language: en · status: in-force · last checked: 2026-10-08

Hawaii — Student Online Personal Information Protection (HRS §§302A-499 to 302A-500)

Subpart H of part II of HRS chapter 302A, enacted by L 2016, c 40 (SB2607 SD2 HD2), which the Governor signed on 29 April 2016 and whose section 3 reads "This Act shall take effect upon its approval." A SOPIPA-model statute binding the operator of a website, online service, online application or mobile application with actual knowledge that it is used primarily for, and was designed and marketed for, K-12 school purposes. "K-12 school" is limited to public schools as defined in HRS §302A-101.

Applicability to EdTech

• Who is bound. "Operator" is defined by actual knowledge of primary K-12 use and K-12 design and marketing (§302A-499); general-audience services are outside the subpart (§302A-500(e)(3)).
• Covered information expressly includes biometric information, photos, voice recordings and geolocation information (§302A-499, "Covered information" (3)).
• Subprocessors may receive covered information only under contract terms limiting use to the contracted service, prohibiting onward disclosure and requiring reasonable security (§302A-500(a)(4)(F)).
• Deletion within a reasonable time on the school's or complex's request (§302A-500(b)(2)).
• Adaptive learning is preserved (§302A-500(e)(2)).

Contents

Key obligations at a glance

• No targeted advertising, no profile-building except for K-12 school purposes, no sale or rental — §302A-500(a)(1)–(3).
• Disclose covered information only on the enumerated grounds — §302A-500(a)(4).
• Reasonable security; deletion on request — §302A-500(b).

Enforcement

Neither section of subpart H, as the HRS publishes it, sets a penalty or names an enforcing authority (§302A-500).

Licence

The corpus reproduces HRS §§302A-499 and 302A-500 verbatim from the Hawaii State Legislature's HRS pages (through the Internet Archive's id_ endpoint, which returns the publisher's original bytes), with each section's session-law credit.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

The HRS pages (capitol.hawaii.gov — HRS §302A-500, read 2026-10-08 through the Internet Archive) carry no copyright notice.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).

Related

• California SOPIPA — the model this subpart follows
• COPPA · FERPA — the federal layer

Sources

• Hawaii State Legislature — HRS §302A-499
• Hawaii State Legislature — HRS §302A-500
• Hawaii State Legislature — Governor's Message No. 1140 (2016) — "on April 29, 2016, the following bill was signed into law: SB2607 SD2 HD2 … ACT 040 (16)", with the signed act attached, whose section 3 reads "This Act shall take effect upon its approval." (read through the Internet Archive capture of 24 December 2016)