language: en · last checked: 2026-10-26

Arkansas — Student Data Vendor Security Act (Act 754 of 2023; Ark. Code Ann. §§6-18-2601 to 6-18-2608)

The Arkansas act that makes every local education agency's contracts carry express privacy and security provisions, requires published lists of school service contract providers and on-demand providers, and binds contract providers to data transparency, use limits, security and destruction duties. Reproduced from the enrolled act; the section numbers are the act's own (6-18-2501 to 6-18-2508), codified as 6-18-2601 to 6-18-2608.

SECTION 1. (Subchapter 25 — Student Data Vendor Security Act)

Verbatim from Act 754 of 2023, as enrolled and published by the Arkansas General Assembly. See Meta.

SECTION 1. Arkansas Code Title 6, Chapter 18, is amended to add an additional subchapter to read as follows:

Subchapter 25 — Student Data Vendor Security Act

6-18-2501. Title. (codified as Ark. Code Ann. §6-18-2601)

Verbatim from Act 754 of 2023, as enrolled and published by the Arkansas General Assembly; the section number is the act's own. See Meta.

This subchapter shall be known and may be cited as the “Student Data Vendor Security Act”.

6-18-2502. Purpose. (codified as Ark. Code Ann. §6-18-2602)

Verbatim from Act 754 of 2023, as enrolled and published by the Arkansas General Assembly; the section number is the act's own. See Meta.

The purpose of this subchapter is to increase security and transparency in the sharing and use of student data with and by third party vendors.

6-18-2503. Definitions. (codified as Ark. Code Ann. §6-18-2603)

Verbatim from Act 754 of 2023, as enrolled and published by the Arkansas General Assembly; the section number is the act's own. See Meta.

As used in this subchapter:

(1) “Affiliate” means a legal entity that controls, is controlled by, or is under common control with another legal entity;

(2) “Control” means:

(A) Ownership of, or the power to vote, more than fifty percent (50%) of the outstanding voting securities of a company; or
(B) Control in any manner over the election of a majority of the directors or of individuals exercising similar management functions of a company;

(3) “Deidentified data” means data that cannot reasonably be linked to an identified or identifiable natural person;

(4) “Destroy” means to remove student personally identifiable information so that the information is permanently irretrievable in the normal course of business;

(5) "Local education agency" means:

(A) A public school district; or
(B) An open-enrollment public charter school;

(6) “Parent” means:

(A) The biological or adoptive parent of a student;
(B) A student's legal guardian; or
(C) A person standing in loco parentis to a student;

(7) “Public education entity” means:

(A) The Department of Education;
(B) A public school within a public school district; or
(C) An open-enrollment public charter school;

(8)

(A) “School service” means a website, online service, online application, or mobile application that:
- (i) Is designed and marketed primarily for use in a preschool, elementary school, or secondary school;
- (ii) Is used at the direction of teachers or other employees of a local education agency; and
- (iii) Collects, maintains, or uses student personally identifiable information.
(B) “School service” does not include a website, online service, online application, or mobile application that is designed and marketed for use by individuals or entities generally, even if the website, online service, online application, or mobile application is also marketed to a preschool, elementary school, or secondary school;

(9) “School service contract provider” means an entity, other than a local education agency or an institution of higher education, that enters into a formal, negotiated contract with a public education entity to provide a school service;

(10) “School service on-demand provider” means an entity, other than a public education entity or an institution of higher education, that provides a school service to a public education entity, subject to agreement by the public education entity, or an employee of the public education entity, to standard, nonnegotiable terms and conditions of service established by the entity;

(11)

(A) “Student personally identifiable information” means information that, alone or in combination, personally identifies an individual student or the student’s parent or family, and that is collected, maintained, generated, or inferred by:
- (i) A public education entity, either directly or through a school service;
- (ii) A school service contract provider; or
- (iii) A school service on-demand provider.
(B) “Student personally identifiable information” does not include deidentified data;

(12)

(A) “Targeted advertising” means selecting and sending advertisements to a student based on personal data obtained or inferred over time from the student’s online behavior, use of applications, or student personally identifiable information.
(B) “Targeted advertising” does not include:
- (i) Advertising to a student:
  - (a) At an online location based on the student’s current visit to that location or in response to the student’s request for information or feedback; and
  - (b) Without the collection and retention of a student’s online activities over time;
- (ii) Adaptive learning, personalized learning, or customized education;
- (iii) With the consent of a student or the student’s parent, using the student’s personally identifiable information to identify for the student institutions of higher education or scholarship providers that are seeking students who meet specific criteria; or
- (iv) Processing personal data solely for measuring or reporting advertising performance, reach, or frequency; and

(13)

(A) “Vendor” means a business or other organization with which a public education entity contracts for a product or service.
(B) “Vendor” includes a school service contract provider and a school service on-demand provider.

6-18-2504. Local education agency — Vendor security and transparency. (codified as Ark. Code Ann. §6-18-2604)

Verbatim from Act 754 of 2023, as enrolled and published by the Arkansas General Assembly; the section number is the act's own. See Meta.

(a) Each local education agency shall ensure that all contracts that disclose or make available student personally identifiable information to vendors, including school service contract providers, school service on-demand providers, and other third parties, including without limitation subcontractors of contract providers, include express provisions that safeguard the privacy and security of student personally identifiable information.

(b)

(1)
- (A) Each local education agency shall maintain a list of the school service contract providers that the local education agency contracts with for school services that include or make available student personally identifiable information.
- (B) A local education agency shall:
  - (i) At a minimum, update the list of school service contract providers required under subdivision (b)(1)(A) of this section at the beginning and mid-point of each school year;
  - (ii) Upon the request of a parent, provide a copy of the list required under subdivision (b)(1)(A) of this section; and
  - (iii) Maintain a copy of each contract between the local education agency and a school service contract provider.
(2)
- (A) A local education agency shall ensure that the terms of a contract entered into or renewed by the local education agency with a school service contract provider on and after the effective date of this act, at a minimum, require the school service contract provider to comply with the requirements in § 6-18-2505 and § 6-18-2507.
- (B)
  - (i) If a school service contract provider commits a material breach of a contract that involves the misuse or unauthorized release of student personally identifiable information, the local education agency shall determine whether to terminate the contract at the direction of, or in accordance with a policy adopted by, the governing body of the local education agency.
  - (ii) At a minimum, within a reasonable time after the local education agency identifies the existence of a material breach of contract, the local education agency shall:
    - (a) Investigate the nature of the material breach;
    - (b) Provide an opportunity for the school service contract provider to respond concerning the alleged material breach;
    - (c) Obtain the advice and direction of the governing body of the local education agency; and
    - (d) Determine whether to terminate or continue the contract with the school service contract provider.
(3) On and after the effective date of this act, a local education agency shall not enter into or renew a contract with a school service contract provider that:
- (A) Refuses to accept the terms specified in subdivision (b)(2) of this section; or
- (B) Has substantially failed to comply with one (1) or more of the requirements in § 6-18-2505 and § 6-18-2507.

(c)

(1)
- (A) Each local education agency shall maintain a list of the school service on-demand providers that the local education agency or an employee of the local education agency uses for school services that include or make available student personally identifiable information.
- (B) A local education agency shall:
  - (i) At a minimum, update the list of school service on-demand providers required under subdivision (c)(1)(A) of this section at the beginning and mid-point of each school year; and
  - (ii) Upon the request of a parent, provide a copy of the list required under subdivision (c)(1)(A) of this section and, upon further request of the parent, assist the parent in obtaining the data privacy policy of the school service on-demand providers.
(2) If a parent has evidence demonstrating that a school service on-demand provider with which a local education agency or an employee of a local education agency acting on behalf of a local education agency contracts does not substantially comply with the school service on-demand provider’s privacy policy or does not meet the requirements in § 6-18-2506(b) and § 6-18-2507(a), the parent may notify the local education agency and provide the evidence for the parent’s conclusion.
(3)
- (A) If a local education agency has evidence demonstrating that a school service on-demand provider does not substantially comply with the school service on-demand provider’s privacy policy or does not meet the requirements in § 6-18-2506(b) and § 6-18-2507(a), the local education agency may cease using or refuse to use the school service on-demand provider and prohibit employees of the local education agency from using the school service on-demand provider.
- (B) The local education agency shall notify the school service on-demand provider that the:
  - (i) Local education agency is ceasing or refusing to use the school service on-demand provider under subdivision (c)(3)(A) of this section; and
  - (ii) School service on-demand provider may submit a written response to the local education agency.
- (C) The local education agency shall:
  - (i) Notify the Department of Education if the local education agency ceases using a school service on-demand provider for the reasons described in subdivision (c)(3) of this section; and
  - (ii) Provide a copy of any written response that a school service on-demand provider submits to the local education agency under subdivision (c)(3)(b)(ii) of this section.

6-18-2505. School service contract provider — Data transparency. (codified as Ark. Code Ann. §6-18-2605)

Verbatim from Act 754 of 2023, as enrolled and published by the Arkansas General Assembly; the section number is the act's own. See Meta.

(a)

(1) Each school service contract provider shall provide clear information that is understandable by a layperson explaining:
- (A) The elements of student personally identifiable information that the school service contract provider collects;
- (B) The purpose for which the school service contract provider collects the student personally identifiable information; and
- (C) How the school service contract provider uses and shares the student personally identifiable information.
(2) The information required under subdivision (a)(1) of this section shall include all student personally identifiable information that the school service contract provider collects regardless of whether it is initially collected or ultimately held individually or in the aggregate.
(3) A school service contract provider shall:
- (A) Provide the information required under subdivision (a)(1) of this section to each public education entity that the school service contract provider contracts with in a format that is easily accessible; and
- (B) Update the information required under subdivision (a)(1) of this section as necessary to maintain accuracy.

(b) A school service contract provider shall:

(1) Provide clear notice to each public education entity that it contracts with before making material changes to its privacy policy for school services that would result in a material reduction in the level of privacy and security provided for student personally identifiable information; and
(2) Facilitate access to and the correction of any factually inaccurate student personally identifiable information by a contracting local education agency in response to a request for correction that the local education agency receives and to which the local education agency responds.

(d) Upon discovering the misuse or unauthorized release of student personally identifiable information held by a school service contract provider, a subcontractor of a school service contract provider, or a subsequent subcontractor of a school service contract provider, the school service contract provider shall notify the contracting public education entity as soon as possible, regardless of whether the misuse or unauthorized release is a result of a material breach of the terms of a contract.

6-18-2506. School service contract provider — Use of data. (codified as Ark. Code Ann. §6-18-2606)

Verbatim from Act 754 of 2023, as enrolled and published by the Arkansas General Assembly; the section number is the act's own. See Meta.

(a)

(1) A school service contract provider may collect, use, and share student personally identifiable information only:
- (A) For the purposes authorized in the contract between the school service contract provider and a public education entity; or
- (B) With the consent of the student who is the subject of the information or the student’s parent.
(2) A school service contract provider shall obtain the consent of a student or a student’s parent before using student personally identifiable information in a manner that is materially inconsistent with the contract between the school service contract provider and the public education entity that applies to the collection of the student personally identifiable information.

(b)

(1) A school service contract provider shall not:
- (A) Sell student personally identifiable information;
- (B) Use or share student personally identifiable information for purposes of targeted advertising to students; or
- (C) Use student personally identifiable information to create a personal profile of a student other than for supporting purposes authorized by the contracting public education entity or with the consent of the student or the student’s parent.
(2) Notwithstanding anything in this subchapter to the contrary, selling student personally identifiable information does not include a school service contract provider's use, sharing, or transfer of student personally identifiable information:
- (A) With or to an affiliate of the school service contract provider;
- (B) For any purpose permitted under subdivision (a)(1) of this section;
- (C) With or to a third party that processes the student personally identifiable information on behalf of the school service contract provider;
- (D) For any purpose at the direction of the contracting public education entity or with the consent of the student or the student’s parent; or
- (E) In connection with the purchase, merger, or other type of acquisition of a school service contract provider, or any assets of a school service contract provider, by another entity, so long as the successor entity continues to be subject to the provisions of this subchapter with respect to student personally identifiable information that the school service contract provider acquired while subject to this subchapter.

(c) Notwithstanding subdivision (a)(2) or subsection (b) of this section to the contrary, a school service contract provider may use or disclose student personally identifiable information:

(1)
- (A) To:
  - (i) Ensure legal or regulatory compliance or to take precautions against liability;
  - (ii) Respond to or participate in the judicial process;
  - (iii) Protect the safety of users or others on the school service contract provider’s website, online service, online application, or mobile application; or
  - (iv) Investigate a matter related to public safety.
- (B) If a school service contract provider uses or discloses student personally identifiable information as permitted under subdivision (c)(1)(A) of this section, the school service contract provider shall notify the contracting public education entity as soon as possible after the use or disclosure of the information; and
(2)
- (A) To a subcontractor only if the school service contract provider contractually requires the subcontractor to comply with this subchapter.
- (B) Subdivision (c)(2)(A) of this section shall apply to the ability of an initial or subsequent subcontractor to further subcontract.
- (C)
  - (i) If a public education entity determines that an initial or subsequent subcontractor has committed a material breach of contract that involves the misuse or unauthorized disclosure of student personally identifiable information, the public education entity shall comply with the requirements of § 6-18-2504.
  - (ii) However, the public education entity is not required to consider terminating the contract if the school service contract provider terminates the contract with the subcontractor as soon as possible after the school service contract provider knows or has reason to know of the initial or subsequent subcontractor’s material breach.

(d) A student may consent to the use, sharing, or retention of the student’s student personally identifiable information only if the student is eighteen (18) years of age or older or legally emancipated for purposes of this section.

6-18-2507. School service contract provider — Data security and destruction. (codified as Ark. Code Ann. §6-18-2607)

Verbatim from Act 754 of 2023, as enrolled and published by the Arkansas General Assembly; the section number is the act's own. See Meta.

(a)

(1) A school service contract provider shall maintain a comprehensive information security program that is reasonably designed to protect the security, privacy, confidentiality, and integrity of student personally identifiable information.
(2) The comprehensive information security program required under subdivision (a)(1) of this section shall make use of appropriate administrative, technological, and physical safeguards.

(b) During the term of a contract between a school service contract provider and a public education entity, if the contracting public education entity requests destruction of a student’s student personally identifiable information collected, generated, or inferred as a result of the contract, the contracting school service contract provider shall destroy the information as soon as practicable after the date of the request unless:

(1) The school service contract provider obtains the consent of the student or the student’s parent to retain the student’s student personally identifiable information; or
(2) The student has transferred to another public education entity and the receiving public education entity has requested that the school service contract provider retain the student’s student personally identifiable information.

(c)

(1) Following the termination or conclusion of a contract between a school service contract provider and a public education entity, the school service contract provider shall, within the time period specified in the contract, destroy all student personally identifiable information collected, generated, or inferred as a result of the contract.
(2) If the contract does not specify a period for destruction of student personally identifiable information, the school service contract provider shall destroy the information as soon as practicable after the information is no longer needed for the purpose of the contract between the school service contract provider and the public education entity.
(3) Upon request of the public education entity, the school service contract provider shall notify the public education entity of the date upon which all of the student personally identifiable information is destroyed.

6-18-2508. Exceptions — Applicability. (codified as Ark. Code Ann. §6-18-2608)

Verbatim from Act 754 of 2023, as enrolled and published by the Arkansas General Assembly; the section number is the act's own. See Meta.

(a) Notwithstanding any provision of this subchapter to the contrary, this subchapter does not prohibit the use of student personally identifiable information to:

(1) Use adaptive learning or design personalized or customized education;
(2) Maintain, develop, support, improve, or diagnose a school service contract provider’s website, online service, online application, or mobile application;
(3) Provide recommendations for school, educational, or employment purposes within a school service, so long as the response is not determined in whole or in part by payment or other consideration from a third party;
(4) Respond to a student’s request for information or for feedback so long as the information or response is not determined in whole or in part by payment or other consideration from a third party;
(5) Identify for the student, only with the written consent of the student or the student’s parent, institutions of higher education or scholarship providers that are seeking students who meet specific criteria, regardless of whether the identified institutions of higher education or scholarship providers provide consideration to the school service contract provider;
(6) In accordance with the terms of a contract between the school service contract provider and a public education entity, produce and distribute, free or for consideration, student class photos and yearbooks only to the public education entity, students, parents, or individuals authorized by parents; or
(7)
- (A) Provide for the student, only with the express written consent of the student or the student’s parent given in response to clear and conspicuous notice, access to employment opportunities, educational scholarships or financial aid, or postsecondary education opportunities, regardless of whether the school service contract provider receives consideration from one or more third parties in exchange for the student personally identifiable information.
- (B) Subdivision (a)(7)(A) of this section applies only to a school service contract provider that provides nationally recognized assessments that postsecondary institutions of higher education use in making admissions decisions.

(b) This subchapter does not:

(1) Impose a duty on a provider of interactive computer service, as defined in 47 U.S.C. Sec. 230, as it existed on January 1, 2023, to review or enforce compliance with this subchapter by school service contract providers or school service on-demand providers;
(2) Impede the ability of a student to download, export, or otherwise save or maintain his or her own student personally identifiable information or documents;
(3) Limit internet service providers from providing internet connectivity to local education agencies or to students and their families;
(4) Prohibit a school service contract provider from marketing educational products directly to parents so long as the marketing does not result from the use of student personally identifiable information obtained by the school service contract provider as a result of providing its website, online service, online application, or mobile application to a public education entity; or
(5) Impose a duty on a provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software or applications to review or enforce compliance with this subchapter on that software or those applications.

(c) The requirements in § 6-18-2505 and § 6-18-2507 shall apply to a school service contract provider that enters or renews a contract with a public education entity on or after the effective date of this act.

SECTION 2. (effective date)

Verbatim from Act 754 of 2023, as enrolled and published by the Arkansas General Assembly. See Meta.

SECTION 2. DO NOT CODIFY. Effective date. This act shall be effective on and after June 1, 2024.

APPROVED: 4/12/23

Sources

Arkansas General Assembly — Act 754 of the 2023 Regular Session (HB 1757) — PDF SHA-256 ab4cd87bddbd244fd0894552c85b530551649848e0812803bb8fc7cdb5a9e6a6
Codified numbering: Justia — 2023 Arkansas Code, Title 6, Subtitle 2, Chapter 18, Subchapter 26, Internet Archive capture 20241217045640
Extracted-text SHA-256: 1dfd4758c70ec458592fe85559b0dfe8af6f3c1c9f53f6a0ae69c22fec0e0509