language: en · status: in-force · last checked: 2026-10-08

Iowa — student online personal information protection (Iowa Code §279.71)

Iowa Code §279.71, enacted by 2018 Acts, ch 1042, §1 (H.F. 2354, which enacted it as section 279.70; approved 28 March 2018 and specifying no effective date, so under Iowa Code §3.7(1) it took effect on 1 July 2018), is Iowa's SOPIPA-model statute. It binds the operator of an internet site, online service, online application or mobile application used primarily for K-12 school purposes directly, whether or not it has a contract with the school district: no targeted advertising, profiling, or sale of student information; disclosure only for listed purposes; security consistent with current industry standards; and deletion when the district or attendance center asks.

Applicability to EdTech

• Who is bound. An "operator" is "the operator of an internet site, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for kindergarten through grade twelve school purposes and was designed and marketed for such purposes" (§279.71(1)(e)). General-audience services are excluded (§279.71(6)(c)).
• What is covered. "Covered information" includes information an operator gathers through its service that personally identifies a student, naming "biometric information", "search activity, photos, voice recordings, or geolocation information" (§279.71(1)(b)(3)).
• Prohibitions. No targeted advertising, no profile except in furtherance of K-12 school purposes, no sale or rental, and no disclosure outside the listed purposes (§279.71(2)(a)).
• Subprocessors. A third party may receive covered information only if the operator contractually limits its use to the contracted service, requires it to protect student information "to the same extent that the operator is required to", prohibits onward disclosure, and requires security "consistent with current industry standards" (§279.71(2)(a)(4)(f)).
• Duties. Security procedures and practices "consistent with current industry standards and all applicable state and federal laws, rules, and regulations" (§279.71(3)(a)); delete "as soon as reasonably practicable" on the school district's or attendance center's request, unless a student or parent consents to retention (§279.71(3)(b)).
• Permitted uses. Using information to maintain, develop, support, improve or diagnose the service (§279.71(2)(b)); de-identified use to improve products and to demonstrate effectiveness (§279.71(5)); adaptive or customized learning (§279.71(6)(b)).

Contents

Key obligations at a glance

• No targeted advertising, profiling outside K-12 school purposes, or sale or rental of student information — §279.71(2)(a)(1)–(3).
• Disclose covered information only for the listed purposes, with contractual controls on third parties — §279.71(2)(a)(4).
• Security consistent with current industry standards — §279.71(3)(a).
• Delete on the district's or attendance center's request — §279.71(3)(b).

Enforcement

The section sets no penalty, names no enforcing agency and creates no private right of action (STUDENT-ONLINE-PERSONAL-INFORMATION.md). A breach of covered information that is also "personal information" under chapter 715C engages that chapter's notification duties and Attorney General enforcement (Iowa Code ch. 715C).

Licence

The corpus reproduces Iowa Code §279.71 verbatim from the Iowa Legislature's 2026 Code PDF.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

The Iowa General Assembly's disclaimer (legis.iowa.gov/law/disclaimer, read 2026-10-08) states no copyright or licence terms for the Code; it says: "This website contains official editions of legal publications produced as copies in a PDF format." The only rights reservation on that page concerns session photographs owned by the Associated Press, which the corpus does not reproduce. The Acts credits and "Referred to in" notes are the Legislative Services Agency's, made in the course of its legislative duties.

Conditions: none attach. The corpus names the official source in Sources and in each section's {.meta} provenance line, and its Meta section describes what it changed (anchors added, a backslash before a list designation's period so Markdown does not renumber it, nothing reworded).

Related

• Iowa — personal information security breach protection (Iowa Code ch. 715C) — the breach-notification layer, including vendors holding data on a school's behalf
• California SOPIPA — the model §279.71 follows
• Michigan SOPPA — the same model in Michigan
• FERPA — the federal education-records layer

Sources

• Iowa Legislature — Iowa Code 2026, §279.71 (PDF)
• Iowa Legislature — 2018 Iowa Acts, chapter 1042 (H.F. 2354) (PDF) — the enacting Act: its single section adds the text as "NEW SECTION. 279.70", sets no effective date, "Approved March 28, 2018"
• Iowa Legislature — Iowa Code 2026, §3.7 (PDF) — "All Acts and resolutions of a public nature passed at regular sessions of the general assembly shall take effect on the first day of July following their passage, unless some other specified time is provided"; last amended by 2006 Acts, ch 1010, so the rule applied in 2018