California protects student information through a combination of education-specific privacy laws, consumer privacy requirements, and protections for minors using online services. The law that applies depends on who holds the information, how it was collected, and how it is used.
California student privacy at a glance
Some requirements apply directly to educational technology providers, while others govern contracts entered into by local educational agencies, social-media monitoring programs, businesses, or online services used by minors. These laws operate alongside federal requirements such as FERPA and COPPA.
Key California protections
K–12 Pupil Online Personal Information Protection Act
Often called SOPIPA, this law applies to operators of online services designed and marketed primarily for K–12 school purposes. It restricts targeted advertising, profiles created for non-school purposes, the sale of pupil information, and unauthorized disclosure of covered information. Operators must also use reasonable security practices and comply with applicable deletion requirements.
California Consumer Privacy Act
The CCPA, as amended by the California Privacy Rights Act, gives California residents rights concerning personal information collected by businesses covered by the law. Depending on the circumstances, those rights can include knowing, deleting, correcting, limiting, and opting out of the sale or sharing of personal information. The CCPA is not a student-record law, and statutory exemptions and other privacy laws may affect how it applies to education data.
Education Code § 49073.1
When a local educational agency contracts with a third party to store, manage, or retrieve pupil records—or to provide digital educational software that accesses those records—the contract must contain specified privacy, security, access, correction, breach-notification, deletion, FERPA-compliance, and advertising provisions.
Education Code § 49073.6
This section governs programs through which a school district, county office of education, or charter school gathers or maintains information about enrolled pupils from social media. It requires notice and public comment before adoption and limits collection to information directly related to school or pupil safety. It also establishes access, correction, deletion, notification, and third-party contract requirements.
Privacy Rights for California Minors in the Digital World
Enacted through Senate Bill 568 and sometimes called the “Eraser Law,” this law requires covered websites, online services, applications, and mobile applications to allow a minor who is a registered user to remove—or request removal of—content or information the minor posted. The right has statutory exceptions, and removal does not guarantee complete erasure when information has been copied, reposted, anonymized, or must be retained by law.
What this means for educational agencies
Student privacy is a shared governance responsibility. Districts should inventory the information collected by each service, document the educational purpose, review contracts and subprocessors, establish access and correction procedures, require appropriate security and breach response, define retention and deletion rules, and prevent advertising or unrelated commercial uses.
Questions to include in a privacy review
- What student information is collected, and is every data element necessary?
- Which law governs the school, provider, business, record, or activity?
- Who can access the information, including subcontractors and subprocessors?
- Does the contract contain all required privacy, security, and deletion terms?
- How can parents, guardians, and eligible students inspect or correct information?
- What happens to accounts and data when the service or enrollment ends?
- How will the organization respond to an unauthorized disclosure or security incident?
A coordinated legal framework
No single statute covers every student-privacy situation. California requirements should be evaluated together with FERPA, COPPA, other applicable federal and state laws, district policy, contractual commitments, records-retention rules, and current regulatory guidance.