EdLaw
Kansas — Student Data Privacy Act (K.S.A. 72-6312 to 72-6320)
Kansas's student-records statute, enacted by L. 2014, ch. 124 (effective July 1, as each section's History line records) and amended in 2022 (72-6316). It governs disclosure of student data held in the statewide longitudinal student data system, prohibits school districts from collecting biometric data or assessing a student's physiological or emotional state without written consent, and puts breach-notification duties on any entity or third party given access to student data.
Applicability to EdTech
- Service providers need a data-sharing agreement. Student data may be disclosed to "a service provider of a state agency, educational agency or school who is engaged to perform a function of instruction, assessment or longitudinal reporting" only under a data-sharing agreement setting out purpose, scope and duration, purpose limitation, access/use/security restrictions and destruction (72-6314(c)). Destruction must comply with NIST SP 800-88 (72-6314(c)(4)).
- Biometrics and affect sensing. "No school district shall collect biometric data from a student, or use any device or mechanism to assess a student's physiological or emotional state", without written consent of the adult student or the parent or legal guardian (72-6315). Biometric data includes voiceprints and facial characteristics (72-6313(b)). A product that captures such signals in a Kansas classroom puts the district on the wrong side of this section unless consent is in hand.
- Breach duties bind the vendor directly: on a security breach or unauthorized disclosure by "other entity or third party given access", that entity "shall immediately notify each affected student, if an adult, or the parent or legal guardian of the student, if a minor" and investigate (72-6318).
- Injunctions reach vendors: the attorney general or any district attorney may seek to enjoin "any other entity in possession of student data" from disclosing it in violation of the act (72-6317).
Contents
| Document | Covers |
|---|---|
| STUDENT-DATA-PRIVACY.md | K.S.A. 72-6312 to 72-6320 — citation, definitions, disclosure, biometric data, nonacademic surveys, enforcement, breach notification, publication, annual report |
Key obligations at a glance
- Disclosure to a service provider only under a compliant data-sharing agreement — 72-6314(c).
- No biometric collection or physiological/emotional-state assessment without written consent — 72-6315.
- No personally identifiable student data collected through nonacademic tests, questionnaires or surveys — 72-6316(d).
- Immediate breach notice to affected students or parents, and investigation — 72-6318.
Enforcement
The attorney general or any district attorney, by action seeking injunctive relief (72-6317).
Licence
The corpus reproduces K.S.A. 72-6312 to 72-6320 verbatim from the Kansas Office of Revisor of Statutes' per-section pages, with each section's History line and "Source or Prior Law" note.
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."
The statute pages (ksrevisor.gov — 72-6315, read 2026-10-08) carry no copyright notice.
Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).
Related
- Kansas Student Online Personal Protection Act — the companion operator statute (K.S.A. 72-6331 to 72-6334)
- Idaho Code §33-133 — the same 2014 model
- Illinois BIPA — the biometric statute with a private right of action
- PPRA · FERPA — the federal survey and records regimes