California. Children's privacy. Act

SOPIPAStudent Online Personal Information Protection Act (Cal. Bus. & Prof. Code § 22584)

In force

Partly verified

Medium confidence. Representative of ~40 state student privacy laws. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.

§1Summary

Synopsis

Prohibits operators of K-12 online services from targeted advertising to students, building profiles for non-educational purposes and selling student information, and requires reasonable security and deletion on request.

Key themes

student data
ed-tech
targeted advertising ban
sale ban
security
deletion

Unique features

Applies directly to ed-tech operators regardless of contract with schools; model for many other state student privacy laws.

SaaS relevance

Any ed-tech SaaS designed and marketed for K-12 use in California is covered.

§2Obligations

Extraterritorial: Yes
Breach notification: None
DPO: No
Cross-border transfers: None
Maximum penalty: Unfair Competition Law penalties (up to $2,500 per violation)

§3Dates

Key dates

Adopted 29 September 2014
In force 1 January 2016

§4Text and authority

Text

Authoritative text leginfo.legislature.ca.gov

Authority

California Attorney General

§5Where it applies

Domestic law of: California

§6Sources and verification

Sources consulted

oag.ca.gov

Verification

Medium confidence.

Partly verified

Medium confidence. Representative of ~40 state student privacy laws. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.