Student data privacy laws for edtech in California

The short version

If you remember only one thing: in California, a company that builds a product for K-12 schools can't use what it learns about students for anything other than school purposes, and the district's contract has to say who owns the data, how it's protected, and what happens to it at the end. Federal law adds rules about education records and about young children's information.

Each section below covers one law at a high level. This page is general information, not legal advice. Check specific questions with your district's counsel.

SOPIPA: what K-12 operators can't do

The Student Online Personal Information Protection Act (SOPIPA), in the California Business and Professions Code, applies to operators of websites, apps and online services that are used primarily for K-12 school purposes and were designed and marketed for that use. It applies whether or not the operator has a contract with your district, and whether or not the product is free.

• No targeted advertising to students based on information gathered through the service.
• No building a profile of a K-12 student except for K-12 school purposes.
• No selling student information.
• No disclosing student information except in specific circumstances the law allows, such as to carry out school purposes or to comply with the law.
• Operators must keep reasonable security for the information they hold.
• Operators must delete a student's information when the school or district asks, for data under the school's or district's control.

AB 1584: what the contract must say

AB 1584, now California Education Code section 49073.1, governs contracts between a local educational agency and a third party that stores or manages pupil records or provides digital educational software. A contract that doesn't comply is void if the problem isn't corrected after notice and a reasonable chance to fix it. The required terms include:

• A statement that pupil records remain the property of, and under the control of, the district.
• How students can keep control of content they create, including a way to transfer it to a personal account.
• A ban on the vendor using pupil records for anything other than what the contract allows.
• How a parent, guardian or eligible pupil can review personally identifiable information and correct errors.
• The steps the vendor takes to keep records secure and confidential.
• How the vendor will notify affected families after an unauthorized disclosure.
• A certification that records won't be kept or available to the vendor once the contract ends, and how that is enforced. Content a student created can stay in their own account if they choose.
• How the district and vendor will jointly make sure they comply with FERPA.
• A ban on using personally identifiable information in pupil records for targeted advertising.

FERPA: education records and the school official exception

The Family Educational Rights and Privacy Act (FERPA) is federal law covering education records at schools that receive funds from applicable U.S. Department of Education programs.

It gives parents the right to see their child's records and generally requires consent before personally identifiable information from those records is disclosed. Those rights pass to the student at 18 or when they enroll in a postsecondary school.

Edtech vendors usually receive records under the school official exception. That exception requires that the vendor performs a service the school would otherwise use its own staff for, that the school keeps direct control over how the records are used and maintained, and that the vendor doesn't re-disclose them. Your district's annual FERPA notice should describe who counts as a school official with a legitimate educational interest.

COPPA: children under 13

The Children's Online Privacy Protection Act (COPPA), enforced by the Federal Trade Commission, applies to commercial online services directed to children under 13 or that know they are collecting information from them. Operators must give notice and get verifiable parental consent before collecting a child's personal information, protect it, and keep it only as long as reasonably necessary.

Long-standing FTC guidance says a school can consent on parents' behalf when the information is used only for the school's educational purposes and not for any other commercial purpose. Many districts still tell families which tools their students use. The FTC finalized amendments to the COPPA Rule in 2025, so ask vendors how their practices reflect the current rule.

Extra questions for AI tools

AI tutors and assistants collect kinds of data older tools didn't, such as voice, free-form conversation and drawings. The laws above still apply, but your questions should go further:

• Is students' voice audio recorded and stored, or turned into text and discarded?
• How long are conversation transcripts kept, and can the district delete them on request?
• Is student work used to train AI models? If so, on whose permission?
• Which subprocessors, including AI model providers, receive student data, and what are they contractually allowed to do with it?
• Can a teacher or parent review what the AI said to a student?
• How are small groups protected in district reports so individual students can't be identified?
• Where is data stored, how is it encrypted, and how quickly is it removed from backups after deletion?

How Helio handles student data

• For school accounts, the school decides who sees student data, and Helio uses it only for the school. Schools and districts sign their own agreement with us.
• Speech becomes text as Helio listens. The audio is not saved.
• Each student’s saved work is locked with its own key, and deleting the work destroys the key. Backups clear within 14 days of a deletion.
• Helio has no ads, doesn’t sell data, and doesn’t use a student’s work to train models without permission.
• District reports hide any group with fewer than 5 students. Staff sign in with two-step verification.