EdLaw
Texas — student information protection (Tex. Educ. Code §§32.151–32.157)
Education Code Chapter 32, Subchapter D in full — the SOPIPA-style regime binding operators of websites, online services and mobile applications used primarily for a school purpose: the prohibited uses of covered information, the permitted disclosures and uses, the security duty, the deletion duty on a school district's request, and the applicability limits.
Sec. 32.151. DEFINITIONS.
In this subchapter:
- (1) "Covered information" means personally identifiable information or information that is linked to personally identifiable information, in any media or format, that is not publicly available and is:
- (A) created by or provided to an operator by a student or the student's parent in the course of the student's or parent's use of the operator's website, online service, online application, or mobile application for a school purpose;
- (B) created by or provided to an operator by an employee of a school district or school campus for a school purpose; or
- (C) gathered by an operator through the operation of the operator's website, online service, online application, or mobile application for a school purpose and personally identifies a student, including the student's educational record, electronic mail, first and last name, home address, telephone number, electronic mail address, information that allows physical or online contact, discipline records, test results, special education data, juvenile delinquency records, grades, evaluations, criminal records, medical records, health records, social security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, student identifiers, search activity, photograph, voice recordings, or geolocation information.
- (2) "Interactive computer service" has the meaning assigned by 47 U.S.C. Section 230.
- (3) "Operator" means, to the extent operating in this capacity, the operator of a website, online service, online application, or mobile application who has actual knowledge that the website, online service, online application, or mobile application is used primarily for a school purpose and was designed and marketed for a school purpose.
- (4) "Parent" includes a person standing in parental relation.
- (5) "School purpose" means a purpose that is directed by or customarily takes place at the direction of a school district, school campus, or teacher or assists in the administration of school activities, including instruction in the classroom or at home, administrative activities, and collaboration between students, school personnel, or parents, or is otherwise for the use and benefit of the school.
- (6) "Targeted advertising" means presenting an advertisement to a student in which the advertisement is selected for the student based on information obtained or inferred over time from the student's online behavior, usage of applications, or covered information. The term does not include advertising to a student at an online location based on the student's visit to that location at that time, or in response to the student's request for information or feedback, without the retention of the student's online activities or requests over time for the purpose of targeting subsequent advertisements.
Added by Acts 2017, 85th Leg., R.S., Ch. 355 (H.B. 2087), Sec. 2, eff. September 1, 2017.
Sec. 32.152. PROHIBITED USE OF COVERED INFORMATION.
- (a) An operator may not knowingly:
- (1) engage in targeted advertising on any website, online service, online application, or mobile application if the target of the advertising is based on any information, including covered information and persistent unique identifiers, that the operator has acquired through the use of the operator's website, online service, online application, or mobile application for a school purpose;
- (2) use information, including persistent unique identifiers, created or gathered by the operator's website, online service, online application, or mobile application, to create a profile about a student unless the profile is created for a school purpose; or
- (3) except as provided by Subsection (c), sell or rent any student's covered information.
- (b) For purposes of Subsection (a)(2), the collection and retention of account information by an operator that remains under the control of the student, the student's parent, or the campus or district is not an attempt to create a profile by the operator.
- (c) Subsection (a)(3) does not apply to:
- (1) the purchase, merger, or any other type of acquisition of an operator by another entity, if the operator or successor entity complies with this subchapter regarding previously acquired student information; or
- (2) a national assessment provider if the provider secures the express affirmative consent of the student or the student's parent, given in response to clear and conspicuous notice, and if the information is used solely to provide access to employment, educational scholarships, financial aid, or postsecondary educational opportunities.
Added by Acts 2017, 85th Leg., R.S., Ch. 355 (H.B. 2087), Sec. 2, eff. September 1, 2017.
Sec. 32.153. ALLOWED DISCLOSURE OF COVERED INFORMATION.
- (a) An operator may use or disclose covered information under the following circumstances:
- (1) to further a school purpose of the website, online service, online application, or mobile application and the recipient of the covered information disclosed under this subsection does not further disclose the information unless the disclosure is to allow or improve operability and functionality of the operator's website, online service, online application, or mobile application;
- (2) to ensure legal and regulatory compliance;
- (3) to protect against liability;
- (4) to respond to or participate in the judicial process;
- (5) to protect:
- (A) the safety or integrity of users of the website, online service, online application, or mobile application; or
- (B) the security of the website, online service, online application, or mobile application;
- (6) for a school, education, or employment purpose requested by the student or the student's parent and the information is not used or disclosed for any other purpose;
- (7) to use the covered information for:
- (A) a legitimate research purpose; or
- (B) a school purpose or postsecondary educational purpose; or
- (8) for a request by the agency or the school district for a school purpose.
- (b) A national assessment provider or a provider of a college and career counseling service may, in response to a request of a student, and on receiving the express affirmative consent of the student or the student's parent given in response to clear and conspicuous notice, use or disclose covered information solely to provide access to employment, educational scholarships, financial aid, or postsecondary educational opportunities.
- (c) An operator may disclose covered information if a provision of federal or state law requires the operator to disclose the information. The operator must comply with the requirements of federal and state law to protect the information being disclosed.
- (d) An operator may disclose covered information to a third party if the operator has contracted with the third party to provide a service for a school purpose for or on behalf of the operator. The contract must prohibit the third party from using any covered information for any purpose other than providing the contracted service. The operator must require the third party to implement and maintain reasonable procedures and practices designed to prevent disclosure of covered information.
- (e) Nothing in this subchapter prohibits the operator's use of covered information for maintaining, developing, supporting, improving, or diagnosing the operator's website, online service, online application, or mobile application.
Added by Acts 2017, 85th Leg., R.S., Ch. 355 (H.B. 2087), Sec. 2, eff. September 1, 2017.
Sec. 32.154. ALLOWED USE OF COVERED INFORMATION.
This subchapter does not prohibit an operator from:
- (1) using covered information:
- (A) to improve educational products if that information is not associated with an identified student using the operator's website, online service, online application, or mobile application; and
- (B) that is not associated with an identified student to demonstrate the effectiveness of the operator's products or services and to market the operator's services;
- (2) sharing covered information that is not associated with an identified student for the development and improvement of educational websites, online services, online applications, or mobile applications;
- (3) recommending to a student additional services or content relating to an educational, learning, or employment opportunity within a website, online service, online application, or mobile application if the recommendation is not determined by payment or other consideration from a third party;
- (4) responding to a student's request for information or for feedback without the information or response being determined by payment or other consideration from a third party; or
- (5) if the operator is a national assessment provider or a provider of a college and career counseling service, identifying for a student, with the express affirmative consent of the student or the student's parent, institutions of higher education or scholarship providers that are seeking students who meet specific criteria, regardless of whether the identified institution of higher education or scholarship provider provides consideration to the operator.
Added by Acts 2017, 85th Leg., R.S., Ch. 355 (H.B. 2087), Sec. 2, eff. September 1, 2017.
Sec. 32.155. PROTECTION OF COVERED INFORMATION.
- (a) An operator must implement and maintain reasonable security procedures and practices designed to protect any covered information from unauthorized access, deletion, use, modification, or disclosure.
- (b) Any operator that has been approved by the agency or had a product adopted by the agency and possesses any covered information must use the unique identifier established by the Texas Student Data System (TSDS) or a successor data management system maintained by the agency for any account creation, data upload, data transmission, analysis, or reporting to mask all personally identifiable student information. The operator shall adhere to a state-required student data sharing agreement that includes an established unique identifier standard for all operators as prescribed by the agency.
- (c) In addition to including the unique identifier in releasing information as provided by Subsection (b), an operator may include any other data field identified by the agency or by a school district, open-enrollment charter school, regional education service center, or other local education agency as necessary for the information being released to be useful.
- (d) A school district, open-enrollment charter school, regional education service center, or other local education agency may include additional data fields in an agreement with an operator or the amendment of an agreement with an operator under this section. An operator may agree to include the additional data fields requested by a school district, open-enrollment charter school, regional education service center, or other local education agency but may not require that additional data fields be included.
- (e) A school district, open-enrollment charter school, regional education service center, or other local education agency may require an operator that contracts directly with the entity to adhere to a state-required student data sharing agreement that includes the use of an established unique identifier standard for all operators as prescribed by the agency.
- (f) A national assessment provider who receives covered information from a student or from a school district or campus on behalf of a student is not required to comply with Subsection (b) or (e) if the provider receives the covered information solely to provide access to:
- (1) employment, educational scholarships, financial aid, or postsecondary educational opportunities; or
- (2) educational resources for middle school, junior high school, or high school students.
- (g) The commissioner may adopt rules as necessary to administer this section.
Added by Acts 2017, 85th Leg., R.S., Ch. 355 (H.B. 2087), Sec. 2, eff. September 1, 2017.
Amended by:
Acts 2021, 87th Leg., R.S., Ch. 806 (H.B. 1525), Sec. 14, eff. September 1, 2023.
Sec. 32.156. DELETION OF COVERED INFORMATION.
If a school district requests the deletion of a student's covered information under the control of the school district and maintained by the operator, the operator shall delete the information not later than the 60th day after the date of the request, or as otherwise specified in the contract or terms of service, unless the student or the student's parent consents to the operator's maintenance of the covered information.
Added by Acts 2017, 85th Leg., R.S., Ch. 355 (H.B. 2087), Sec. 2, eff. September 1, 2017.
Sec. 32.157. APPLICABILITY.
This subchapter does not:
- (1) limit the authority of a law enforcement agency to obtain any information from an operator as authorized by law or under a court order;
- (2) limit the ability of an operator to use student data, including covered information, for adaptive learning or customized student learning purposes;
- (3) apply to general audience:
- (A) websites;
- (B) online services;
- (C) online applications; or
- (D) mobile applications;
- (4) limit service providers from providing Internet connection to school districts or students and students' families;
- (5) prohibit an operator from marketing educational products directly to a student's parent if the marketing is not a result of the use of covered information obtained by the operator through providing services to the school district;
- (6) impose a duty on a provider of an electronic store, gateway, marketplace, or other means of purchasing or downloading software or applications to review or enforce compliance with this subchapter on those applications or software;
- (7) impose a duty on a provider of an interactive computer service to review or enforce compliance with this subchapter by third-party content providers;
- (8) prohibit a student from downloading, exporting, transferring, saving, or maintaining the student's data or documents; or
- (9) alter the rights or duties of the operator, provider, school, parent, or student under the Family Educational Rights and Privacy Act of 1974 (20 U.S.C. Section 1232g) or other federal law.
Added by Acts 2017, 85th Leg., R.S., Ch. 355 (H.B. 2087), Sec. 2, eff. September 1, 2017.