{"formats":[{"name":"JSON","format":"json","url":"\/downloads\/2026\/code-json\/22.1-289.01.json"},{"name":"Plain Text","format":"text","url":"\/downloads\/2026\/code-text\/22.1-289.01.txt"},{"name":"XML","format":"xml","url":"\/downloads\/2026\/code-xml\/22.1-289.01.xml"},{"name":"HTML","format":"html","url":"\/downloads\/2026\/code-html\/22.1-289.01.html"}],"law_id":354674,"edition_id":2,"section_id":354674,"structure_id":50731,"section_number":"22.1-289.01","catch_line":"School service providers; school-affiliated entities; school-issued devices; student personal information","history":"2015, c. 728; 2016, cc. 438, 439, 468; 2017, c. 518; 2025, c. 364.","full_text":"A\n\nFor the purposes of this section:\n\t\t\t“Elementary and secondary school purposes” means purposes that (i) customarily take place at the direction of an elementary or secondary school, elementary or secondary school teacher, or school division; (ii) aid in the administration of school activities, including instruction in the classroom or at home; administrative activities; and collaboration between students, school personnel, or parents; or (iii) are otherwise for the use and benefit of an elementary or secondary school.\n\n\t\t\t“Machine-readable format” means a structured format that can automatically be read and processed by a computer such as comma-separated values (CSV), Javascript Object Notation (JSON), or Extensible Markup Language (XML). “Machine-readable format” does not include portable document format (PDF).\n\n\t\t\t“Personal profile” does not include account information that is collected and retained by a school service provider and remains under control of a student, parent, or elementary or secondary school.\n\n\t\t\t“School-affiliated entity” means any private entity that provides support to a local school division or a public elementary or secondary school in the Commonwealth. “School-affiliated entity” includes alumni associations, booster clubs, parent-teacher associations, parent-teacher-student associations, parent-teacher organizations, public education foundations, public education funds, and scholarship organizations.\n\n\t\t\t“School-issued device” means any technological hardware or devices that a school board, acting independently or pursuant to a contract with a school technology provider, provides to individual students for their personal use on school property, at home, or both. “School-issued device” includes any laptop, tablet, or other technological device.\n\n\t\t\t“School service” means a website, mobile application, or online service that (i) is designed and marketed primarily for use in elementary or secondary schools; (ii) is used (a) at the direction of teachers or other employees at elementary or secondary schools or (b) by any school-affiliated entity; and (iii) collects and maintains, uses, or shares student personal information. “School service” does not include a website, mobile application, or online service that is (a) used for the purposes of college and career readiness assessment or (b) designed and marketed for use by individuals or entities generally, even if it is also marketed for use in elementary or secondary schools.\n\n\t\t\t“School service provider” means an entity that operates a school service pursuant to a contract with a local school division in the Commonwealth.\n\n\t\t\t“School technology provider” means an entity that provides, pursuant to a contract with a school board in the Commonwealth, any technological hardware or devices intended for student use as school-issued devices.\n\n\t\t\t“Student personal information” means information collected through a school service that identifies a currently or formerly enrolled individual student or is linked to information that identifies a currently or formerly enrolled individual student.\n\n\t\t\t“Targeted advertising” means advertising that is presented to a student and selected on the basis of information obtained or inferred over time from such student’s online behavior, use of applications, or sharing of student personal information. “Targeted advertising” does not include advertising (i) that is presented to a student at an online location (a) on the basis of such student’s online behavior, use of applications, or sharing of student personal information during his current visit to that online location or (b) in response to that student’s request for information or feedback and (ii) for which a student’s online activities or requests are not retained over time for the purpose of subsequent advertising.\n\nB\n\nIn operating a school service or providing school-issued devices pursuant to a contract with a local school division, each school service provider or school technology provider or, in the case of any school or school board providing any school-issued devices independently, any school board or school shall:\n\n1\n\nProvide clear and easy-to-understand information about the types of student personal information it collects through any school service or through providing any school-issued devices and how it maintains, uses, or shares such student personal information;\n\n2\n\nMaintain a policy for the privacy of student personal information for each school service or each school-issued device and provide prominent notice before making material changes to its policy for the privacy of student personal information for the relevant school service or school-issued devices;\n\n3\n\nMaintain a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of student personal information and makes use of appropriate administrative, technological, and physical safeguards;\n\n4\n\nFacilitate access to and correction of student personal information by each student whose student personal information has been collected, maintained, used, or shared by the school service provider or school technology provider, or by such student’s parent, either directly or through the student’s school or teacher;\n\n5\n\nCollect, maintain, use, and share student personal information only with the consent of the student or, if the student is less than 18 years of age, his parent or for the purposes authorized in the contract between the school division and the school service provider or school technology provider;\n\n6\n\nWhen it collects student personal information directly from the student, obtain the consent of the student or, if the student is less than 18 years of age, his parent before using student personal information in a manner that is inconsistent with its policy for the privacy of student personal information for the relevant school service or school-issued device, and when it collects student personal information from an individual or entity other than the student, obtain the consent of the school division before using student personal information in a manner that is inconsistent with its policy for the privacy of student personal information for the relevant school service or school-issued device;\n\n7\n\nRequire any successor entity or third party with whom it contracts to abide by its policy for the privacy of student personal information and comprehensive information security program before accessing student personal information;\n\n8\n\nUpon the request of the school or school division, delete student personal information within a reasonable period of time after such request unless the student or, if the student is less than 18 years of age, his parent consents to the maintenance of the student personal information by the school service provider;\n\n9\n\nFor any school-issued device that a student returns at the end of the school year or upon request of the school or school division and that shall subsequently be provided to another student, disposed of, donated, or otherwise transferred in ownership to any individual or entity other than the specific student to whom it was issued, delete any student personal information stored in the school-issued device within a reasonable time after such school-issued device is returned and prior to the subsequent provision of such school-issued device to any other student or other transfer in ownership of such school-issued device; and\n\n10\n\nProvide, upon request, either directly to the student or his parent or through the school, access to an electronic copy of such student’s personal information in a manner consistent with the functionality of the school service or school-issued device. Contracts between local school boards and school service providers or school technology providers may require that such electronic copy be in a machine-readable format.\n\nC\n\nIn operating a school service or providing any school-issued devices pursuant to a contract with a local school division, no school service provider or school technology provider or, in the case of any school or school board providing any school-issued devices independently, any school board or school shall knowingly:\n\n1\n\nUse or share any student personal information for the purpose of targeted advertising to students;\n\n2\n\nUse or share any student personal information to create a personal profile of a student other than for elementary and secondary school purposes authorized by the school division, with the consent of the student or, if the student is less than 18 years of age, his parent, or as otherwise authorized in the contract between the school division and the school service provider or school technology provider;\n\n3\n\nSell student personal information, except to the extent that such student personal information is sold to or acquired by a successor entity that purchases, merges with, or otherwise acquires the school service provider or school technology provider, subject to the provisions of subdivision B 7; or\n\n4\n\nExcept as provided in subdivision E 4, use any school-issued device provided pursuant to any such contract, or grant any school board or other entity with the ability to use any school-issued device, to access or monitor (i) location-tracking features; (ii) audio or visual receiving, transmitting, or recording features; or (iii) student interactions, unless such use (a) is limited to a noncommercial, educational, or instructional purpose, to the provision of technical support, or to exam proctoring by a school board employee or a third party pursuant to a contract with the school board and notice of such use is provided in advance or (b) is permitted under a judicial warrant or is necessary to comply with state or federal law.\n\nD\n\nNothing in this section shall be construed to prohibit school service providers or school technology providers or, in the case of any school or school board providing any school-issued devices independently, any school board or school from:\n\n1\n\nUsing student personal information for purposes of adaptive learning, personalized learning, or customized education;\n\n2\n\nUsing student personal information for maintaining, developing, supporting, improving, or diagnosing any school service;\n\n3\n\nProviding recommendations for employment, school, educational, or other learning purposes within a school service when such recommendation is not determined in whole or in part by payment or other consideration from a third party;\n\n4\n\nDisclosing student personal information to (i) ensure legal or regulatory compliance, (ii) protect against liability, or (iii) protect the security or integrity of its school service; or\n\n5\n\nDisclosing student personal information pursuant to a contract with a service provider, provided that the school service provider, school technology provider, school board, or school (i) contractually prohibits the service provider from using any student personal information for any purpose other than providing the contracted service to or on behalf of the school service provider, school technology provider, school board, or school, (ii) contractually prohibits the service provider from disclosing any student personal information provided by the school service provider, school technology provider, school board, or school to any third party unless such disclosure is permitted by subdivision B 7, and (iii) requires the service provider to comply with the requirements set forth in subsection B and prohibitions set forth in subsection C.\n\nE\n\nNothing in this section shall be construed to:\n\n1\n\nImpose a duty upon a provider of an electronic store, gateway, marketplace, forum, or means for purchasing or downloading software or applications to review or enforce compliance with this section with regard to any school service provider whose school service is available for purchase or download on such electronic store, gateway, marketplace, forum, or means;\n\n2\n\nImpose liability on an interactive computer service, as that term is defined in 47 U.S.C. § 230(f), for content provided by another individual;\n\n3\n\nProhibit any student from downloading, exporting, transferring, saving, or maintaining his personal information, data, or documents; or\n\n4\n\nProhibit any school board from requesting or prohibit any provider from granting any school board access to or the ability to monitor school-issued devices to ensure compliance with a school code of conduct or otherwise limit the ability of any school board to use software filters to monitor school-issued devices for certain safety threats, self-harm prevention, or other risk indicators.\n\nF\n\nNo school service provider in operation on June 30, 2016, shall be subject to the provisions of this section until such time as the contract to operate a school service is renewed.\n\n","order_by":null,"text":{"0":{"id":1320498,"text":"For the purposes of this section:\n\t\t\t“Elementary and secondary school purposes” means purposes that (i) customarily take place at the direction of an elementary or secondary school, elementary or secondary school teacher, or school division; (ii) aid in the administration of school activities, including instruction in the classroom or at home; administrative activities; and collaboration between students, school personnel, or parents; or (iii) are otherwise for the use and benefit of an elementary or secondary school.\t\t\t“Machine-readable format” means a structured format that can automatically be read and processed by a computer such as comma-separated values (CSV), Javascript Object Notation (JSON), or Extensible Markup Language (XML). “Machine-readable format” does not include portable document format (PDF).\t\t\t“Personal profile” does not include account information that is collected and retained by a school service provider and remains under control of a student, parent, or elementary or secondary school.\t\t\t“School-affiliated entity” means any private entity that provides support to a local school division or a public elementary or secondary school in the Commonwealth. “School-affiliated entity” includes alumni associations, booster clubs, parent-teacher associations, parent-teacher-student associations, parent-teacher organizations, public education foundations, public education funds, and scholarship organizations.\t\t\t“School-issued device” means any technological hardware or devices that a school board, acting independently or pursuant to a contract with a school technology provider, provides to individual students for their personal use on school property, at home, or both. “School-issued device” includes any laptop, tablet, or other technological device.\t\t\t“School service” means a website, mobile application, or online service that (i) is designed and marketed primarily for use in elementary or secondary schools; (ii) is used (a) at the direction of teachers or other employees at elementary or secondary schools or (b) by any school-affiliated entity; and (iii) collects and maintains, uses, or shares student personal information. “School service” does not include a website, mobile application, or online service that is (a) used for the purposes of college and career readiness assessment or (b) designed and marketed for use by individuals or entities generally, even if it is also marketed for use in elementary or secondary schools.\t\t\t“School service provider” means an entity that operates a school service pursuant to a contract with a local school division in the Commonwealth.\t\t\t“School technology provider” means an entity that provides, pursuant to a contract with a school board in the Commonwealth, any technological hardware or devices intended for student use as school-issued devices.\t\t\t“Student personal information” means information collected through a school service that identifies a currently or formerly enrolled individual student or is linked to information that identifies a currently or formerly enrolled individual student.\t\t\t“Targeted advertising” means advertising that is presented to a student and selected on the basis of information obtained or inferred over time from such student’s online behavior, use of applications, or sharing of student personal information. “Targeted advertising” does not include advertising (i) that is presented to a student at an online location (a) on the basis of such student’s online behavior, use of applications, or sharing of student personal information during his current visit to that online location or (b) in response to that student’s request for information or feedback and (ii) for which a student’s online activities or requests are not retained over time for the purpose of subsequent advertising.","type":"section","prefixes":["A"],"prefix":"A","entire_prefix":"A","prefix_anchor":"A","level":1,"next_prefix":"B"},"1":{"id":1320499,"text":"In operating a school service or providing school-issued devices pursuant to a contract with a local school division, each school service provider or school technology provider or, in the case of any school or school board providing any school-issued devices independently, any school board or school shall:","type":"section","prefixes":["B"],"prefix":"B","entire_prefix":"B","prefix_anchor":"B","level":1,"prior_prefix":"A","next_prefix":"B1"},"2":{"id":1320500,"text":"Provide clear and easy-to-understand information about the types of student personal information it collects through any school service or through providing any school-issued devices and how it maintains, uses, or shares such student personal information;","type":"section","prefixes":["B","1"],"prefix":"1","entire_prefix":"B1","prefix_anchor":"B1","level":2,"prior_prefix":"B","next_prefix":"B2"},"3":{"id":1320501,"text":"Maintain a policy for the privacy of student personal information for each school service or each school-issued device and provide prominent notice before making material changes to its policy for the privacy of student personal information for the relevant school service or school-issued devices;","type":"section","prefixes":["B","2"],"prefix":"2","entire_prefix":"B2","prefix_anchor":"B2","level":2,"prior_prefix":"B1","next_prefix":"B3"},"4":{"id":1320502,"text":"Maintain a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of student personal information and makes use of appropriate administrative, technological, and physical safeguards;","type":"section","prefixes":["B","3"],"prefix":"3","entire_prefix":"B3","prefix_anchor":"B3","level":2,"prior_prefix":"B2","next_prefix":"B4"},"5":{"id":1320503,"text":"Facilitate access to and correction of student personal information by each student whose student personal information has been collected, maintained, used, or shared by the school service provider or school technology provider, or by such student’s parent, either directly or through the student’s school or teacher;","type":"section","prefixes":["B","4"],"prefix":"4","entire_prefix":"B4","prefix_anchor":"B4","level":2,"prior_prefix":"B3","next_prefix":"B5"},"6":{"id":1320504,"text":"Collect, maintain, use, and share student personal information only with the consent of the student or, if the student is less than 18 years of age, his parent or for the purposes authorized in the contract between the school division and the school service provider or school technology provider;","type":"section","prefixes":["B","5"],"prefix":"5","entire_prefix":"B5","prefix_anchor":"B5","level":2,"prior_prefix":"B4","next_prefix":"B6"},"7":{"id":1320505,"text":"When it collects student personal information directly from the student, obtain the consent of the student or, if the student is less than 18 years of age, his parent before using student personal information in a manner that is inconsistent with its policy for the privacy of student personal information for the relevant school service or school-issued device, and when it collects student personal information from an individual or entity other than the student, obtain the consent of the school division before using student personal information in a manner that is inconsistent with its policy for the privacy of student personal information for the relevant school service or school-issued device;","type":"section","prefixes":["B","6"],"prefix":"6","entire_prefix":"B6","prefix_anchor":"B6","level":2,"prior_prefix":"B5","next_prefix":"B7"},"8":{"id":1320506,"text":"Require any successor entity or third party with whom it contracts to abide by its policy for the privacy of student personal information and comprehensive information security program before accessing student personal information;","type":"section","prefixes":["B","7"],"prefix":"7","entire_prefix":"B7","prefix_anchor":"B7","level":2,"prior_prefix":"B6","next_prefix":"B8"},"9":{"id":1320507,"text":"Upon the request of the school or school division, delete student personal information within a reasonable period of time after such request unless the student or, if the student is less than 18 years of age, his parent consents to the maintenance of the student personal information by the school service provider;","type":"section","prefixes":["B","8"],"prefix":"8","entire_prefix":"B8","prefix_anchor":"B8","level":2,"prior_prefix":"B7","next_prefix":"B9"},"10":{"id":1320508,"text":"For any school-issued device that a student returns at the end of the school year or upon request of the school or school division and that shall subsequently be provided to another student, disposed of, donated, or otherwise transferred in ownership to any individual or entity other than the specific student to whom it was issued, delete any student personal information stored in the school-issued device within a reasonable time after such school-issued device is returned and prior to the subsequent provision of such school-issued device to any other student or other transfer in ownership of such school-issued device; and","type":"section","prefixes":["B","9"],"prefix":"9","entire_prefix":"B9","prefix_anchor":"B9","level":2,"prior_prefix":"B8","next_prefix":"B10"},"11":{"id":1320509,"text":"Provide, upon request, either directly to the student or his parent or through the school, access to an electronic copy of such student’s personal information in a manner consistent with the functionality of the school service or school-issued device. Contracts between local school boards and school service providers or school technology providers may require that such electronic copy be in a machine-readable format.","type":"section","prefixes":["B","10"],"prefix":"10","entire_prefix":"B10","prefix_anchor":"B10","level":2,"prior_prefix":"B9","next_prefix":"C"},"12":{"id":1320510,"text":"In operating a school service or providing any school-issued devices pursuant to a contract with a local school division, no school service provider or school technology provider or, in the case of any school or school board providing any school-issued devices independently, any school board or school shall knowingly:","type":"section","prefixes":["C"],"prefix":"C","entire_prefix":"C","prefix_anchor":"C","level":1,"prior_prefix":"B10","next_prefix":"C1"},"13":{"id":1320511,"text":"Use or share any student personal information for the purpose of targeted advertising to students;","type":"section","prefixes":["C","1"],"prefix":"1","entire_prefix":"C1","prefix_anchor":"C1","level":2,"prior_prefix":"C","next_prefix":"C2"},"14":{"id":1320512,"text":"Use or share any student personal information to create a personal profile of a student other than for elementary and secondary school purposes authorized by the school division, with the consent of the student or, if the student is less than 18 years of age, his parent, or as otherwise authorized in the contract between the school division and the school service provider or school technology provider;","type":"section","prefixes":["C","2"],"prefix":"2","entire_prefix":"C2","prefix_anchor":"C2","level":2,"prior_prefix":"C1","next_prefix":"C3"},"15":{"id":1320513,"text":"Sell student personal information, except to the extent that such student personal information is sold to or acquired by a successor entity that purchases, merges with, or otherwise acquires the school service provider or school technology provider, subject to the provisions of subdivision B 7; or","type":"section","prefixes":["C","3"],"prefix":"3","entire_prefix":"C3","prefix_anchor":"C3","level":2,"prior_prefix":"C2","next_prefix":"C4"},"16":{"id":1320514,"text":"Except as provided in subdivision E 4, use any school-issued device provided pursuant to any such contract, or grant any school board or other entity with the ability to use any school-issued device, to access or monitor (i) location-tracking features; (ii) audio or visual receiving, transmitting, or recording features; or (iii) student interactions, unless such use (a) is limited to a noncommercial, educational, or instructional purpose, to the provision of technical support, or to exam proctoring by a school board employee or a third party pursuant to a contract with the school board and notice of such use is provided in advance or (b) is permitted under a judicial warrant or is necessary to comply with state or federal law.","type":"section","prefixes":["C","4"],"prefix":"4","entire_prefix":"C4","prefix_anchor":"C4","level":2,"prior_prefix":"C3","next_prefix":"D"},"17":{"id":1320515,"text":"Nothing in this section shall be construed to prohibit school service providers or school technology providers or, in the case of any school or school board providing any school-issued devices independently, any school board or school from:","type":"section","prefixes":["D"],"prefix":"D","entire_prefix":"D","prefix_anchor":"D","level":1,"prior_prefix":"C4","next_prefix":"D1"},"18":{"id":1320516,"text":"Using student personal information for purposes of adaptive learning, personalized learning, or customized education;","type":"section","prefixes":["D","1"],"prefix":"1","entire_prefix":"D1","prefix_anchor":"D1","level":2,"prior_prefix":"D","next_prefix":"D2"},"19":{"id":1320517,"text":"Using student personal information for maintaining, developing, supporting, improving, or diagnosing any school service;","type":"section","prefixes":["D","2"],"prefix":"2","entire_prefix":"D2","prefix_anchor":"D2","level":2,"prior_prefix":"D1","next_prefix":"D3"},"20":{"id":1320518,"text":"Providing recommendations for employment, school, educational, or other learning purposes within a school service when such recommendation is not determined in whole or in part by payment or other consideration from a third party;","type":"section","prefixes":["D","3"],"prefix":"3","entire_prefix":"D3","prefix_anchor":"D3","level":2,"prior_prefix":"D2","next_prefix":"D4"},"21":{"id":1320519,"text":"Disclosing student personal information to (i) ensure legal or regulatory compliance, (ii) protect against liability, or (iii) protect the security or integrity of its school service; or","type":"section","prefixes":["D","4"],"prefix":"4","entire_prefix":"D4","prefix_anchor":"D4","level":2,"prior_prefix":"D3","next_prefix":"D5"},"22":{"id":1320520,"text":"Disclosing student personal information pursuant to a contract with a service provider, provided that the school service provider, school technology provider, school board, or school (i) contractually prohibits the service provider from using any student personal information for any purpose other than providing the contracted service to or on behalf of the school service provider, school technology provider, school board, or school, (ii) contractually prohibits the service provider from disclosing any student personal information provided by the school service provider, school technology provider, school board, or school to any third party unless such disclosure is permitted by subdivision B 7, and (iii) requires the service provider to comply with the requirements set forth in subsection B and prohibitions set forth in subsection C.","type":"section","prefixes":["D","5"],"prefix":"5","entire_prefix":"D5","prefix_anchor":"D5","level":2,"prior_prefix":"D4","next_prefix":"E"},"23":{"id":1320521,"text":"Nothing in this section shall be construed to:","type":"section","prefixes":["E"],"prefix":"E","entire_prefix":"E","prefix_anchor":"E","level":1,"prior_prefix":"D5","next_prefix":"E1"},"24":{"id":1320522,"text":"Impose a duty upon a provider of an electronic store, gateway, marketplace, forum, or means for purchasing or downloading software or applications to review or enforce compliance with this section with regard to any school service provider whose school service is available for purchase or download on such electronic store, gateway, marketplace, forum, or means;","type":"section","prefixes":["E","1"],"prefix":"1","entire_prefix":"E1","prefix_anchor":"E1","level":2,"prior_prefix":"E","next_prefix":"E2"},"25":{"id":1320523,"text":"Impose liability on an interactive computer service, as that term is defined in 47 U.S.C. § 230(f), for content provided by another individual;","type":"section","prefixes":["E","2"],"prefix":"2","entire_prefix":"E2","prefix_anchor":"E2","level":2,"prior_prefix":"E1","next_prefix":"E3"},"26":{"id":1320524,"text":"Prohibit any student from downloading, exporting, transferring, saving, or maintaining his personal information, data, or documents; or","type":"section","prefixes":["E","3"],"prefix":"3","entire_prefix":"E3","prefix_anchor":"E3","level":2,"prior_prefix":"E2","next_prefix":"E4"},"27":{"id":1320525,"text":"Prohibit any school board from requesting or prohibit any provider from granting any school board access to or the ability to monitor school-issued devices to ensure compliance with a school code of conduct or otherwise limit the ability of any school board to use software filters to monitor school-issued devices for certain safety threats, self-harm prevention, or other risk indicators.","type":"section","prefixes":["E","4"],"prefix":"4","entire_prefix":"E4","prefix_anchor":"E4","level":2,"prior_prefix":"E3","next_prefix":"F"},"28":{"id":1320526,"text":"No school service provider in operation on June 30, 2016, shall be subject to the provisions of this section until such time as the contract to operate a school service is renewed.","type":"section","prefixes":["F"],"prefix":"F","entire_prefix":"F","prefix_anchor":"F","level":1,"prior_prefix":"E4"}},"ancestry":[{"id":50731,"edition_id":2,"name":"Pupil Records","identifier":"5","label":"article","depth":3,"order_by":5,"parent_id":50723,"metadata":{"child_laws":13,"child_structures":0},"date_created":"2026-08-02 02:32:30","date_modified":"2026-08-02 12:31:10","permalink":{"id":1409553,"object_type":"structure","relational_id":50731,"identifier":"5","token":"22.1\/14\/5","url":"\/22.1\/14\/5\/","edition_id":2,"permalink":0,"preferred":1}},{"id":50723,"edition_id":2,"name":"Pupils","identifier":"14","label":"chapter","depth":2,"order_by":20,"parent_id":50682,"metadata":{"child_laws":115,"child_structures":5},"date_created":"2026-08-02 02:32:18","date_modified":"2026-08-02 12:31:10","permalink":{"id":1409135,"object_type":"structure","relational_id":50723,"identifier":"14","token":"22.1\/14","url":"\/22.1\/14\/","edition_id":2,"permalink":0,"preferred":1}},{"id":50682,"edition_id":2,"name":"Education","identifier":"22.1","label":"title","depth":1,"order_by":60,"parent_id":null,"metadata":{"child_laws":858,"child_structures":99},"date_created":"2026-08-02 02:31:28","date_modified":"2026-08-02 12:30:57","permalink":{"id":1407951,"object_type":"structure","relational_id":50682,"identifier":"22.1","token":"22.1","url":"\/22.1\/","edition_id":2,"permalink":0,"preferred":1}}],"structure_contents":[{"id":354669,"structure_id":50731,"section_number":"22.1-287","catch_line":"Limitations on access to records","url":"\/22.1-287\/","token":"22.1\/14\/5\/22.1-287","metadata":false},{"id":354663,"structure_id":50731,"section_number":"22.1-287.01","catch_line":"Student information; release to federal government agencies","url":"\/22.1-287.01\/","token":"22.1\/14\/5\/22.1-287.01","metadata":false},{"id":354664,"structure_id":50731,"section_number":"22.1-287.02","catch_line":"Students' personally identifiable information","url":"\/22.1-287.02\/","token":"22.1\/14\/5\/22.1-287.02","metadata":false},{"id":354665,"structure_id":50731,"section_number":"22.1-287.03","catch_line":"Unique student identification numbers","url":"\/22.1-287.03\/","token":"22.1\/14\/5\/22.1-287.03","metadata":false},{"id":354666,"structure_id":50731,"section_number":"22.1-287.04","catch_line":"Uniformed services-connected students","url":"\/22.1-287.04\/","token":"22.1\/14\/5\/22.1-287.04","metadata":false},{"id":354667,"structure_id":50731,"section_number":"22.1-287.05","catch_line":"Student identification cards; 988 Suicide and Crisis Lifeline; requirement","url":"\/22.1-287.05\/","token":"22.1\/14\/5\/22.1-287.05","metadata":false},{"id":354668,"structure_id":50731,"section_number":"22.1-287.1","catch_line":"Directory information","url":"\/22.1-287.1\/","token":"22.1\/14\/5\/22.1-287.1","metadata":false},{"id":354673,"structure_id":50731,"section_number":"22.1-288","catch_line":"Furnishing information to public or private school or institution of higher education or private business or professional school or institution of higher education or military force","url":"\/22.1-288\/","token":"22.1\/14\/5\/22.1-288","metadata":false},{"id":354670,"structure_id":50731,"section_number":"22.1-288.1","catch_line":"Notation in school records of missing children; local law-enforcement cooperation","url":"\/22.1-288.1\/","token":"22.1\/14\/5\/22.1-288.1","metadata":false},{"id":354671,"structure_id":50731,"section_number":"22.1-288.2","catch_line":"Receipt, dissemination and maintenance of records of certain law-enforcement information","url":"\/22.1-288.2\/","token":"22.1\/14\/5\/22.1-288.2","metadata":false},{"id":354672,"structure_id":50731,"section_number":"22.1-288.3","catch_line":"Records; redaction of foster parent's address upon written request","url":"\/22.1-288.3\/","token":"22.1\/14\/5\/22.1-288.3","metadata":false},{"id":354740,"structure_id":50731,"section_number":"22.1-289","catch_line":"Transfer and management of scholastic records; disclosure of information in court notices; penalty","url":"\/22.1-289\/","token":"22.1\/14\/5\/22.1-289","metadata":false},{"id":354674,"structure_id":50731,"section_number":"22.1-289.01","catch_line":"School service providers; school-affiliated entities; school-issued devices; student personal information","url":"\/22.1-289.01\/","token":"22.1\/14\/5\/22.1-289.01","metadata":false}],"previous_section":{"id":354740,"structure_id":50731,"section_number":"22.1-289","catch_line":"Transfer and management of scholastic records; disclosure of information in court notices; penalty","url":"\/22.1-289\/","token":"22.1\/14\/5\/22.1-289","metadata":false},"metadata":false,"official_url":"https:\/\/law.lis.virginia.gov\/vacode\/22.1-289.01\/","history_text":"

This law was first created in 2015. The record of its establishment is cataloged in chapter 728<\/a> of that year\u2019s edition of \u201cActs of Assembly,\u201d the annual state publication listing all changes made to the Code of Virginia in that year. It has been modified 3 times. Those modifications are cataloged by \u201cThe Acts of Assembly,\u201d a state publication, by year and chapter. Those modifications that can be read on the General Assembly\u2019s website will be linked accordingly. Those modifications are as follows: in 2016, chapters 438<\/a>, 439<\/a>, and 468<\/a>; in 2017, chapter 518<\/a>; in 2025, chapter 364<\/a>.<\/p>","references":false,"refers_to":false,"permalink":{"id":1409603,"object_type":"law","relational_id":354674,"identifier":"22.1-289.01","token":"22.1\/14\/5\/22.1-289.01","url":"\/22.1-289.01\/","edition_id":2,"permalink":0,"preferred":1},"url":"\/22.1-289.01\/","token":"22.1\/14\/5\/22.1-289.01","dublin_core":{"Title":"School service providers; school-affiliated entities; school-issued devices; student personal information","Type":"Text","Format":"text\/html","Identifier":"\u00a7 22.1-289.01","Relation":"Code of Virginia"},"html":"\n\t\t\t\t\t\t

A.<\/span> For the purposes of this section:\n\t\t\t“Elementary and secondary school purposes<\/span>” means purposes that (i) customarily take place at the direction of an elementary or secondary school, elementary or secondary school teacher, or school division; (ii) aid in the administration of school activities, including instruction in the classroom or at home; administrative activities; and collaboration between students, school personnel, or parents<\/span>; or (iii) are otherwise for the use and benefit of an elementary or secondary school.

\t\t\t“Machine-readable format<\/span>” means a structured format that can automatically be read and processed by a computer such as comma-separated values (CSV), Javascript Object<\/span> Notation (JSON), or Extensible Markup Language (XML). “Machine-readable format<\/span>” does not include portable document format (PDF).

\t\t\t“Personal profile” does not include account information that is collected and retained by a school service provider<\/span> and remains under control of a student, parent<\/span>, or elementary or secondary school.

\t\t\t“School-affiliated entity<\/span>” means any private entity that provides support to a local school division or a public elementary or secondary school in the Commonwealth. “School-affiliated entity<\/span>” includes alumni associations, booster clubs, parent<\/span>-teacher associations, parent<\/span>-teacher-student associations, parent<\/span>-teacher organizations, public education foundations, public education funds, and scholarship organizations.

\t\t\t“School-issued device<\/span>” means any technological hardware or devices that a school board<\/span>, acting independently or pursuant to a contract<\/span> with a school technology provider<\/span>, provides to individual students for their personal use on school property, at home, or both. “School-issued device<\/span>” includes any laptop, tablet, or other technological device.

\t\t\t“School service” means a website, mobile application, or online service that (i) is designed and marketed primarily for use in elementary or secondary schools; (ii) is used (a) at the direction of teachers or other employees at elementary or secondary schools or (b) by any school-affiliated entity<\/span>; and (iii) collects and maintains, uses, or shares student personal information<\/span>. “School service” does not include a website, mobile application, or online service that is (a) used for the purposes of college and career readiness assessment or (b) designed and marketed for use by individuals or entities generally, even if it is also marketed for use in elementary or secondary schools.

\t\t\t“School service provider<\/span>” means an entity that operates a school service pursuant to a contract<\/span> with a local school division in the Commonwealth.

\t\t\t“School technology provider<\/span>” means an entity that provides, pursuant to a contract<\/span> with a school board<\/span> in the Commonwealth, any technological hardware or devices intended for student use as school-issued devices<\/span>.

\t\t\t“Student personal information<\/span>” means information collected through a school service that identifies a currently or formerly enrolled individual student or is linked to information that identifies a currently or formerly enrolled individual student.

\t\t\t“Targeted advertising<\/span>” means advertising that is presented to a student and selected on the basis of information obtained or inferred over time from such student’s online behavior, use of applications, or sharing of student personal information<\/span>. “Targeted advertising<\/span>” does not include advertising (i) that is presented to a student at an online location (a) on the basis of such student’s online behavior, use of applications, or sharing of student personal information<\/span> during his current visit to that online location or (b) in response to that student’s request for information or feedback and (ii) for which a student’s online activities or requests are not retained over time for the purpose of subsequent advertising. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

B.<\/span> In operating a school service or providing school-issued devices<\/span> pursuant to a contract<\/span> with a local school division, each school service provider<\/span> or school technology provider<\/span> or, in the case of any school or school board<\/span> providing any school-issued devices<\/span> independently, any school board<\/span> or school shall: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Provide clear and easy-to-understand information about the types of student personal information<\/span> it collects through any school service or through providing any school-issued devices<\/span> and how it maintains, uses, or shares such student personal information<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> Maintain a policy for the privacy of student personal information<\/span> for each school service or each school-issued device<\/span> and provide prominent notice before making material<\/span> changes to its policy for the privacy of student personal information<\/span> for the relevant school service or school-issued devices<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> Maintain a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of student personal information<\/span> and makes use of appropriate administrative, technological, and physical safeguards; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> Facilitate access to and correction of student personal information<\/span> by each student whose student personal information<\/span> has been collected, maintained, used, or shared by the school service provider<\/span> or school technology provider<\/span>, or by such student’s parent<\/span>, either directly or through the student’s school or teacher; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

5.<\/span> Collect, maintain, use, and share student personal information<\/span> only with the consent of the student or, if the student is less than 18 years of age, his parent<\/span> or for the purposes authorized in the contract<\/span> between the school division and the school service provider<\/span> or school technology provider<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

6.<\/span> When it collects student personal information<\/span> directly from the student, obtain the consent of the student or, if the student is less than 18 years of age, his parent<\/span> before using student personal information<\/span> in a manner that is inconsistent with its policy for the privacy of student personal information<\/span> for the relevant school service or school-issued device<\/span>, and when it collects student personal information<\/span> from an individual or entity other than the student, obtain the consent of the school division before using student personal information<\/span> in a manner that is inconsistent with its policy for the privacy of student personal information<\/span> for the relevant school service or school-issued device<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

7.<\/span> Require any successor entity or third party<\/span> with whom it contracts<\/span> to abide by its policy for the privacy of student personal information<\/span> and comprehensive information security program before accessing student personal information<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

8.<\/span> Upon the request of the school or school division, delete student personal information<\/span> within a reasonable period of time after such request unless the student or, if the student is less than 18 years of age, his parent<\/span> consents to the maintenance of the student personal information<\/span> by the school service provider<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

9.<\/span> For any school-issued device<\/span> that a student returns at the end of the school year or upon request of the school or school division and that shall subsequently be provided to another student, disposed of, donated, or otherwise transferred in ownership to any individual or entity other than the specific student to whom it was issued, delete any student personal information<\/span> stored in the school-issued device<\/span> within a reasonable time after such school-issued device<\/span> is returned and prior to the subsequent provision of such school-issued device<\/span> to any other student or other transfer in ownership of such school-issued device<\/span>; and <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

10.<\/span> Provide, upon request, either directly to the student or his parent<\/span> or through the school, access to an electronic copy of such student’s personal information in a manner consistent with the functionality of the school service or school-issued device<\/span>. Contracts<\/span> between local school boards<\/span> and school service providers<\/span> or school technology providers<\/span> may require that such electronic copy be in a machine-readable format<\/span>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

C.<\/span> In operating a school service or providing any school-issued devices<\/span> pursuant to a contract<\/span> with a local school division, no school service provider<\/span> or school technology provider<\/span> or, in the case of any school or school board<\/span> providing any school-issued devices<\/span> independently, any school board<\/span> or school shall knowingly: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Use or share any student personal information<\/span> for the purpose of targeted advertising<\/span> to students; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> Use or share any student personal information<\/span> to create a personal profile of a student other than for elementary and secondary school purposes<\/span> authorized by the school division, with the consent of the student or, if the student is less than 18 years of age, his parent<\/span>, or as otherwise authorized in the contract<\/span> between the school division and the school service provider<\/span> or school technology provider<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> Sell student personal information<\/span>, except to the extent that such student personal information<\/span> is sold to or acquired by a successor entity that purchases, merges with, or otherwise acquires the school service provider<\/span> or school technology provider<\/span>, subject to the provisions of subdivision B 7; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> Except as provided in subdivision E 4, use any school-issued device<\/span> provided pursuant to any such contract<\/span>, or grant any school board<\/span> or other entity with the ability to use any school-issued device<\/span>, to access or monitor (i) location-tracking features; (ii) audio or visual receiving, transmitting, or recording features; or (iii) student interactions, unless such use (a) is limited to a noncommercial, educational, or instructional purpose, to the provision of technical support, or to exam proctoring by a school board<\/span> employee or a third party<\/span> pursuant to a contract<\/span> with the school board<\/span> and notice of such use is provided in advance or (b) is permitted under a judicial warrant or is necessary to comply with state or federal law<\/span>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

D.<\/span> Nothing in this section shall be construed to prohibit school service providers<\/span> or school technology providers<\/span> or, in the case of any school or school board<\/span> providing any school-issued devices<\/span> independently, any school board<\/span> or school from: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Using student personal information<\/span> for purposes of adaptive learning, personalized learning, or customized education; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> Using student personal information<\/span> for maintaining, developing, supporting, improving, or diagnosing any school service; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> Providing recommendations for employment, school, educational, or other learning purposes within a school service when such recommendation is not determined in whole or in part by payment or other consideration from a third party<\/span>; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> Disclosing student personal information<\/span> to (i) ensure legal or regulatory compliance, (ii) protect against liability, or (iii) protect the security or integrity of its school service; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

5.<\/span> Disclosing student personal information<\/span> pursuant to a contract<\/span> with a service provider, provided that the school service provider<\/span>, school technology provider<\/span>, school board<\/span>, or school (i) contractually prohibits the service provider from using any student personal information<\/span> for any purpose other than providing the contracted service to or on behalf of the school service provider<\/span>, school technology provider<\/span>, school board<\/span>, or school, (ii) contractually prohibits the service provider from disclosing any student personal information<\/span> provided by the school service provider<\/span>, school technology provider<\/span>, school board<\/span>, or school to any third party<\/span> unless such disclosure is permitted by subdivision B 7, and (iii) requires the service provider to comply with the requirements set forth in subsection B and prohibitions set forth in subsection C. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

E.<\/span> Nothing in this section shall be construed to: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Impose a duty upon a provider of an electronic store, gateway, marketplace, forum, or means for purchasing or downloading software or applications to review or enforce compliance with this section with regard to any school service provider<\/span> whose school service is available for purchase or download on such electronic store, gateway, marketplace, forum, or means; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> Impose liability on an interactive computer service, as that term is defined in 47 U.S.C. § 230(f), for content provided by another individual; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> Prohibit any student from downloading, exporting, transferring, saving, or maintaining his personal information, data, or documents; or <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> Prohibit any school board<\/span> from requesting or prohibit any provider from granting any school board<\/span> access to or the ability to monitor school-issued devices<\/span> to ensure compliance with a school code of conduct or otherwise limit the ability of any school board<\/span> to use software filters to monitor school-issued devices<\/span> for certain safety threats, self-harm prevention, or other risk indicators. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

F.<\/span> No school service provider<\/span> in operation on June 30, 2016, shall be subject to the provisions of this section until such time as the contract<\/span> to operate a school service is renewed. <\/i><\/a><\/p><\/section>","plain_text":" CODE OF VIRGINIA\n\nSCHOOL SERVICE PROVIDERS; SCHOOL-AFFILIATED ENTITIES; SCHOOL-ISSUED DEVICES;\nSTUDENT PERSONAL INFORMATION (\u00a7 22.1-289.01)\n\nA. For the purposes of this section:\n\t\t\t“Elementary and secondary school purposes” means purposes that\n(i) customarily take place at the direction of an elementary or secondary\nschool, elementary or secondary school teacher, or school division; (ii) aid in\nthe administration of school activities, including instruction in the classroom\nor at home; administrative activities; and collaboration between students,\nschool personnel, or parents; or (iii) are otherwise for the use and benefit of\nan elementary or secondary school.\t\t\t“Machine-readable format” means\na structured format that can automatically be read and processed by a computer\nsuch as comma-separated values (CSV), Javascript Object Notation (JSON), or\nExtensible Markup Language (XML). “Machine-readable format” does not\ninclude portable document format (PDF).\t\t\t“Personal profile” does\nnot include account information that is collected and retained by a school\nservice provider and remains under control of a student, parent, or elementary\nor secondary school.\t\t\t“School-affiliated entity” means any private\nentity that provides support to a local school division or a public elementary\nor secondary school in the Commonwealth. “School-affiliated entity”\nincludes alumni associations, booster clubs, parent-teacher associations,\nparent-teacher-student associations, parent-teacher organizations, public\neducation foundations, public education funds, and scholarship\norganizations.\t\t\t“School-issued device” means any technological\nhardware or devices that a school board, acting independently or pursuant to a\ncontract with a school technology provider, provides to individual students for\ntheir personal use on school property, at home, or both. “School-issued\ndevice” includes any laptop, tablet, or other technological\ndevice.\t\t\t“School service” means a website, mobile application, or\nonline service that (i) is designed and marketed primarily for use in elementary\nor secondary schools; (ii) is used (a) at the direction of teachers or other\nemployees at elementary or secondary schools or (b) by any school-affiliated\nentity; and (iii) collects and maintains, uses, or shares student personal\ninformation. “School service” does not include a website, mobile\napplication, or online service that is (a) used for the purposes of college and\ncareer readiness assessment or (b) designed and marketed for use by individuals\nor entities generally, even if it is also marketed for use in elementary or\nsecondary schools.\t\t\t“School service provider” means an entity that\noperates a school service pursuant to a contract with a local school division in\nthe Commonwealth.\t\t\t“School technology provider” means an entity\nthat provides, pursuant to a contract with a school board in the Commonwealth,\nany technological hardware or devices intended for student use as school-issued\ndevices.\t\t\t“Student personal information” means information\ncollected through a school service that identifies a currently or formerly\nenrolled individual student or is linked to information that identifies a\ncurrently or formerly enrolled individual student.\t\t\t“Targeted\nadvertising” means advertising that is presented to a student and selected\non the basis of information obtained or inferred over time from such\nstudent’s online behavior, use of applications, or sharing of student\npersonal information. “Targeted advertising” does not include\nadvertising (i) that is presented to a student at an online location (a) on the\nbasis of such student’s online behavior, use of applications, or sharing\nof student personal information during his current visit to that online location\nor (b) in response to that student’s request for information or feedback\nand (ii) for which a student’s online activities or requests are not\nretained over time for the purpose of subsequent advertising.\n\nB. In operating a school service or providing school-issued devices pursuant to\na contract with a local school division, each school service provider or school\ntechnology provider or, in the case of any school or school board providing any\nschool-issued devices independently, any school board or school shall:\n\n 1. Provide clear and easy-to-understand information about the types of student\n personal information it collects through any school service or through\n providing any school-issued devices and how it maintains, uses, or shares such\n student personal information;\n\n 2. Maintain a policy for the privacy of student personal information for each\n school service or each school-issued device and provide prominent notice\n before making material changes to its policy for the privacy of student\n personal information for the relevant school service or school-issued devices;\n\n 3. Maintain a comprehensive information security program that is reasonably\n designed to protect the security, privacy, confidentiality, and integrity of\n student personal information and makes use of appropriate administrative,\n technological, and physical safeguards;\n\n 4. Facilitate access to and correction of student personal information by each\n student whose student personal information has been collected, maintained,\n used, or shared by the school service provider or school technology provider,\n or by such student’s parent, either directly or through the\n student’s school or teacher;\n\n 5. Collect, maintain, use, and share student personal information only with\n the consent of the student or, if the student is less than 18 years of age,\n his parent or for the purposes authorized in the contract between the school\n division and the school service provider or school technology provider;\n\n 6. When it collects student personal information directly from the student,\n obtain the consent of the student or, if the student is less than 18 years of\n age, his parent before using student personal information in a manner that is\n inconsistent with its policy for the privacy of student personal information\n for the relevant school service or school-issued device, and when it collects\n student personal information from an individual or entity other than the\n student, obtain the consent of the school division before using student\n personal information in a manner that is inconsistent with its policy for the\n privacy of student personal information for the relevant school service or\n school-issued device;\n\n 7. Require any successor entity or third party with whom it contracts to abide\n by its policy for the privacy of student personal information and\n comprehensive information security program before accessing student personal\n information;\n\n 8. Upon the request of the school or school division, delete student personal\n information within a reasonable period of time after such request unless the\n student or, if the student is less than 18 years of age, his parent consents\n to the maintenance of the student personal information by the school service\n provider;\n\n 9. For any school-issued device that a student returns at the end of the\n school year or upon request of the school or school division and that shall\n subsequently be provided to another student, disposed of, donated, or\n otherwise transferred in ownership to any individual or entity other than the\n specific student to whom it was issued, delete any student personal\n information stored in the school-issued device within a reasonable time after\n such school-issued device is returned and prior to the subsequent provision of\n such school-issued device to any other student or other transfer in ownership\n of such school-issued device; and\n\n 10. Provide, upon request, either directly to the student or his parent or\n through the school, access to an electronic copy of such student’s\n personal information in a manner consistent with the functionality of the\n school service or school-issued device. Contracts between local school boards\n and school service providers or school technology providers may require that\n such electronic copy be in a machine-readable format.\n\nC. In operating a school service or providing any school-issued devices pursuant\nto a contract with a local school division, no school service provider or school\ntechnology provider or, in the case of any school or school board providing any\nschool-issued devices independently, any school board or school shall knowingly:\n\n 1. Use or share any student personal information for the purpose of targeted\n advertising to students;\n\n 2. Use or share any student personal information to create a personal profile\n of a student other than for elementary and secondary school purposes\n authorized by the school division, with the consent of the student or, if the\n student is less than 18 years of age, his parent, or as otherwise authorized\n in the contract between the school division and the school service provider or\n school technology provider;\n\n 3. Sell student personal information, except to the extent that such student\n personal information is sold to or acquired by a successor entity that\n purchases, merges with, or otherwise acquires the school service provider or\n school technology provider, subject to the provisions of subdivision B 7; or\n\n 4. Except as provided in subdivision E 4, use any school-issued device\n provided pursuant to any such contract, or grant any school board or other\n entity with the ability to use any school-issued device, to access or monitor\n (i) location-tracking features; (ii) audio or visual receiving, transmitting,\n or recording features; or (iii) student interactions, unless such use (a) is\n limited to a noncommercial, educational, or instructional purpose, to the\n provision of technical support, or to exam proctoring by a school board\n employee or a third party pursuant to a contract with the school board and\n notice of such use is provided in advance or (b) is permitted under a judicial\n warrant or is necessary to comply with state or federal law.\n\nD. Nothing in this section shall be construed to prohibit school service\nproviders or school technology providers or, in the case of any school or school\nboard providing any school-issued devices independently, any school board or\nschool from:\n\n 1. Using student personal information for purposes of adaptive learning,\n personalized learning, or customized education;\n\n 2. Using student personal information for maintaining, developing, supporting,\n improving, or diagnosing any school service;\n\n 3. Providing recommendations for employment, school, educational, or other\n learning purposes within a school service when such recommendation is not\n determined in whole or in part by payment or other consideration from a third\n party;\n\n 4. Disclosing student personal information to (i) ensure legal or regulatory\n compliance, (ii) protect against liability, or (iii) protect the security or\n integrity of its school service; or\n\n 5. Disclosing student personal information pursuant to a contract with a\n service provider, provided that the school service provider, school technology\n provider, school board, or school (i) contractually prohibits the service\n provider from using any student personal information for any purpose other\n than providing the contracted service to or on behalf of the school service\n provider, school technology provider, school board, or school, (ii)\n contractually prohibits the service provider from disclosing any student\n personal information provided by the school service provider, school\n technology provider, school board, or school to any third party unless such\n disclosure is permitted by subdivision B 7, and (iii) requires the service\n provider to comply with the requirements set forth in subsection B and\n prohibitions set forth in subsection C.\n\nE. Nothing in this section shall be construed to:\n\n 1. Impose a duty upon a provider of an electronic store, gateway, marketplace,\n forum, or means for purchasing or downloading software or applications to\n review or enforce compliance with this section with regard to any school\n service provider whose school service is available for purchase or download on\n such electronic store, gateway, marketplace, forum, or means;\n\n 2. Impose liability on an interactive computer service, as that term is\n defined in 47 U.S.C. § 230(f), for content provided by another\n individual;\n\n 3. Prohibit any student from downloading, exporting, transferring, saving, or\n maintaining his personal information, data, or documents; or\n\n 4. Prohibit any school board from requesting or prohibit any provider from\n granting any school board access to or the ability to monitor school-issued\n devices to ensure compliance with a school code of conduct or otherwise limit\n the ability of any school board to use software filters to monitor\n school-issued devices for certain safety threats, self-harm prevention, or\n other risk indicators.\n\nF. No school service provider in operation on June 30, 2016, shall be subject to\nthe provisions of this section until such time as the contract to operate a\nschool service is renewed.\n\nHISTORY: 2015, c. 728; 2016, cc. 438, 439, 468; 2017, c. 518; 2025, c. 364.","edition":{"id":2,"name":"2026","slug":"2026","date_created":"2026-07-16 18:40:23","date_modified":"2026-08-02 15:14:36","current":1,"order_by":2,"last_import":"2026-08-02 12:37:30"}}