EdLaw
Michigan — Student Online Personal Protection Act (2016 PA 368)
The Student Online Personal Protection Act, 2016 PA 368, effective 22 March 2017, codified at MCL 388.1291, 388.1293 and 388.1295. It is Michigan's SOPIPA-model statute: it binds the operator of a website, online service, online application or mobile application designed, marketed and used primarily for K-12 school purposes, directly and regardless of whether a contract with the school exists. It prohibits targeted advertising, profiling and sale of student information, limits disclosure to listed purposes, and imposes security and deletion-on-request duties.
Applicability to EdTech
- Who is bound. An "operator" is the operator of an Internet website, online service, online application, or mobile application "with actual knowledge that the site, service, or application is used primarily for K–12 school purposes and was designed and marketed for K–12 school purposes" (MCL 388.1293(e)). A product sold to schools and used in class fits that definition; general-audience services are carved out (388.1295(5)(c)).
- What is protected. "Covered information" includes information gathered "through the operation of a site, service, or application for K-12 school purposes" that personally identifies a student, and the list names "biometric information", "photos, voice recordings, or geolocation information", "search activity" and "student identifiers" (388.1293(a)(iii)). Devices that capture voice or images in class are squarely within it.
- Prohibitions. An operator shall not knowingly engage in targeted advertising, amass a profile about a student except in furtherance of K-12 school purposes, sell or rent a student's information, or disclose covered information outside the listed purposes (388.1295(1)(a)–(d)).
- Subprocessors. Disclosure to a service provider is permitted only if the operator "contractually prohibits the service provider from using any covered information for any purpose other than providing the contracted service", prohibits onward disclosure, and requires reasonable security (388.1295(1)(d)(vi)). Hosting, AI and analytics vendors need those terms flowed down.
- Duties. Implement and maintain reasonable security procedures and practices, and delete a student's covered information if the school or district requests it (388.1295(2)).
- Permitted uses. De-identified data may be used to improve educational products and to demonstrate effectiveness, including in marketing (388.1295(4)(a)–(c)); adaptive learning and customized learning are preserved (388.1295(5)(b)).
Contents
| Document | Covers |
|---|---|
| SOPPA.md | MCL 388.1291 (short title), 388.1293 (definitions), 388.1295 (operator prohibitions, duties, permitted uses) in full |
Key obligations at a glance
- No targeted advertising based on information acquired through K-12 use — 388.1295(1)(a).
- No student profiles except in furtherance of K-12 school purposes — 388.1295(1)(b).
- No sale or rental of student information — 388.1295(1)(c).
- Disclose covered information only for the listed purposes, and to service providers only under contractual use, onward-disclosure and security restrictions — 388.1295(1)(d).
- Reasonable security; delete on the school's or district's request — 388.1295(2)(a)–(b).
Enforcement
The act names no enforcing agency, penalty or private right of action in its text (SOPPA.md). Any remedy would arise under other Michigan law; none is extracted here.
Licence
The corpus reproduces MCL 388.1291, 388.1293 and 388.1295 verbatim from the Michigan Legislature's MCL pages.
Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties."
The MCL pages carry no copyright notice. Their footer (as captured) says: "The Michigan Legislature Website is a free service of the Legislative Service Bureau in cooperation with the Michigan Legislative Council, the Michigan House of Representatives, the Michigan Senate, and the Library of Michigan." and "The information obtained from this site is not intended to replace official versions of that information and is subject to revision." The section catchlines and History credits are the Legislative Service Bureau's, an agency of the Legislature acting in its legislative duties.
Conditions: none attach. The corpus names the official source in Sources and in each section's {.meta} provenance line, and its Meta section describes what it changed (anchors added, nothing reworded). Because the text is a website rendering, check the official version before relying on exact wording.
Related
- California SOPIPA — the model this act follows almost word for word
- Iowa — student online personal information protection (Iowa Code §279.71) — the same model enacted in Iowa
- Connecticut — student data privacy (C.G.S. §§10-234aa–10-234gg) — a contract-based regime layered on the same operator duties
- FERPA — the federal records layer; 388.1295(5)(i) refers to the annual notice under 34 CFR 99.7
- COPPA — the federal children's-privacy layer for under-13 users