language: en · last checked: 2026-10-26

Kansas — Student Online Personal Protection Act (K.S.A. 72-6331 to 72-6334)

Kansas's SOPIPA-model statute, which binds the operator of a website, online service, online application or mobile application used primarily for, and designed and marketed for, K-12 school purposes: the definitions, the operator prohibitions and duties, and enforcement.

K.S.A. 72-6331. Student online personal protection act

Verbatim from Kansas Office of Revisor of Statutes — 72-6331, fetched live; see Meta.

K.S.A. 72-6331 through 72-6334, and amendments thereto, shall be known and may be cited as the student online personal protection act.

History: L. 2016, ch. 57, § 1; July 1. Source or Prior Law: 72-6224.

K.S.A. 72-6332. Definitions

Verbatim from Kansas Office of Revisor of Statutes — 72-6332, fetched live; see Meta.

As used in K.S.A. 72-6331 through 72-6334, and amendments thereto:

(a) "Educational purposes" means purposes that are directed by an employee or agent of a school district, that customarily take place at an attendance center operated by a school district or that aid in the administration of school activities, including, but not limited to, instruction in the classroom or at home, administrative activities and collaboration between students, school personnel or parents, or which are otherwise for the use and benefit of the school district.

(b) "Interactive computer service" means any service, system or software provider that provides or enables multiple users access to a computer server, including a service or system that provides access to the internet and systems or services offered by libraries or educational institutions.

(c) "Educational online product" means an internet website, online service, online application or mobile application that is used primarily, and was designed and marketed for, educational purposes.

(d)

(1) "Operator" means, to the extent it is operating in this capacity, the operator of an educational online product with actual knowledge that the educational online product is used primarily for educational purposes and was designed and marketed for educational purposes.
(2) The term "operator" does not include:
- (A) Any school district or school district employee acting on behalf of a school district employer; or
- (B) any national assessment provider that is administering a college and career readiness assessment.

(e) "Personally identifiable information" means information that personally identifies an individual student or that is linked to information that personally identifies an individual student, including, but not limited to:

(1) Information in the student's educational record or electronic mail; (2) first and last name; (3) home address; (4) telephone number; (5) electronic mail address; (6) any other information that allows physical or online contact with the student; (7) discipline records; (8) test results; (9) data that is a part of or related to any individualized education program for such student; (10) juvenile dependency records; (11) grades; (12) evaluations; (13) criminal records; (14) medical records; (15) health records; (16) social security number; (17) biometric information; (18) disabilities; (19) socioeconomic information; (20) food purchases; (21) political affiliations; (22) religious information; (23) text messages; (24) documents; (25) student identifiers; (26) search activity; (27) photos; (28) voice recordings; or (29) geolocation information.

(f) "School district" means any unified school district organized and operating under the laws of this state.

(g) "Service provider" means a person or entity that provides a service to an operator, or provides a service that enables users to access content, information, electronic mail or other services offered over the internet or a computer network.

(h) "Student information" means personally identifiable information or material in any media or format that is not otherwise available to the public and was:

(1) Created by an operator in the course of the use of the operator's educational online product for educational purposes;
(2) provided to an operator by a student, or the student's parent or legal guardian, in the course of the use of the operator's educational online product for educational purposes;
(3) created by an operator as a result of the activities of an employee or agent of a school district;
(4) provided to an operator by an employee or agent of a school district for educational purposes; or
(5) gathered by an operator through the operation of such operator's educational online product for educational purposes.

(i) "Targeted advertising" means presenting an advertisement to a student where the advertisement is selected based on information obtained or inferred over time from that student's online behavior, usage of online applications or student information. Targeted advertising does not include advertising to a student at an online location based upon that student's current visit to that location, or in response to that student's request for information or feedback, without the retention of that student's online activities or requests over time for the purpose of targeting subsequent advertisements.

History: L. 2016, ch. 57, § 2; L. 2022, ch. 86, § 10; July 1. Source or Prior Law: 72-6225.

K.S.A. 72-6333. Same; operator prohibitions; exceptions

Verbatim from Kansas Office of Revisor of Statutes — 72-6333, fetched live; see Meta.

(a) An operator shall not knowingly:

(1) Engage in targeted advertising on the operator's educational online product, or target advertising on any other educational online product if the targeting of the advertising is based on any information, including student information and persistent unique identifiers, that the operator has acquired because of the use of such operator's educational online product for educational purposes;
(2) use information, including student information and persistent unique identifiers, created or gathered through the operation of such operator's educational online product, to amass a profile about a student, except in furtherance of educational purposes;
(3) sell or rent student information to a third party, except when such information is part of the assets being transferred during the purchase, merger or other acquisition of an operator by another entity, provided, the successor entity complies with the provisions of this subsection as though it were an operator with respect to the acquired student information; or
(4) disclose student information unless the disclosure is made for the following purposes:
- (A) For legitimate research purposes subject to and as allowed by federal and state law, and under the direction of a school district or the state department of education, provided the student information is not used for advertising or to amass a profile on the student for purposes other than educational purposes, or for any other purposes other than educational purposes;
- (B) that information described in K.S.A. 72-6332(e)(2) and (e)(8), and amendments thereto, upon request by a school district or state agency for educational purposes;
- (C) to law enforcement agencies or to a court of competent jurisdiction to protect the safety or integrity of users of the operator's educational online product or other individuals, or the security of such educational online product;
- (D) for educational or employment purposes upon request by the student or the student's parent or legal guardian, provided the student information is not used or further disclosed for any other purpose;
- (E) to a service provider, provided the operator contractually: (i) Prohibits the service provider from using any student information for any purpose other than providing the contracted service to or on behalf of the operator; (ii) prohibits the service provider from disclosing any student information provided by the operator with subsequent third parties; and (iii) requires the service provider to implement and maintain reasonable security procedures and practices to ensure the confidentiality of the student information; or
- (F) in the course of transferring assets as a part of a business purchase, merger or other acquisition as described in subsection (a)(3).

(b) An operator shall:

(1) Implement and maintain reasonable security procedures and practices appropriate to the nature of the student information which are designed to protect such information from unauthorized access, destruction, use, modification or disclosure; and
(2) delete within a reasonable period of time student information upon request by the school district, unless the student or the student's parent or legal guardian requests that such information continue to be maintained.

(1) Using student information to maintain, develop, support, improve or diagnose the operator's educational online product;
(2) using student information to improve educational products, provided such information is not associated with an identified student within the operator's educational online product or within other online products owned by the operator;
(3) using student information to demonstrate the effectiveness of the operator's educational online products, including in their marketing, provided such information is not associated with an identified student within the operator's educational online product or within other online products owned by the operator;
(4) sharing student information for purposes of development and improvement of educational online products, provided such information is not associated with an identified student within the operator's educational online product or within other online products owned by the operator;
(5) using recommendation engines to suggest to a student additional content or services within the operator's educational online product related to an educational, other learning or employment opportunity purpose, provided the recommendation is not determined in whole or in part by payment or other consideration from a third party; or
(6) responding to a student's request for information or feedback, provided such response is not determined in whole or in part by payment or other consideration from a third party.

(d) Nothing in this section shall be construed to:

(1) Limit the authority of a law enforcement agency to obtain any content or information from an operator as authorized by law or pursuant to a court order;
(2) limit the ability of an operator to use student information for adaptive learning or customized student learning purposes;
(3) apply to general audience internet websites, general audience online services, general audience online applications or general audience mobile applications, even if login credentials created for an operator's educational online product may be used to access those general audience websites, online services or online applications;
(4) limit service providers from providing internet connectivity to schools or to students and the students' parents or legal guardians;
(5) prohibit an operator from marketing educational products directly to parents and legal guardians, provided such marketing does not result from the use of student information obtained by the operator through the operation of such operator's educational online products;
(6) impose a duty upon a provider of an electronic store, gateway, marketplace or other means of purchasing or downloading software or applications to review or enforce the compliance with this section on such software or applications;
(7) impose a duty upon a provider of an interactive computer service to review or enforce the compliance with this section by third-party content providers; or
(8) prohibit students from downloading, exporting, transferring, saving or maintaining such student's own student information or documents.

(e) As used in this section, the term "amass a profile" shall not include the collection and retention of account information that remains under the control of the student, the student's parent or legal guardian or the school district.

History: L. 2016, ch. 57, § 3; July 1. Source or Prior Law: 72-6226.

K.S.A. 72-6334. Same; enforcement

Verbatim from Kansas Office of Revisor of Statutes — 72-6334, fetched live; see Meta.

The attorney general or any district attorney may enforce the provisions of the student online personal protection act by bringing an action in a court of competent jurisdiction, and may seek injunctive relief to enjoin any operator in possession of student information from disclosing any student information in violation of the provisions of the student online personal protection act.

History: L. 2016, ch. 57, § 4; July 1. Source or Prior Law: 72-6227.