Skip to Content

Privacy & Data

Surveying State Student Privacy Laws


Policymakers in education, privacy advocates, parents, and those working in education technology (EdTech) are often pupils themselves – of student privacy laws. In the absence of a comprehensive baseline consumer privacy law, student privacy is addressed by a patchwork of state and federal laws. With more and more states legislating around privacy in new and novel ways, understanding these laws has become challenging.

To help sort through this maze of laws, CDT developed a state-by-state survey of student privacy laws, along with a great team at BakerHostetler. This student privacy compendium is a tremendous resource for privacy advocates, policymakers, and anyone who wants to know more about how student data in their state is protected.

California’s Student Online Personal Information Protect Act (SOPIPA) is an example of a state developing a comprehensive law for student privacy and serves as a model for many other states thinking about the issue. However, as the compendium makes clear, many state laws are far less protective and use very different approaches, including variations in when personally identifiable information may be collected and stored, or in determining when school administrators and third parties have access to student data and what they are allowed to do with it.

Federal laws that offer some protections for the privacy of student data include the Family Educational Rights and Privacy Act (FERPA) and the Children’s Online Privacy Protection Act (COPPA). These laws protect educational records, which include student course schedules and grades received, and requiring parental consent before registering for certain online services. But both laws have failed to keep up with the pace of innovation in EdTech, leading to more aggressive legislation in some states, as detailed in the compendium.

Surveying 50 states is not easy work and a lot of smart people put in many hours creating this resource. I’d like to thank Alex Bradshaw, Ian Williams, and Vijay Kasschau from CDT for their contributions. In addition to the folks at BakerHostetler, Will Hellmuth was also instrumental in moving the project forward.