EdLaw
District of Columbia — Protecting Students Digital Privacy Act of 2016
D.C. Law 21-218, codified as Subchapter I ("Protection of Students Digital Privacy") of Chapter 8B of Title 38 of the D.C. Code. The law took effect on 18 February 2017, and its operative sections apply from 1 August 2017 (§ 38-831.06). It has two halves. One binds the operator of a pre-k–12 website, service or application, on the SOPIPA model with some District-specific changes. The other limits what school-based personnel may do with school-issued 1-to-1 devices and with students' own accounts and devices.
Applicability to EdTech
- Who is an operator. An operator runs "an Internet website, online service, online application, or mobile application" that is "designed, marketed, and primarily used for pre-k through 12 purposes" and knows it is being so used (§ 38-831.01(10)). An "educational institution" is a DC public school or public charter school (§ 38-831.01(6)).
- Image and voice are personal data. "Personally identifiable student information" expressly includes "A photograph, video, or audio recording that contains the student's image or voice". It also covers indirect identifiers such as "geolocation information" and a "persistent unique identifier" (§ 38-831.01(14)). A product that captures camera images or voice is inside the definition.
- Affirmative duties. An operator serving a DC school or LEA must keep reasonable security policies and procedures, including provisions for notifying educational institutions and LEAs of unauthorized access under the District's breach statute. It must agree that student information "is under the control of the LEA", and delete it within a reasonable period after services end unless the LEA asks for it to be kept (§ 38-831.02(a)).
- Prohibitions. An operator may not knowingly sell, rent or trade the information (with narrow exceptions), conduct targeted advertising, or build a profile of a student except in furtherance of pre-k–12 purposes. It may disclose the information only on the listed grounds. Disclosure to a sub-processor requires a contract that limits use, onward disclosure, security and deletion (§ 38-831.02(b)).
- Permitted uses. Internal use to maintain, improve or diagnose the service, adaptive or customized learning, and use of de-identified information are all preserved (§ 38-831.02(d)).
- 1-to-1 devices: camera, microphone and location. School-based personnel may not remotely activate or access a 1-to-1 device's audio or video functions, save on three grounds: the student starts the communication, a judicial order or warrant, or an imminent threat to life or safety. The last needs notice within 72 hours. Location tracking is limited in the same way (§ 38-831.03(c)–(d)). A returned device must be erased, and students must get written notice before issue (§ 38-831.03(e)–(f)). A "1-to-1 device provider" is defined (§ 38-831.01(2)), but the section's duties fall on school-based personnel and the educational institution. "School-based personnel" includes an employee of a contractor acting as the school's agent (§ 38-831.01(16)).
Contents
| Document | Covers |
|---|---|
| STUDENT-DIGITAL-PRIVACY.md | D.C. Code §§ 38-831.01–38-831.06 in full |
Key obligations at a glance
- Reasonable security, LEA control of the data, and deletion after service ends — § 38-831.02(a).
- No sale, no targeted advertising, no non-school profiling; disclosure only on the listed grounds, with contract terms for service providers — § 38-831.02(b).
- Limits on school access to 1-to-1 device data, location tracking and remote camera or microphone activation — § 38-831.03.
Enforcement
The subchapter sets no penalty and creates no private right of action. It directs the Mayor to issue implementing rules (§ 38-831.05); those rules are not extracted here. Operator security policies must provide for notice of unauthorized access "consistent with the requirements of subchapter II of Chapter 38 of Title 28" (§ 38-831.02(a)(1)), which is the District's data-breach statute, extracted as D.C. Code §§ 28-3851–28-3853.
Licence
The corpus reproduces D.C. Code §§ 38-831.01–38-831.06 verbatim from the Council of the District of Columbia's official D.C. Code site.
The site states in its footer (code.dccouncil.gov, read 2026-10-08): "The codes and laws on this website are in the public domain." That accords with the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held that "officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties."
Conditions: none. The same footer asks readers "Please do not scrape. Instead, bulk download the HTML or XML" from the Council's GitHub repositories. Neither repository's default branch carried this subchapter on 2026-10-08, so the builder reads the six section pages only, one request each per run. The corpus names the source in Sources and in each section's {.meta} provenance line.
Related
- California SOPIPA — the operator-statute model this law follows
- Kentucky KRS 365.734 — another statute binding the service provider directly
- D.C. Code §§ 28-3851–28-3853 — the breach statute § 38-831.02(a)(1) points to
- FERPA — the federal education-records layer
- COPPA — the federal under-13 layer, relevant to the verified-consent exception in § 38-831.02(b)(1)(A)(ii)