UT SB0296

Students currently or previously enrolled in Utah education entities and higher education institutions have the right to access their educational data (transcripts, enrollment information, course history, and academic credentials) and authorize third-party access through informed consent

Beginning July 1, 2027, education entities and institutions must offer secure digital or electronic mechanisms as the primary method for obtaining informed consent, with written consent allowed when digital options are unavailable

Educational institutions are prohibited from denying or restricting a student's ability to grant informed consent, requiring students to waive unrelated rights as a condition of consent, or bundling unrelated terms with consent requests

Third parties receiving educational data from more than 10 students are subject to state data privacy requirements and may not redisclose the data; students have a private right of action against third parties (not institutions) that violate these requirements

Parents must provide informed consent on behalf of students under 18 years old; the bill takes effect July 1, 2026, and does not supersede FERPA or other applicable privacy laws