language: en · status: in-force · last checked: 2026-09-19

Georgia — Student Data Privacy, Accessibility, and Transparency Act (O.C.G.A. §§20-2-660 to 20-2-668)

Georgia's student-data statute (Title 20, Chapter 2, Article 15), enacted by Ga. L. 2015, p. 1031 (SB 89) and amended since — most recently by HB 268 (eff. 28 April 2025), SB 431 (eff. 11 May 2026) and HB 1268 (eff. 1 July 2026). It binds the Department of Education, local boards of education and, in §20-2-666, operators directly.

Text source. The statute text in this folder is reproduced from Justia, a third-party republisher, because the primary source is not machine-readable — see the fact document's Meta section and the Sources section below. Cite the O.C.G.A. section numbers, and check exact wording against the official code before relying on it.

Applicability to EdTech

§20-2-666 is the operator regime and binds a vendor directly. Its prohibitions are the SOPIPA family's — no behaviourally targeted advertising, no amassing a profile, no sale of student data, no disclosure of personally identifiable data outside the enumerated grounds ((a)(1)–(a)(4)) — but two details differ from the neighbours and are worth designing to:

• Deletion runs to a hard 45 days on a school's or local board's request ((b)(2)), where most sibling statutes say only "within a reasonable time".
• Consent, where it is the gateway, is the student's own if over 13, or the parent's or guardian's ((a)) — a lower threshold than COPPA's under-13 line and unusual among the state operator statutes.

The permitted uses are generous and explicit: product maintenance and improvement, adaptive learning, recommendation engines not driven by payment, and use of aggregate or de-identified data including to demonstrate effectiveness in marketing ((d), (e)). General-audience services are outside the section entirely ((g)).

Separately, §20-2-665 bars collection outright — not merely reporting — of political affiliation, voting history, income and religious affiliation or beliefs ((b)), and bars local boards from reporting juvenile delinquency, criminal, and medical and health records to the department ((a)). These bite regardless of consent.

Key obligations at a glance

Operators (§20-2-666)

• No behaviourally targeted advertising from student data — (a)(1).
• No profile amassing outside K-12 school purposes — (a)(2).
• No sale of a student's data — (a)(3).
• No disclosure of student personally identifiable data outside the seven enumerated grounds — (a)(4).
• Reasonable security appropriate to the nature of the data — (b)(1); deletion within 45 days on request — (b)(2).

Department and local boards

• A chief privacy officer with ten enumerated responsibilities, investigatory powers, and a privacy incident response programme — §20-2-663.
• A statewide guidance document on what student records may be shared with whom, issued by 31 December 2025 and reviewed each 1 July — §20-2-663(c) (added by HB 268, eff. 28 April 2025).
• Role of the department — §20-2-664 (the source carries a commencement note on this section).
• Prohibited reporting and collection — §20-2-665.

Parents and students (§20-2-667)

• Right to inspect and review the child's education record — (a); to request student data including data held by an operator — (b).
• An electronic copy of the complete education record, on a school-business-day clock — (c) (rewritten by HB 268 in 2025; "school business day" substituted by SB 431 in 2026).
• Right to request correction of inaccurate records — (d); rights extend to eligible students — (e).
• No additional cause of action beyond the complaint process — (h).

Contents

Licence

The corpus reproduces O.C.G.A. §§ 20-2-660 to 20-2-668 (2025 Code of Georgia) and each section's History credit, taken from Justia, a third-party republisher, because the official code published for the State by LexisNexis serves no text to a non-browser client. Justia's editorial apparatus (Annotations, Research References, Law reviews, Hierarchy Notes) is excluded, and no LexisNexis annotation is reproduced.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

Georgia v. Public.Resource.Org concerned this code: it held that even the official annotations of the O.C.G.A., prepared by the Code Revision Commission, are outside copyright, so the bare statute text and its History credits are a fortiori. Annotations written by a commercial publisher on its own account are not covered by that holding, which is why Justia's are excluded. Justia's Terms of Service (justia.com/terms-of-service, read 2026-10-01 through the Internet Archive capture of 26 September 2026, because the live page answers a Cloudflare challenge) say: "Justia claims no copyright in any works of the US Federal Government or US State Governments, including court documents, codes, and regulations."

The curator should decide on the route rather than the rights. The same Terms of Service also say "You agree not to access the Service by any means other than through the interface that is provided by Justia for use in accessing the Service" and "You agree not to reproduce, duplicate, copy, sell, trade, resell or exploit for any commercial purposes, any portion of the Service". These are contract terms with Justia, not copyright in the code; the builder reaches Justia's pages through the Internet Archive or a reader transport. Replacing the source with the official text, when it becomes reachable, would remove the question.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).

Related

• California SOPIPA — the model for the §20-2-666 operator regime
• Illinois SOPPA · North Carolina §115C-401.2 — the same family, with different deletion clocks
• Ohio R.C. §§3319.325–3319.327 — the technology-provider analogue
• FERPA · COPPA — the federal regimes this article works alongside

Sources

• Primary: Official Code of Georgia Annotated §§20-2-660 to 20-2-668, published for the State by LexisNexis — official public access. Not machine-readable: it serves a JavaScript bootstrap with no statute text to any non-browser client.
• Text reproduced from (third party): Justia — 2025 Code of Georgia, Title 20, Ch. 2, Art. 15. Per-section links and routes are listed in the fact document's Sources section.