language: en · status: in-force · last checked: 2026-09-18

Illinois — Student Online Personal Protection Act (SOPPA, 105 ILCS 85)

Illinois state law binding operators of online services used primarily for K-12 school purposes, and — unusually — the schools and the State Board of Education as well. Enacted by P.A. 100-315 (eff. 24 Aug 2017); the operator, school and State Board regime that makes SOPPA the most demanding of the SOPIPA-family statutes was added by P.A. 101-516 (eff. 1 Jul 2021).

Three features set it apart from California's SOPIPA: every written agreement between a school and an operator must be published on the school's website, breach notice runs through the school to parents within 30 calendar days, and parents hold statutory rights of inspection and correction directly against covered information however it is held.

Applicability to EdTech

Binds the vendor directly, on actual knowledge that the service is used primarily for — and was designed and marketed for — K through 12 school purposes (§5). For a supplier to Illinois districts the load-bearing consequences are the mandatory written agreement with its six required contents (§15(4)), the fact that the signed agreement becomes public (§27(c)), and the allocation of breach costs to the operator where a breach is attributed to it (§15(4)(D)).

Key obligations at a glance

Operators

• No targeted advertising, no profiling-style use of covered information, and no sale or rent of a student's information — §10(1), §10(2), §10(3).
• No disclosure of covered information except on the enumerated grounds — §10(4).
• Reasonable security meeting or exceeding industry standards; deletion of covered information on a school's request — §15(1), §15(2).
• A written agreement with the school before receiving covered information, carrying the data categories, the product statement, the FERPA school-official statement, the breach-cost description, the deletion/transfer term and the public-posting term — §15(4).
• Breach notice to the school no later than 30 calendar days after determining a breach occurred — §15(5).

Schools

• No sale, rent, lease or trade of covered information; sharing restricted to the enumerated grounds — §26.
• Publish the data inventory, the list of operators, a copy of each written agreement, subcontractor lists, the parent-rights procedure and a list of breaches — §27(a), §27(c).
• Notify parents of a breach within 30 calendar days of receipt or determination — §27(d).
• Reasonable security; optional designated privacy officer — §27(e), §27(f).
• None of §27 applies to nonpublic schools — §27(h).

Parents and enforcement

• Rights to inspect, obtain a copy of, and require correction of covered information — corrections confirmed within 90 calendar days — §33(c).
• Enforcement is by the Attorney General under the Consumer Fraud and Deceptive Business Practices Act; SOPPA creates no private right of action — §35.

Contents

Licence

The corpus reproduces 105 ILCS 85 in full verbatim from the Illinois General Assembly's compiled-statutes page (through the Internet Archive's id_ endpoint, which returns the publisher's original bytes), with each section's "(Source: P.A. …)" trailer.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

ilga.gov pages end with the footer "All Rights Reserved" (ilga.gov, read 2026-10-01 through the Internet Archive). The site's Disclaimers page (read the same way, 2026-10-01) sets no terms for reproducing statute text. A site-wide footer of that kind can cover the site, but not the Acts the General Assembly enacts.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).

Related

• Illinois PIPA — the general breach-notification and data-security statute running alongside SOPPA; §27(a)(5)(A) defers to it on disclosing student numbers
• SDPC IL-NDPA Exhibit G — the contract layer carrying these duties into every Illinois DPA
• California SOPIPA — the model this act extends
• COPPA · FERPA — the federal regimes §30 preserves
• Illinois BIPA — the biometric statute with a private right of action; §5 of this act brings biometric information inside "covered information"

Sources

• Illinois General Assembly — 105 ILCS 85