CDT’s Consumer Privacy Legislation and What It Means for the Education Sector

CDT recently put forth a draft federal privacy bill for discussion as well as expanded its focus on student privacy. As momentum grows toward passing federal legislation that provides comprehensive protections for personal information that can’t be signed away, it is important to understand how these bills will affect the education sector. As a first step, the following analysis identifies the considerations of CDT’s draft bill for the education sector that will warrant thoughtful discussion in the new Congress.

 

This Table in .PDF

 

Topics	Considerations
Preemption: Schools/districts/CMOs	Public schools (e.g. traditional neighborhood schools and charter schools), local education agencies (e.g. school districts, charter management organizations), and state education agencies are exempted from CDT’s consumer privacy bill. Non-public schools (e.g. private schools, homeschools) are covered by CDT’s consumer privacy bill.
Preemption: Data and technology vendors	Vendors working on behalf of a public school, district, or state are exempted from CDT’s consumer privacy bill. This would include data that are collected by vendors via devices and applications at the direction of public school. Vendors that are not working on behalf of a public school (e.g. collecting data directly from students and families, working on behalf of a non-public school) are covered by CDT’s consumer privacy bill.
Federal laws: Children’s Online Privacy Protection Act (COPPA)	CDT’s consumer privacy bill does not preempt COPPA with the exception of the limits on the disclosure of children’s information to third parties and the use of children’s information for targeted advertising purposes  (Section 5 of CDT’s bill).
Federal laws: Family Educational Rights and Privacy Act (FERPA)	CDT’s consumer privacy bill does not preempt FERPA.
Biometric data	The bill permits covered entities to collect and use biometric data if it is necessary to provide service that has been requested but cannot use it for another purpose beyond the reason it was collected.
Age for portability and deletion rights	The bill does not define an age for when students and/or their parents can exercise portability and deletion rights.
Prohibition of targeted advertising for children under age 13	CDT’s bill prohibits covered entities from using information collected from children under age 13 for targeted advertising purposes; however, the bill does not include a definition of targeted advertising.