EdLaw
Connecticut — student data privacy (C.G.S. §§10-234aa to 10-234gg)
Connecticut's student data privacy law, enacted by P.A. 16-189 and amended by P.A. 17-13, 17-200 and 18-125, codified in Title 10, Chapter 170 of the General Statutes. It works on two tracks: a contractor (an operator or consultant holding student data under a contract with a board of education) must be bound by a written contract with ten mandatory terms, and an operator of a school-purpose website, online service or mobile application is bound directly by SOPIPA-style prohibitions and duties. Both carry breach-notification deadlines.
Applicability to EdTech
- Two definitions catch a school vendor. An "operator" operates an Internet web site, online service or mobile application "with actual knowledge that [it] is used for school purposes and was designed and marketed for school purposes" and "collects, maintains or uses student information" (§10-234aa(2)); a "contractor" is "an operator or consultant that is in possession of or has access to student information, student records or student-generated content as a result of a contract with a local or regional board of education" (§10-234aa(1)).
- Broad data scope. "Student information" names "biometric information", "photographs, voice recordings, survey responses or behavioral assessments" and "search activity" (§10-234aa(4)); "student record" includes "any information acquired from a student through the use of educational software assigned to the student by a teacher" (§10-234aa(5)); "student-generated content" covers audio files and photographs, which "shall be the property of the student or the parent or legal guardian" (§10-234bb(b)).
- A written contract is mandatory. A board must enter a written contract "any time" it shares or provides access to student data, and the contract must contain ten listed terms — data not the contractor's property, deletion on request, use only as authorised, review and correction, security, breach-notification procedure, no retention after expiry, FERPA compliance, Connecticut governing law, severability (§10-234bb(a)). Conflicting terms are void, and a contract missing a required term or the uniform addendum is void if the contractor fails to amend after reasonable notice (§10-234bb(e)–(f)). Each board posts notice of the contract on its website within five business days (§10-234bb(g)).
- Security standard. A contractor's security must use technologies and methodologies consistent with the HITECH guidance under section 13402(h)(2) of Public Law 111-5, maintain technical safeguards consistent with 45 CFR 164.312, and otherwise meet or exceed industry standards (§10-234bb(c)); an operator's must "meet or exceed industry standards" (§10-234cc(a)).
- Operator prohibitions. No targeted advertising, no collection, storage or use for purposes other than school purposes, no sale, rental or trade, and disclosure only on listed grounds — including to a service provider bound by contract against other use and onward disclosure (§10-234cc(b)). Deletion on request of the student, parent or board within a reasonable time, with a disaster-recovery-copy exception (§10-234cc(a)).
- Breach deadlines. A contractor notifies the board within 30 days of discovering a breach of student information (60 days for directory information, student records or student-generated content); the board then notifies families within two business days (§10-234dd(a)). An operator notifies the student or parents directly on the same 30/60-day clock (§10-234dd(b)).
- Uniform addendum. The Commission for Educational Technology develops a uniform terms-of-service addendum that may satisfy the contract requirement (§10-234ff; §10-234bb(h)). The addendum itself is not reproduced here.
Contents
| Document | Covers |
|---|---|
| STUDENT-DATA-PRIVACY.md | §§10-234aa (definitions), 10-234bb (contracts), 10-234cc (operators), 10-234dd (breach), 10-234ee (guidance), 10-234ff (uniform addendum), 10-234gg (no-contract reporting), in full |
Key obligations at a glance
- Sign a written contract containing the ten required terms before receiving student data from a board — §10-234bb(a).
- Use student data only as the contract authorises, and never for targeted advertising — §10-234bb(d).
- Security consistent with HITECH guidance, 45 CFR 164.312 and industry standards — §10-234bb(c).
- Notify the board of a breach within 30 or 60 days of discovery — §10-234dd(a).
- As an operator: no targeted advertising, profiling outside school purposes, sale, or unlisted disclosure — §10-234cc(b).
Enforcement
The sections set no penalty and name no enforcing agency. The contract regime enforces itself through voidness: a conflicting term is void (§10-234bb(e)), and a contract that lacks a required term is void once the contractor fails to amend it after reasonable notice (§10-234bb(f)). A use without a contract is permitted only where the product is unique and necessary for an IEP or Section 504 plan (§10-234bb(i)), and boards report such uses each year (§10-234gg).
Licence
The corpus reproduces §§10-234aa to 10-234gg verbatim from the Connecticut General Assembly's General Statutes chapter page.
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."
The chapter page (cga.ct.gov, Chapter 170, read 2026-10-08) carries no copyright notice or licence. The Public Act credits and the "History:" notes are the work of the Legislative Commissioners' Office, the General Assembly's own office, which is the situation Georgia v. Public.Resource.Org held to be outside copyright. Case annotations on the page are not reproduced.
Conditions: none attach. The corpus names the official source in Sources and in each section's {.meta} provenance line, and its Meta section describes what it changed (anchors added, nothing reworded).
Related
- California SOPIPA — the operator model §10-234cc follows
- Michigan SOPPA — the same operator model without a contract track
- Utah — Student Data Protection (Utah Code Title 53E, Chapter 9, Part 3) — another contract-based regime, with mandatory contract terms for third-party contractors
- FERPA — required by contract term §10-234bb(a)(8); directory information is defined by 34 CFR 99.3