As tech firms collect and sell student data, new state law aims to protect their privacy

THE MASSIVE EDUCATION TECHNOLOGY INDUSTRY, including providers such as Canvas and DuoLingo, will face stricter rules around students’ privacy starting next year after Gov. Gavin Newsom signed a new law Thursday. 

The law, Assembly Bill 1159, prohibits technology companies from using student data to train or develop AI models at a time when California’s K-12 schools, community colleges and universities are increasingly relying on AI for learning, grading and navigating bureaucratic issues. 

The new law by Assemblymember Dawn Addis, a San Luis Obispo Democrat, also expands on California’s landmark education technology law, which limits how companies can use data from students in prekindergarten, preschool and K-12. The new law applies the same rules to the use of college students’ data and broadens the scope of companies subject to the regulations.

“Ensuring data privacy and protection is vital to our children’s well-being, dignity, and right to learn. No child should be put at risk of big tech taking advantage of their personal data for financial — or any kind of gain,” said Addis in a news release Thursday. 

The law had powerful supporters, including unions representing California teachers, nurses and college professors, all of which have donated millions to legislators over the years. TechNet and the California Chamber of Commerce, two powerful pro-tech and pro-industry groups, opposed the bill but did not respond before publication to CalMatters’ request for comment. 

In 2014, California became the first state in the country to regulate education technology companies’ use of student data. But as apps and websites came to dominate students’ lives at all levels of education, loopholes emerged. That law, for instance, applies to companies that “primarily” serve students and that are designed and marketed for them. It excludes popular products, such as Google or YouTube, which can easily argue that they are not primarily for students and were not originally designed and marketed for them, even though their tools are popular in classrooms.

“… No child should be put at risk of big tech taking advantage of their personal data for financial — or any kind of gain.”
Assemblymember Dawn Addis

The new law says any company that knows its products are used in schools and whose products are designed or marketed to students are prohibited from selling the data they collect or using that information for anything beyond that student’s education. 

“It’s a good day for our children, it’s a good day for the state of California, and it’s a good day for California’s leadership,” said Newsom Thursday at a news conference before signing the law along with 12 others related to kids and technology, including those limiting children’s access to chatbots. 

The bill is unlikely to cover all of children’s data, especially for apps and websites that are used outside of the classroom or are not specifically endorsed by the school. California students routinely use technology to navigate after-school programs, sports and homework, often at the recommendation of a coach, teacher, parent or friend. 

Federal law forces companies to get parental consent before knowingly collecting or selling data from children 12 and under, but otherwise, a child who is using technology outside of school has no more privacy rights than an adult.

This story originally appeared in CalMatters.