EdLaw
Ohio — technology providers and school-issued device monitoring (R.C. §§3319.325–3319.327)
Three linked sections of the Ohio Revised Code, all enacted by H.B. 432 of the 135th General Assembly and effective 9 December 2024. Together they bind a "technology provider" contracting with an Ohio school district, and — distinctively — restrict what either the district or the provider may do with a school-issued device in a student's hands.
The device-monitoring rule in §3319.327 is the part with few parallels in other states: it is a default prohibition on electronic access, not a disclosure requirement.
Applicability to EdTech
A supplier of curriculum, testing or assessment technology to an Ohio district is a technology provider and is bound directly. Three consequences carry the most weight commercially:
- Education records created or received under the contract are solely the property of the school district (§3319.326(A)).
- Absent reasonably anticipated renewal, records must be destroyed or returned within 90 days of contract expiry (§3319.326(C)).
- No use of education records for any commercial purpose, marketing and advertising to a student or parent expressly included (§3319.326(E)).
For any device that ships with a camera, microphone, location services or activity logging, §3319.327 is the governing provision and should be read before designing telemetry, remote support or proctoring features.
Key obligations at a glance
Technology providers (§3319.326)
- Education records are the district's property — (A).
- On discovering a security breach, disclose to the district everything needed to satisfy R.C. §1347.12 — (B).
- Destroy or return all education records within 90 days of contract expiry — (C).
- No sale, sharing or dissemination of education records — (D).
- No commercial use, including marketing or advertising to a student or parent — (E).
- The contract must carry security safeguards, a restriction on unauthorised employee/contractor access, and need-to-know authorisation — (F)(1), (F)(2).
- Districts give parents and students direct notice of each such provider by 1 August each school year — (G).
School-issued devices (§3319.327)
- A district or technology provider shall not electronically access or monitor a device's location-tracking features, its audio or visual receiving/transmitting/recording features, or student interactions including keystrokes and web-browsing activity — (A)(1)–(A)(3).
- Six exceptions only: noncommercial educational purpose (instruction, technical support, exam-proctoring), judicial warrant or subpoena, a missing or stolen device, a threat to life or safety, compliance with federal or state law, and participation in federal or state funding programmes — (B).
- Where a district or provider elects to monitor generally under any of those circumstances, the district must give written notice to parents that year — (C)(1).
- After responsive action on a warrant/subpoena or a missing device, notice follows within 72 hours — (C)(2).
Contents
| Document | Covers |
|---|---|
| SCHOOL-DEVICE-MONITORING.md | §§3319.325–3319.327 in full — definitions, technology-provider duties over education records, and the device-monitoring prohibition with its exceptions and notice rules |
Licence
The reproduced text is R.C. §§3319.325 to 3319.327, enacted by the Ohio General Assembly and served by the Legislative Service Commission on codes.ohio.gov. No copyright subsists in this text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It went on: "judges—and, we now confirm, legislators—may not be considered the 'authors' of the works they produce in the course of their official duties as judges and legislators. That rule applies regardless of whether a given material carries the force of law." (slip opinion, pp. 1 and 5–6, read 2026-10-01.)
The pages link a Disclaimer page this audit did not read; nothing on the section pages asserts copyright (the builder's cached copies, checked 2026-10-01).
Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup and anchors only). Nothing here suggests that the Ohio General Assembly endorses the corpus.
Related
- Illinois SOPPA — the other state regime binding schools as well as vendors
- North Carolina §115C-401.2 — the operator-side sibling
- FERPA — the federal education-records regime §3319.325 borrows its definition from