FERPA and State Student Privacy Laws: The Stricter Layer

Four gaps. Vendors: FERPA binds schools; vendors feel it only through contracts, and only the five-year data ban reaches them directly, states imposed statutory duties on operators themselves. Commercial use: FERPA says nothing explicit about advertising or profiling built on lawfully received data, SOPIPA-style laws prohibit targeted ads, profiling for non-educational purposes, and sale outright. Security: FERPA contains no security standard at all, states mandate reasonable security, and New York requires NIST Cybersecurity Framework alignment. Breach: FERPA has no breach-notification provision, state student laws and general breach statutes fill it, some with education-specific clocks and, in New York, vendor-paid per-student penalties. Add enforcement reality (no private FERPA suit after Gonzaga, versus state AG actions), and the state layer is where modern student-privacy liability actually lives.

California's Student Online Personal Information Protection Act (effective 2016) binds operators of sites and apps designed and marketed for K-12 purposes, no contract, no consent framework, direct statutory duties: no targeted advertising on the service or using data acquired from it; no profiling students except for K-12 purposes; no selling student information; no disclosure except enumerated purposes; reasonable security; and deletion of a student's data at district request. It also expressly permits legitimate uses: adaptive learning, maintaining the service, and improvement within K-12 purposes. Roughly two dozen states copied it nearly verbatim (Delaware, Maryland, Georgia, Kansas, Oregon, Washington and more), making the SOPIPA prohibition set the national baseline for edtech operators regardless of where they incorporate. Its enforcement runs through state UDAP/AG authority, no private right of action, but the prohibitions also become FTC Section 5 hooks when stated in privacy policies.

Process depth. 2-d (2014, with 2020 implementing regulations, Part 121) requires each educational agency to publish a Parents' Bill of Rights and attach supplemental information for every third-party contractor contract; mandates specific contract terms (exclusive purposes, subcontractor flow-down, expiration and data return/deletion, challenge rights, security protections including encryption); requires agencies and vendors to align with the NIST Cybersecurity Framework; obliges districts to appoint a Data Protection Officer; and requires annual employee training. Vendor breach consequences are concrete: report to the district within 7 days, and the state can impose penalties on vendors up to $10 per student affected (statutory maximums apply), plus disqualification exposure. For vendors, 2-d compliance means a New York-specific rider on the national DPA, published data-security disclosures per contract, and NIST-mapped security documentation, the most paperwork-intensive state regime in the sector.

Less permissively than vendors assume. SOPIPA allows de-identified data use within the service and for demonstrating effectiveness, and aggregated de-identified data for development and improvement, but the de-identification must actually hold, small-cohort education data (a rural district's eighth grade) re-identifies easily, and regulators evaluate the claim, not the label. New York's Part 121 requires de-identification consistent with FERPA standards and bars re-identification attempts. Several states restrict even de-identified data sale or require contractual re-identification bans downstream. Colorado's Student Data Transparency Act adds publication duties: districts must post what data goes to which vendors, making quiet de-identified-data commerce visible. The safe architecture: de-identify to a documented standard (expert-style justification, k-anonymity thresholds for small cohorts), bind every recipient against re-identification, and treat 'we might sell aggregate insights someday' as a decision requiring counsel, not a default.

Build once to the composite ceiling. Prohibitions: adopt SOPIPA's bans (no targeted ads, no non-educational profiling, no sale) as absolute product rules, they recur in two dozen states and align with the FTC's posture anyway. Process: build the New York 2-d artifact set (published security disclosures, NIST CSF mapping, parents' bill of rights supplements, 7-day breach clocks) as your national capability, since it supersets most states' process demands. Contracts: negotiate from the SDPC national DPA with state-specific exhibits rather than bespoke agreements, the consortium maintains state versions tracking local requirements. Registries: several states (Utah, Connecticut practice) maintain vendor registries or standard-contract regimes, get listed. Monitoring: assign ownership for tracking new statutes and amendments each legislative season; the count still grows yearly. The alternative, fifty postures, fails commercially: district procurement officers reject vendors whose paperwork does not already match their state's checklist.