EdLaw
New York Education Law §2-d
New York's student data privacy statute, binding educational agencies and their third-party contractors: prohibitions on selling student data and use for marketing, required contract terms, a parents' bill of rights, data security and privacy plans, and breach notification. Implemented by the NYSED regulations at 8 NYCRR Part 121. Citation: N.Y. Educ. Law §2-d, published at nysenate.gov/legislation/laws/EDN/2-D.
Status: statute fact documents pending
No statute text is reproduced here yet. The NY Senate site returns HTTP 403 to non-browser clients (bot protection, not geo-blocking — nysed.gov fetches fine), and the legislature's legacy LRS server (public.leginfo.state.ny.us) returns 502; so the statute text could not be extracted mechanically at last check (2026-09-05). Per METHODOLOGY.md no text is included that has not been verified against the definitive source. The nysenate.gov link works in ordinary browsers.
To complete: obtain §2-d (and 8 NYCRR Part 121) via a browser save or permitted route, extract the contractor prohibitions and required contract/security provisions, and verify mechanically per the methodology.
Archived sources
- sources/NYSED-Data-Privacy-and-Security-Policy-2021-06-14.pdf — the NYS Education Department's own Data Privacy and Security Policy (2021-06-14), made under Education Law §2‐d; retrieved 2026-09-05 from nysed.gov. Regulator policy, not the statute text.
Applicability to EdTech
§2-d is among the strictest state regimes: NY districts require signed Data Privacy Agreements incorporating its parents' bill of rights and security requirements (including encryption in transit and at rest) before any student data reaches a vendor.
Related
Sources
- NY Senate — Education Law §2-d (blocks non-browser clients; see status note)
- NYSED — Data Privacy and Security Policy (PDF, archived in sources/)