles on students/educators except for school purposes

Requires operators to implement reasonable security procedures, return or destroy covered information when requested or no longer needed, and allows civil penalties up to $10,000 per violation plus punitive damages for willful violations

Mandates that contracts between educational entities and operators include descriptions of data collected, security safeguards, breach notification procedures, and certification that data will be returned or destroyed upon contract completion

Requires the Board of Elementary and Secondary Education to promulgate data security regulations and the Commissioner to appoint a chief privacy officer to oversee implementation and develop model policies

Requires each school district to develop privacy and security policies, designate a student data manager, publicly list categories of student data collected and operators with data access, and provide annual data confidentiality training to employees