language: en · last checked: 2026-10-26

Connecticut — student data privacy (C.G.S. §§10-234aa to 10-234gg)

Connecticut's student data privacy statute in full: the definitions (contractor, operator, consultant, student information, student-generated content), the written contract every board of education must have with a contractor, the operator's duties and prohibitions, the breach-notification timetable, and the uniform terms-of-service addendum and reporting provisions.

Sec. 10-234aa. Definitions

Verbatim from the Connecticut General Assembly, General Statutes Chapter 170, §10-234aa (live fetch; not amended in the 2026 Supplement).

As used in this section and sections 10-234bb to 10-234dd, inclusive:

• (1) “Contractor” means an operator or consultant that is in possession of or has access to student information, student records or student-generated content as a result of a contract with a local or regional board of education;
• (2) “Operator” means any person who (A) operates an Internet web site, online service or mobile application with actual knowledge that such Internet web site, online service or mobile application is used for school purposes and was designed and marketed for school purposes, to the extent it is engaged in the operation of such Internet web site, online service or mobile application, and (B) collects, maintains or uses student information;
• (3) “Consultant” means a professional who provides noninstructional services, including, but not limited to, administrative, planning, analysis, statistical or research services, to a local or regional board of education pursuant to a contract with such local or regional board of education;
• (4) “Student information” means personally identifiable information or material of a student in any media or format that is not publicly available and is any of the following: (A) Created or provided by a student or the parent or legal guardian of a student, to the operator in the course of the student, parent or legal guardian using the operator's Internet web site, online service or mobile application for school purposes, (B) created or provided by an employee or agent of a local or regional board of education to an operator for school purposes, or (C) gathered by an operator through the operation of the operator's Internet web site, online service or mobile application and identifies a student, including, but not limited to, information in the student's records or electronic mail account, first or last name, home address, telephone number, date of birth, electronic mail address, discipline records, test results, grades, evaluations, criminal records, medical records, health records, Social Security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious affiliations, text messages, documents, student identifiers, search activity, photographs, voice recordings, survey responses or behavioral assessments;
• (5) “Student record” means any information directly related to a student that is maintained by a local or regional board of education, the State Board of Education or the Department of Education or any information acquired from a student through the use of educational software assigned to the student by a teacher or employee of a local or regional board of education, except “student record” does not include de-identified student information allowed under the contract to be used by the contractor to (A) improve educational products for adaptive learning purposes and customize student learning, (B) demonstrate the effectiveness of the contractor's products in the marketing of such products, and (C) develop and improve the contractor's products and services;
• (6) “Student-generated content” means any student materials created by a student including, but not limited to, essays, research papers, portfolios, creative writing, music or other audio files or photographs, except “student-generated content” does not include student responses to a standardized assessment;
• (7) “Directory information” has the same meaning as provided in 34 CFR 99.3, as amended from time to time;
• (8) “School purposes” means purposes that customarily take place at the direction of a teacher or a local or regional board of education, or aid in the administration of school activities, including, but not limited to, instruction in the classroom, administrative activities and collaboration among students, school personnel or parents or legal guardians of students;
• (9) “Student” means a person who is a resident of the state and (A) enrolled in a preschool program participating in the state-wide public school information system, pursuant to section 10-10a, (B) enrolled in grades kindergarten to twelve, inclusive, in a public school, (C) receiving special education and related services under an individualized education program, or (D) otherwise the responsibility of a local or regional board of education;
• (10) “Targeted advertising” means presenting an advertisement to a student where the selection of the advertisement is based on student information, student records or student-generated content or inferred over time from the usage of the operator's Internet web site, online service or mobile application by such student or the retention of such student's online activities or requests over time for the purpose of targeting subsequent advertisements. “Targeted advertising” does not include any advertising to a student on an Internet web site that such student is accessing at the time or in response to a student's response or request for information or feedback;
• (11) “De-identified student information” means any student information that has been altered to prevent the identification of an individual student; and
• (12) “Persistent unique identifier” means a unique piece of information that can be used to recognize a user over time and across different Internet web sites, online services or mobile applications and is acquired as a result of the use of a student's use of an operator's Internet web site, online service or mobile application.

(P.A. 16-189, S. 1.)

Sec. 10-234bb. Contracts between boards of education and contractors re student data. Requirements

Verbatim from the Connecticut General Assembly, General Statutes Chapter 170, §10-234bb (live fetch; not amended in the 2026 Supplement).

• (a) On and after July 1, 2018, a local or regional board of education shall enter into a written contract with a contractor any time such local or regional board of education shares or provides access to student information, student records or student-generated content with such contractor. Each such contract shall include, but need not be limited to, the following:
  • (1) A statement that student information, student records and student-generated content are not the property of or under the control of a contractor;
  • (2) A description of the means by which the local or regional board of education may request the deletion of any student information, student records or student-generated content in the possession of the contractor that is not (A) otherwise prohibited from deletion or required to be retained under state or federal law, or (B) stored as a copy as part of a disaster recovery storage system and that is (i) inaccessible to the public, and (ii) unable to be used in the normal course of business by the contractor, provided such local or regional board of education may request the deletion of any such student information, student records or student-generated content if such copy has been used by the operator to repopulate accessible data following a disaster recovery;
  • (3) A statement that the contractor shall not use student information, student records and student-generated content for any purposes other than those authorized pursuant to the contract;
  • (4) A description of the procedures by which a student, parent or legal guardian of a student may review personally identifiable information contained in student information, student records or student-generated content and correct erroneous information, if any, in such student record;
  • (5) A statement that the contractor shall take actions designed to ensure the security and confidentiality of student information, student records and student-generated content;
  • (6) A description of the procedures that a contractor will follow to notify the local or regional board of education, in accordance with the provisions of section 10-234dd, when there has been an unauthorized release, disclosure or acquisition of student information, student records or student-generated content;
  • (7) A statement that student information, student records or student-generated content shall not be retained or available to the contractor upon expiration of the contract between the contractor and a local or regional board of education, except a student, parent or legal guardian of a student may choose to independently establish or maintain an electronic account with the contractor after the expiration of such contract for the purpose of storing student-generated content;
  • (8) A statement that the contractor and the local or regional board of education shall ensure compliance with the Family Educational Rights and Privacy Act of 1974, 20 USC 1232g, as amended from time to time;
  • (9) A statement that the laws of the state of Connecticut shall govern the rights and duties of the contractor and the local or regional board of education; and
  • (10) A statement that if any provision of the contract or the application of the contract is held invalid by a court of competent jurisdiction, the invalidity does not affect other provisions or applications of the contract which can be given effect without the invalid provision or application.
• (b) All student-generated content shall be the property of the student or the parent or legal guardian of the student.
• (c) A contractor shall implement and maintain security procedures and practices designed to protect student information, student records and student-generated content from unauthorized access, destruction, use, modification or disclosure that, based on the sensitivity of the data and the risk from unauthorized access, (1) use technologies and methodologies that are consistent with the guidance issued pursuant to section 13402(h)(2) of Public Law 111-5, as amended from time to time, (2) maintain technical safeguards as it relates to the possession of student records in a manner consistent with the provisions of 45 CFR 164.312, as amended from time to time, and (3) otherwise meet or exceed industry standards.
• (d) A contractor shall not use (1) student information, student records or student-generated content for any purposes other than those authorized pursuant to the contract, or (2) personally identifiable information contained in student information, student records or student-generated content to engage in targeted advertising.
• (e) Any provision of a contract entered into between a contractor and a local or regional board of education on or after July 1, 2018, that conflicts with any provision of this section shall be void.
• (f) Any contract entered into on and after July 1, 2018, that does not include (1) a provision required by subsection (a) of this section, or (2) the terms-of-service agreement addendum described in section 10-234ff, shall be void, provided the local or regional board of education has given reasonable notice to the contractor and the contractor has failed within a reasonable time to amend the contract to include the provision required by subsection (a) of this section or the terms-of-service agreement addendum.
• (g)
  • (1) Each local and regional board of education shall maintain and update, as necessary, an Internet web site with information relating to all contracts entered into pursuant to this section. Not later than five business days after executing a contract pursuant to this section, a local or regional board of education shall post notice of such contract on the board's Internet web site. The notice shall include the contract and (A) state that the contract has been executed and the date that such contract was executed, (B) provide a brief description of the contract and the purpose of the contract, and (C) state what student information, student records or student-generated content may be collected as a result of the contract.
  • (2) On or before September first of each school year, the board of education shall electronically notify students and the parents or legal guardians of students of the address of the Internet web site described in this subsection.
• (h) A local or regional board of education and a contractor may include in any contract executed pursuant to this section, the uniform student data privacy terms-of-service agreement addendum, described in section 10-234ff, to satisfy the requirements of this section.
• (i) A local or regional board of education shall not be required to enter into a contract pursuant to this section if the use of an Internet web site, online service or mobile application operated by a consultant or an operator is unique and necessary to implement a child's individualized education program or plan pursuant to Section 504 of the Rehabilitation Act of 1973, as amended from time to time, and such Internet web site, online service or mobile application is unable to comply with the provisions of this section, provided (1) such Internet web site, online service or mobile application complies with the Family Educational Rights and Privacy Act of 1974, 20 USC 1232g, as amended from time to time, and the Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, as amended from time to time, (2) such board of education can provide evidence that it has made a reasonable effort to (A) enter into a contract with such consultant or operator to use such Internet web site, online service or mobile application, and (B) find an equivalent Internet web site, online service or mobile application operated by a consultant or an operator that complies with the provisions of this section, (3) the consultant or operator complies with the provisions of section 10-234cc for such use, and (4) the parent or legal guardian of such child, and, in the case of a child with an individualized education program, a member of the planning and placement team, sign an agreement that (A) acknowledges such parent or legal guardian is aware that such Internet web site, online service or mobile application is unable to comply with the provisions of this section, and (B) authorizes the use of such Internet web site, online service or mobile application. A local or regional board of education shall, upon the request of a parent or legal guardian of a child, provide the evidence described in subdivision (2) of this subsection to such parent or legal guardian.

(P.A. 16-189, S. 2; P.A. 17-200, S. 1; P.A. 18-125, S. 2.)

History: P.A. 16-189 effective October 1, 2016, and applicable to contracts entered into, amended or renewed on or after that date; P.A. 17-200 replaced “October 1, 2016” with “July 1, 2018” in Subsecs. (a), (e) and (f), effective July 10, 2017; P.A. 18-125 amended Subsec. (a) by adding Subparas. (A) and (B) re deletion of records or content in possession of contractor in Subdiv. (2), replacing provision re completion of contracted services with provision re expiration of contract, and replacing “establish” with “independently establish” in Subdiv. (7), amended Subsec. (f) by designating existing provision re Subsec. (a) as Subdiv. (1), adding Subdiv. (2) re terms-of-service agreement addendum, amended Subsec. (g) by designating existing provisions re notice of contract as new Subdiv. (1) and amending same by redesignating existing Subdivs. (1) to (3) as Subparas. (A) to (C), adding provision re boards of education to maintain and update Internet web site and replacing provision re electronic notice to students and parents with provision re notice on board's Internet web site, and adding Subdiv. (2) re board to electronically notify parents and students of address of Internet web site, added Subsec. (h) re inclusion of uniform student data privacy terms-of-service agreement addendum in contract, added Subsec. (i) re contract not required if necessary to implement child's individualized education program or Section 504 plan, and made technical and conforming changes, effective July 1, 2018.

Sec. 10-234cc. Requirements for operators re student data

Verbatim from the Connecticut General Assembly, General Statutes Chapter 170, §10-234cc (live fetch; not amended in the 2026 Supplement).

• (a) An operator shall (1) implement and maintain security procedures and practices that meet or exceed industry standards and that are designed to protect student information, student records and student-generated content from unauthorized access, destruction, use, modification or disclosure, and (2) delete any student information, student records or student-generated content within a reasonable amount of time if a student, parent or legal guardian of a student or local or regional board of education who has the right to control such student information requests the deletion of such student information, student records or student-generated content, unless (A) state or federal law prohibits such deletion or otherwise requires the retention of such student information, student records or student-generated content, or (B) a copy of such student information, student records or student-generated content is in the possession of the operator as part of a disaster recovery storage system and is inaccessible to the public and unable to be used in the normal course of business by the operator, provided such student, parent or legal guardian of a student or local or regional board of education may request the deletion of any such student information, student records or student-generated content described in this subparagraph if such copy is used by the operator to repopulate accessible data following a disaster recovery.
• (b) An operator shall not knowingly:
  • (1) Engage in (A) targeted advertising on the operator's Internet web site, online service or mobile application, or (B) targeted advertising on any other Internet web site, online service or mobile application if such advertising is based on any student information, student records, student-generated content or persistent unique identifiers that the operator has acquired because of the use of the operator's Internet web site, online service or mobile application for school purposes;
  • (2) Collect, store and use student information, student records, student-generated content or persistent unique identifiers for purposes other than the furtherance of school purposes;
  • (3) Sell, rent or trade student information, student records or student-generated content unless the sale is part of the purchase, merger or acquisition of an operator by a successor operator and the operator and successor operator continue to be subject to the provisions of this section regarding student information; or
  • (4) Disclose student information, student records or student-generated content unless the disclosure is made (A) in furtherance of school purposes of the Internet web site, online service or mobile application, provided the recipient of the student information uses such student information to improve the operability and functionality of the Internet web site, online service or mobile application and complies with subsection (a) of this section; (B) to ensure compliance with federal or state law or regulations or pursuant to a court order; (C) in response to a judicial order; (D) to protect the safety or integrity of users or others, or the security of the Internet web site, online service or mobile application; (E) to an entity hired by the operator to provide services for the operator's Internet web site, online service or mobile application, provided the operator contractually (i) prohibits the entity from using student information, student records or student-generated content for any purpose other than providing the contracted service to, or on behalf of, the operator, (ii) prohibits the entity from disclosing student information, student records or student-generated content provided by the operator to subsequent third parties, and (iii) requires the entity to comply with subsection (a) of this section; or (F) for a school purpose or other educational or employment purpose requested by a student or the parent or legal guardian of a student, provided such student information is not used or disclosed for any other purpose.
• (c) An operator may use student information (1) to maintain, support, improve, evaluate or diagnose the operator's Internet web site, online service or mobile application, (2) for adaptive learning purposes or customized student learning, (3) to provide recommendation engines to recommend content or services relating to school purposes or other educational or employment purposes, provided such recommendation is not determined in whole or in part by payment or other consideration from a third party, or (4) to respond to a request for information or feedback from a student, provided such response is not determined in whole or in part by payment or other consideration from a third party.
• (d) An operator may use de-identified student information or aggregated student information (1) to develop or improve the operator's Internet web site, online service or mobile application, or other Internet web sites, online services or mobile applications owned by the operator, or (2) to demonstrate or market the effectiveness of the operator's Internet web site, online service or mobile application.
• (e) An operator may share aggregated student information or de-identified student information for the improvement and development of Internet web sites, online services or mobile applications designed for school purposes.
• (f) Nothing in this section shall be construed to (1) limit the ability of a law enforcement agency to obtain student information, student records or student-generated content from an operator as authorized by law or pursuant to a court order, (2) limit the ability of a student or the parent or legal guardian of a student to download, export, transfer or otherwise save or maintain student information, student records or student-generated content, (3) impose a duty upon a provider of an interactive computer service, as defined in 47 USC 230, as amended from time to time, to ensure compliance with this section by third-party information content providers, as defined in 47 USC 230, as amended from time to time, (4) impose a duty upon a seller or provider of an electronic store, gateway, marketplace or other means of purchasing or downloading software applications to review or enforce compliance with this section on such software applications, (5) limit an Internet service provider from providing a student, parent or legal guardian of a student or local or regional board of education with the ability to connect to the Internet, (6) prohibit an operator from advertising other Internet web sites, online services or mobile applications that are used for school purposes to parents or legal guardians of students, provided such advertising does not result from the operator's use of student information, student records or student-generated content, or (7) apply to Internet web sites, online services or mobile applications that are designed and marketed for use by individuals generally, even if the account credentials created for an operator's Internet web site, online service or mobile application may be used to access Internet web sites, online services or mobile applications that are designed and marketed for school purposes.

(P.A. 16-189, S. 3; P.A. 18-125, S. 3.)

History: P.A. 18-125 amended Subsec. (a)(2) by adding Subparas. (A) and (B) re when student information, student records or student-generated content is not required to be deleted by an operator, effective July 1, 2018.

Sec. 10-234dd. Duties re unauthorized release, disclosure or acquisition of student data

Verbatim from the Connecticut General Assembly, General Statutes Chapter 170, §10-234dd (live fetch; not amended in the 2026 Supplement).

• (a)
  • (1) Upon the discovery of a breach of security that results in the unauthorized release, disclosure or acquisition of student information, excluding any directory information contained in such student information, a contractor shall notify, without unreasonable delay, but not more than thirty days after such discovery, the local or regional board of education of such breach of security. During such thirty-day period, the contractor may (A) conduct an investigation to determine the nature and scope of such unauthorized release, disclosure or acquisition, and the identity of the students whose student information is involved in such unauthorized release, disclosure or acquisition, or (B) restore the reasonable integrity of the contractor's data system.
  • (2) Upon the discovery of a breach of security that results in the unauthorized release, disclosure or acquisition of directory information, student records or student-generated content, a contractor shall notify, without unreasonable delay, but not more than sixty days after such discovery, the local or regional board of education of such breach of security. During such sixty-day period, the contractor may (A) conduct an investigation to determine the nature and scope of such unauthorized release, disclosure or acquisition, and the identity of the students whose directory information, student records or student-generated content is involved in such unauthorized release, disclosure or acquisition, or (B) restore the reasonable integrity of the contractor's data system.
  • (3) Upon receipt of notice of a breach of security under subdivision (1) or (2) of this subsection, a local or regional board of education shall electronically notify, not later than two business days after receipt of such notice, the student and the parents or guardians of the student whose student information, student records or student-generated content is involved in such breach of security. The local or regional board of education shall post such notice on the board's Internet web site.
• (b) Upon the discovery of a breach of security that results in the unauthorized release, disclosure or acquisition of student information, student records or student-generated content, an operator that is in possession of or maintains student information, student records or student-generated content as a result of a student's use of such operator's Internet web site, online service or mobile application, shall (1) notify, without unreasonable delay, but not more than thirty days after such discovery, the student or the parents or guardians of such student of any breach of security that results in the unauthorized release, disclosure or acquisition of student information, excluding any directory information contained in such student information, of such student, and (2) notify, without unreasonable delay, but not more than sixty days after such discovery, the student or the parents or guardians of such student of any breach of security that results in the unauthorized release, disclosure or acquisition of directory information, student records or student-generated content of such student. During such thirty-day or sixty-day period, the operator may (A) conduct an investigation to determine the nature and scope of such unauthorized release, disclosure or acquisition, and the identity of the students whose student information, student records or student-generated content are involved in such unauthorized release, disclosure or acquisition, or (B) restore the reasonable integrity of the operator's data system.

(P.A. 16-189, S. 4; P.A. 17-13, S. 1; 17-200, S. 2.)

History: P.A. 17-13 made a technical change in Subsec. (a)(3), effective July 1, 2017; P.A. 17-200 amended Subsec. (a)(3) by replacing “forty-eight hours” with “two business days” and making a technical change, effective July 1, 2017.

Sec. 10-234ee. Written guidance re Family Educational Rights and Privacy Act and laws relating to student data privacy

Verbatim from the Connecticut General Assembly, General Statutes Chapter 170, §10-234ee (live fetch; not amended in the 2026 Supplement).

The Department of Education, in consultation with the Commission for Educational Technology, shall provide written guidance to local and regional boards of education concerning the implementation of the Family Educational Rights and Privacy Act of 1974, 20 USC 1232g, as amended from time to time, and the laws relating to student data privacy, set forth in sections 10-234aa to 10-234dd, inclusive, and section 10-234ff. Such written guidance shall include, but need not be limited to, (1) a plain language explanation of how such student data privacy laws are to be implemented, (2) information about the uniform student data privacy terms-of-service agreement addendum, described in section 10-234ff, and (3) how such addendum may be incorporated into contracts executed pursuant to section 10-234bb.

(P.A. 17-200, S. 3; P.A. 18-125, S. 4.)

History: P.A. 17-200 effective July 10, 2017; P.A. 18-125 added “, in consultation with the Commission for Educational Technology,”, replaced “guidance” with “written guidance”, replaced “provisions of” with “laws relating to student data privacy, set forth in”, added reference to Sec. 10-234ff, and added Subdivs. (1) to (3) re content of written guidance, effective July 1, 2018.

Sec. 10-234ff. Uniform student data privacy terms-of-service agreement addendum

Verbatim from the Connecticut General Assembly, General Statutes Chapter 170, §10-234ff (live fetch; not amended in the 2026 Supplement).

The Commission for Educational Technology shall develop a uniform student data privacy terms-of-service agreement addendum that may be used in contracts entered into pursuant to section 10-234bb. The provisions of such addendum shall conform to the requirements for a contract described in said section. The commission shall make such addendum available on its Internet web site, or in any online registry maintained by the commission for contractors and operators, as those terms are defined in section 10-234aa, and local and regional boards of education.

(P.A. 18-125, S. 1.)

History: P.A. 18-125 effective June 7, 2018.

Sec. 10-234gg. Report re use of certain Internet web sites, online services or mobile applications without a contract

Verbatim from the Connecticut General Assembly, General Statutes Chapter 170, §10-234gg (live fetch; not amended in the 2026 Supplement).

For the school year commencing July 1, 2018, and each school year thereafter, each local or regional board of education shall annually submit a report to the Commission for Educational Technology concerning the use of Internet web sites, online services or mobile applications without a contract pursuant to subsection (i) of section 10-234bb. Such report shall indicate whether or not any such Internet web sites, online services or mobile applications are being so used, and, if so, a list of all such Internet web sites, online services or mobile applications.

(P.A. 18-125, S. 6.)

History: P.A. 18-125 effective July 1, 2018.

Sources

• Connecticut General Assembly — General Statutes Chapter 170
• Connecticut General Assembly — 2026 Supplement, Chapter 170