language: en · status: in-force · last checked: 2026-10-08

Utah — Student Data Protection (Utah Code Title 53E, Chapter 9, Part 3)

Part 3 of Utah's "Student Privacy and Data Protection" chapter governs how education entities (the state board, LEAs, schools) collect, secure, use and share student data, and binds third-party contractors that receive student data under contract directly: purpose limitation, mandatory contract terms, return or deletion at contract end, prohibitions on sale and targeted advertising, civil penalties of up to $25,000 and a private right of action. Several sections were amended by the 2026 General Session with effect from 1 July 2026; the text here is that current version (in_force_from records the latest effective date among the sections carried; each section prints its own).

Applicability to EdTech

• Who is bound. A "third-party contractor" is a person who is not an education entity and who, "in accordance with a contract with an education entity, collects or receives student data in order to provide a product or service" (§53E-9-301(20)). Every vendor contracting with a Utah LEA or school that receives student data qualifies.
• What is covered. "Student data" is "information about a student at the individual student level" (§53E-9-301(17)(a)); "personally identifiable student data" includes "a student's biometric identifier" (§53E-9-301(15)(b)(vii)). A "biometric identifier" excludes a voiceprint and a photograph (§53E-9-301(3)(b)); collection of biometric identifiers or information by an education entity requires a separate biometric collection notice and written consent (§53E-9-305(6)).
• Purpose limitation. A contractor "shall use personally identifiable student data received under a contract with an education entity strictly for the purpose of providing the contracted product or service within the negotiated contract terms" (§53E-9-309(1)).
• Mandatory contract terms. The education entity must require in the contract: collection/use/storage/sharing restrictions; a description of persons, including affiliates, with whom the contractor may share student data; deletion on request; if required, a ban on secondary use; an audit right; and the entity's statutory duty to terminate for a privacy violation, with no fee or financial liability for termination (§53E-9-309(2)(a)(i)). After notice of a violation, the entity must terminate no sooner than 30 days later unless the contractor remedies it and establishes preventive processes (§53E-9-309(2)(a)(iii)); the contractor may not impose a fee or seek damages for that termination (§53E-9-309(2)(b)).
• Prohibitions. A contractor may not sell student data, collect, use or share it inconsistently with the contract, or use it for targeted advertising (§53E-9-309(6)(a)).
• End of contract. Return or delete all personally identifiable student data at the completion of a contract that is not renewed, absent parental written consent (§53E-9-309(5)).
• Permitted uses. Adaptive or customized learning, operability and functionality, and non-paid recommendation engines (§53E-9-309(4)).

Contents

Key obligations at a glance

• Use personally identifiable student data strictly to provide the contracted service — §53E-9-309(1).
• Accept the statutory contract terms, including audit and termination for privacy violations — §53E-9-309(2)(a)(i).
• No sale, no use inconsistent with the contract, no targeted advertising — §53E-9-309(6)(a).
• Return or delete personally identifiable student data when an unrenewed contract ends — §53E-9-309(5).

Enforcement

A third-party contractor that knowingly or recklessly permits unauthorized collecting, sharing or use of student data may be barred from future contracts with education entities, may be required by the state board to pay a civil penalty of up to $25,000, and may be required to pay the entity's notification costs and expenses (§53E-9-310(1)(a)). A parent or adult student may sue for damages caused by a knowing or reckless violation of §53E-9-309 (§53E-9-310(2)). An individual who knowingly or intentionally permits unauthorized use may be guilty of a class A misdemeanor (§53E-9-310(1)(e)). Reports of suspected violations go to the state board student data privacy team, which may audit or investigate the contractor (§53E-9-309(2)(c)).

Licence

The corpus reproduces Utah Code §§53E-9-301 to 53E-9-311 verbatim from the Utah Legislature's versioned code files.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties."

The Legislature's Terms of Use (le.utah.gov/documents/disclaimer.htm, read 2026-10-08) say under "4. Copyright Limitations": "The Legislature makes no warranty that information on a legislative web site is free from copyright claims or other restrictions or limitations on free use or display." That is a disclaimer of warranty, not a claim of rights; the statute text is the Legislature's own enactment and the catchlines, "Effective" dates and History lines are the work of the Office of Legislative Research and General Counsel in the course of its legislative duties.

Conditions: none attach. The corpus names the official source in Sources and in each section's {.meta} provenance line, and its Meta section describes what it changed (anchors added, nothing reworded).

Related

• SDPC supplemental state terms for Utah — the contract exhibit that implements §53E-9-309 in NDPA-based agreements
• Connecticut — student data privacy — another statute that dictates the terms of the school–vendor contract
• FERPA — named in §53E-9-309(2)(a)(ii) and the federal layer for education records
• COPPA — named in §53E-9-309(2)(a)(ii)

Sources

• Utah Legislature — Utah Code Title 53E, Chapter 9, Part 3
• Utah Legislature — Utah Code §53E-9-309