H.F. 307 - Student Online Data Protection and Privacy Act

• Operators of websites, online services, and applications designed for K-12 school purposes must implement reasonable security procedures to protect student data from unauthorized access, destruction, use, modification, or disclosure.

• Operators are prohibited from targeting advertising based on student data, using student information to create profiles for non-educational purposes, selling student information, or disclosing covered information except for K-12 school purposes, legal compliance, safety, or contracted service providers with strict data limitations.

• Operators of websites and applications directed to minors are prohibited from marketing or advertising alcoholic beverages, firearms, tobacco, controlled substances, obscene matter, less lethal weapons, and 14 other restricted product categories to minors.

• Minors who are registered users must be able to remove or request removal of content they posted, with operators required to clearly explain the removal process and notify users that removal may not eliminate all posted content about them.

• Operators may use de-identified educational data to improve educational products and demonstrate effectiveness; general audience websites and internet service providers are exempted from the restrictions.