EdLaw
Delaware — Student Data Privacy Protection Act (14 Del. C. ch. 81A)
Enacted by 80 Del. Laws, c. 149 (Senate Substitute No. 1 for Senate Bill No. 79) and amended by 80 Del. Laws, c. 335. It is Delaware's SOPIPA-style statute and binds the operator directly. The chapter defines student data broadly, imposes security and deletion duties, prohibits targeted advertising, profiling, sale and most disclosure, and is enforced by the Consumer Protection Unit of the Department of Justice. Under 80 Del. Laws, c. 149, § 5 as amended by 80 Del. Laws, c. 335, § 3, the chapter took effect on 1 August 2016 (80 Del. Laws, c. 335, read 2026-10-08). The bracketed note on every section points to c. 149, § 2. That section says the chapter does "not apply to projects relating to the privacy and security of student data approved prior to the effective date of this Act" under the Department of Education's data-governance regulation (80 Del. Laws, c. 149, read 2026-10-08).
Applicability to EdTech
- The operator test has two limbs, joined by "any of the following". An operator is any person other than the Department, districts or schools that either runs a site, service or application used primarily for, and designed and marketed for, K-12 school purposes, or "Collects, maintains, or uses student data in a digital or electronic format for K-12 school purposes" (§ 8102A(10)). The second limb is wider than SOPIPA's: a vendor handling student data for a school is caught even if its product is not school-designed.
- Student data is defined broadly. The list of data gathered by an operator includes "geolocation data; biometric information; […] photos; voice recordings; or video recordings" (§ 8102A(16)e.).
- Security duties are tied to a state policy. Security procedures "shall, at a minimum, comply with the Department of Technology and Information's Cloud and Offsite Hosting Policy and include the terms and conditions set forth in" its Cloud and Offsite Hosting Template for Non-Public Data (§ 8104A(1)). That is a concrete external standard; the policy and its successor agreement, renamed by DTI since 2016, are extracted as DTI Cloud Services and Data Usage Terms.
- Deletion within 45 calendar days when a district or school requests deletion of data under its control (§ 8104A(2)).
- Prohibitions. No targeted advertising, no non-school profiling, no sale, and disclosure only on the listed grounds. A disclosure to a service provider must be made under a contract that limits the provider's use and onward disclosure and imposes the security duty (§ 8105A(1)–(4)). Internal maintenance and diagnosis, adaptive learning, and use of de-identified or aggregate data for product improvement are permitted (§ 8105A(6)–(7)).
Contents
| Document | Covers |
|---|---|
| STUDENT-DATA-PRIVACY.md | 14 Del. C. §§ 8101A–8106A in full |
Key obligations at a glance
- Reasonable security meeting the DTI Cloud and Offsite Hosting Policy and Template — § 8104A(1).
- Delete within 45 calendar days of a district or school request — § 8104A(2).
- No targeted advertising, profiling, sale, or unlisted disclosure — § 8105A.
Enforcement
The Consumer Protection Unit of the Department of Justice "has enforcement authority over this chapter and may investigate and prosecute violations" under subchapter II of Chapter 25 of Title 29 (§ 8103A).
Licence
The corpus reproduces 14 Del. C. §§ 8101A–8106A verbatim from the Delaware Code Online.
The site's notice (delcode.delaware.gov, read 2026-10-08) states: "The Delaware Code appearing on this site is prepared by the Delaware Code Revisors and the editorial staff of LexisNexis in cooperation with the Division of Legislative Services of the General Assembly, and is considered an official version of the State of Delaware statutory code." The site states no copyright claim or reproduction terms; its disclaimer is about warranty and liability only. Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Court held that "officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties". The corpus reproduces the statute text, its headings and its session-law credits, and none of the publisher's annotations.
Conditions: none. The corpus names the source in Sources and in each section's {.meta} provenance line.
Related
- California SOPIPA — the model statute; Delaware's second operator limb is the notable departure
- District of Columbia — Protecting Students Digital Privacy Act — another SOPIPA-style operator statute
- DTI Cloud Services and Data Usage Terms — the policy and agreement § 8104A(1) points to
- FERPA — whose "education record" definition § 8102A(4) adopts