Children's and student data laws by state

HB 1717: To create the arkansas children and teens' online privacy protection act.

This amendment modifies House Bill 1717 by adjusting technical provisions related to operators' handling of children's and teens' personal information online, including revisions to data retention, deletion request procedures, and security protections. The specific operative obligations cannot be fully determined from this amendment text alone without the underlying bill.

SB 930: Student Test Taker Privacy Protection Act: end-to-end encryption.

A business providing proctoring services to a school district, county office of education, or charter school for classroom- or course-based exams must use end-to-end encryption to provide those services. The business must collect, use, retain, and disclose only personal information strictly necessary to provide proctoring services.

Takes effect 1 January 2027

AB 1159: Student personal information.

Operators of internet websites, online services, online applications, or mobile applications designed or marketed for K-12, preschool, prekindergarten, or higher education purposes must not use covered information including persistent unique identifiers to train generative AI systems or develop AI systems. Operators must implement reasonable security, delete information upon request, and establish data retention policies.

Takes effect 1 January 2027

AB 1043: Age verification signals: software applications and online services.

Operating system providers must provide an accessible interface at account setup requiring account holders to indicate a user's birth date or age, and must send developers a digital signal via real-time API identifying the user's age bracket when requested. Developers must request signals when applications are downloaded and launched, and must treat signals as the primary age indicator.

SB 391: Community colleges: Chancellor of the California Community Colleges: data request fee policy.

The Chancellor of the California Community Colleges may implement a data request fee policy for researchers applying for access to individually identifiable data or student data. If implemented, the policy must be reviewed and approved by the Board of Governors, revised periodically, made publicly available on the chancellor's website, and comply with federal and state privacy laws. Fees cannot be imposed on state agencies (except UC, CSU, or State Department of Education), undergraduate or graduate students seeking data for individual studies, or community college faculty seeking data for individual research.

SB 25-143: Extend Prohibition on School Facial Recognition

Schools and school contractors must not process biometric identifiers without obtaining opt-in consent on a stand-alone form that specifies collection, use, and retention. Schools must retain biometric identifiers no longer than eighteen months. Schools using facial recognition for safety must disable the system immediately after identifying the individual and develop policies designating authorized personnel.

SB 5: An act concerning online safety.

Subscription-based providers must disclose key terms and conditions in writing before entering or renewing subscriptions. Frontier developers must prohibit retaliation against employees reporting catastrophic risks and establish anonymous reporting processes. Large frontier developers must investigate reports and provide monthly updates. Operators of AI companions must detect suicidal ideation and provide mental health resources, and must not provide companions to minors capable of encouraging self-harm.

Took effect 1 October 2026

SB 1295: An act concerning broadband internet, gaming, social media, online services and consumer contracts.

Qualified broadband internet access service providers must offer affordable broadband service costing no more than forty dollars monthly to eligible households by October 1, 2026, meeting minimum speed requirements of 100 Mbps downstream and 5-20 Mbps upstream depending on date. Providers must make commercially reasonable efforts to publicize availability and submit annual reports to the Department of Energy and Environmental Protection.

Took effect 1 July 2026

SB 540: Online Internet Safety; certain disclosures related to conversational AI services; require

Operators of AI companion chatbots must disclose to users they are interacting with an AI system at the beginning of each interaction and every three hours thereafter (or hourly for minors). Operators must implement protocols to detect severe harm and refer users to crisis resources, prevent sexually explicit content and romantic simulation with minors, and offer parental controls for minor accounts.

Takes effect 1 July 2027

SB 3001: Relating to artificial intelligence.

Operators of conversational artificial intelligence services must disclose that users are interacting with artificial intelligence rather than humans. For minors, operators must provide persistent visible disclaimers or session-based reminders every three hours. Operators must adopt crisis intervention protocols, prevent sexual content generation for minors, minimize personal data collection, prohibit targeted advertising, and submit annual reports beginning January 1, 2028.

HB 5511: Digital age assurance

Covered manufacturers must provide an accessible interface by January 1, 2028 requiring account holders to indicate a user's birth date or age, and transmit age bracket data signals to covered operators upon user consent. Covered operators must request age bracket signals, treat them as authoritative for users under 18, and implement default privacy protections for covered minors including restricted visibility, disabled direct messaging with adults, and prohibited addictive feeds without verifiable parental consent.

Takes effect 1 January 2028

HF 4138: Social media platform requirements established relating to accounts for minors, and enforcement mechanisms established for regulations on child social media accounts.

Covered social media platforms must obtain verifiable parental consent before creating or maintaining accounts for children age 15 or younger. Platforms must set child accounts to maximum privacy by default, prohibit addictive interface features and targeted paid advertising on child accounts, estimate user ages within specified timeframes and confidence thresholds, and terminate child accounts upon request within seven days.

HB 599: Revise student data collection laws

Government entities must not interfere with parental rights to direct child upbringing, education, and health care unless furthering a compelling governmental interest by the least restrictive means. Parents must be notified of physical and mental health surveys and screenings. Parents may opt children out of personal analysis, evaluation, survey, or data collection not requiring personally identifiable information, and opt in to those requiring such information.

HB 631: Revise student online protection laws related to postsecondary opportunities

Amends Montana student data privacy law to exclude courses providing postsecondary credit and work-based learning courses from the definition of K-12 school purposes, removing data privacy restrictions for those educational activities.

LB 504: Adopt the Age-Appropriate Online Design Code Act

Covered online services must provide covered minors with accessible tools to limit communications, control design features, manage personalized recommendations, restrict in-game purchases, and control geolocation tracking. They must collect only minimum necessary personal data, prohibit targeted advertising to covered minors, restrict notifications during specified hours, and provide parents with monitoring and control tools.

SB 445: Revises provisions relating to the privacy of data concerning pupils. (BDR 34-854)

HB 1727: relative to student data sharing for the Summer EBT program.

The department of education shall provide the department of health and human services with the name, date of birth, and household address of students eligible for free or reduced-price meals for Summer EBT enrollment. School districts and school administrative units shall provide parents or guardians with a distinct notice and opt-out form within 15 days of the free or reduced-price meals decision. Students are automatically enrolled in Summer EBT unless parents or guardians return the opt-out form within 15 days.

HB 1460: prohibiting the sale of a child's personal data.

Persons subject to RSA 507-H:6, I must not sell a child's personal data. The act adds this prohibition to existing expectations of privacy requirements effective January 1, 2027.

Takes effect 1 January 2027

A 4015: "New Jersey Kids Code Act"; adopts New Jersey Age-Appropriate Design Code and requires certain online service providers to implement certain measures concerning minors' use of online service.*

Covered online service providers must implement default privacy settings providing the highest protection for minors, prohibit reducing privacy settings, refrain from targeted advertising to minors, avoid dark patterns, and issue annual reports detailing design features, data practices, and usage metrics prepared by independent third-party auditors.

SB 133: Ncccs lms/nclds.

The State Board of Community Colleges must conduct a competitive solicitation for a learning management system for all community colleges by December 31, 2025, and complete transition to the new system by December 31, 2027. Public school units, community colleges, constituent institutions of The University of North Carolina, and State agencies must comply with data requirements and transfer student and workforce data to the North Carolina Longitudinal Data System according to the Center's implementation schedule and data security plan.

HB 1357: AN ACT to amend and reenact subsection 1 of section 15.1-06-06, and sections 15.1-07-25.3 and 15.1-07-33 of the North Dakota Century Code, relating to protection of student data and data sharing agreements; and to provide an effective date.

Each school district board must adopt a policy protecting student data. The policy must require permission from the board before sharing student data with non-employees or other entities, except parents or as required by law. School districts may share data with state entities using a student information system or state longitudinal dashboard if a data sharing agreement exists. The superintendent must compile lists of individuals and entities receiving student data and school personnel with data access.

SB 1734: Schools; creating the Oklahoma Responsible Technology in Schools Act; requiring development of guidance for use of artificial intelligence and emerging technologies. Effective date. Emergency.

School district boards of education must adopt policies governing artificial intelligence and emerging technologies use by the beginning of the 2027-2028 school year. All classroom AI tools must operate with educator direction and human-in-the-loop oversight. School districts must provide parents annual written disclosure identifying AI tools in use, vendors, student data collected, and educational purposes. Parents may opt students out of student-facing AI tools without academic penalty.

Took effect 1 July 2026

HB 2508: Relating to student data; and declaring an emergency.

HB 2008: Relating to consumer protection.

Amends Oregon's consumer protection law to modify the definition of personal data subject to sale restrictions, specifying that location data accurate within 1,750 feet is covered, while excluding communication content and utility metering infrastructure data.

H 4591: Stop Harm from Addictive Social Media

Covered social media platforms must estimate account holder age within fourteen days of first trigger date, treat those under sixteen as children unless eighty percent confident they are over fifteen, obtain verifiable parental consent before creating or maintaining child accounts, set child accounts to maximum privacy by default, prohibit addictive interface features and profile-based paid advertising for children, and terminate child accounts lacking parental consent.

Takes effect 1 January 2027

H 3431: South Carolina Social Media Regulation Act

Covered online services must exercise reasonable care to prevent harm to minors from compulsive usage, psychological harm, emotional distress, privacy violations, identity theft, discrimination, and financial or physical injury. Services must provide users tools to disable design features, limit time spent, control purchases, restrict messaging, and opt out of personalized recommendations. Services must collect only minimum necessary personal data, prohibit targeted advertising to minors, and establish parental monitoring tools.

SB 296: Student Consent Amendments

Education entities and institutions of higher education must disclose student educational data only with informed consent, beginning July 1, 2027, through a secure digital mechanism as the primary method. They must prohibit bundling unrelated terms with consent requests and cannot deny, delay, or restrict a student's ability to grant compliant informed consent. Parents must provide consent for students under 18.

Took effect 1 July 2026

HB 55: Privacy Compliance for Education Technology Vendors

Education entities or government agencies contracting with third-party contractors must include specified privacy provisions in contracts, notify contractors of unauthorized student data use within 30 days, and terminate contracts if violations are not remedied within 30 days. Third-party contractors must use student data only for contracted purposes.

Took effect 1 July 2026

SB 142: App Store Accountability Act

App store providers must verify user age category, obtain verifiable parental consent from parents of minors before allowing downloads or purchases, notify users and parents of significant changes, share age category data and consent status with developers, and protect age verification data using encryption. Developers must verify age category and parental consent through app stores and may not enforce contracts against minors without verified parental consent.

Took effect 7 May 2025

S 69: An act relating to an age-appropriate design code

Covered businesses must configure default privacy settings for covered minors to the highest level of privacy, prohibit collection of unnecessary personal data, provide transparency about algorithmic recommendation systems and data practices, and not send push notifications between midnight and 6 a.m. Covered businesses must honor account deletion requests within 15 days.

Takes effect 1 January 2027

HB 971: College student-athletes; biometric data, protections and limitations.

Institutions must not disclose enrolled student-athletes' biometric data to outside individuals or entities without prior written consent. No individual or entity may make possession, use, ownership of, or rights to student-athlete biometric data a condition of any contract for name, image, or likeness rights without separate prior written consent.

Took effect 1 July 2026

SB 854: Consumer Data Protection Act; social media platforms, responsibilities and prohibitions to minors.

Controllers and processors operating social media platforms must use commercially reasonable methods to determine if a user is a minor and limit minors' daily use to one hour per service or application, allowing parents to adjust limits with verifiable consent. Age-determination information cannot be used for other purposes.

Took effect 1 January 2026

SB 1486: Public schools; protection of student records and personal information, policies and procedures.

School service providers and school technology providers must collect student personal information only with consent or for authorized contract purposes, maintain comprehensive information security programs, provide access to and correction of student data, and prohibit targeted advertising, personal profiling for non-educational purposes, and sale of student information. They must not use school-issued devices for location tracking, audio/visual monitoring, or interaction monitoring except for educational, technical support, or exam-proctoring purposes with advance notice.