HB 632 - Student Online Privacy Protection

• Prohibits operators of K-12 educational websites, services, and applications from engaging in targeted advertising based on student data or persistent identifiers collected through school purposes.

• Operators cannot use student information to create profiles except for K-12 school purposes, and cannot sell or rent student information with limited exceptions for national assessment providers with parental consent.

• Operators must implement reasonable security procedures to protect student data and delete covered information within 45 days upon request by schools unless express written consent is provided to maintain it.

• Allows covered information disclosure only for K-12 school purposes, legal compliance, judicial proceedings, user safety, or to subcontractors under strict contractual restrictions prohibiting further disclosure.

• Becomes effective October 1, 2016; Attorney General may bring civil action for violations but no private right of action is created.