SS1 for SB79: Protecting the Privacy of Delaware Students

Students use websites and applications provided by commercial technology companies every day.
These products have great educational value, but also create large quantities of student data, much of
it personal, that companies can currently use for profit. According to a recent survey, an overwhelming
majority of parents believe that student use of technology for school purposes is one of todays most
important educational issues, but they are concerned about the security and privacy of their children's
data, how that data is collected and used, and advertisers having access to their children when they are
using educational technology. Attorney General Denn, Sen. Sokola, and Reps. Jaques and Ramone
propose SS1 for SB79 to address these concerns and prevent our students from being used as profit
centers. SS 1 for SB 79 is a balanced bill that permits innovation and research, and allows operators to
provide adaptive and personalized learning, while ensuring the privacy and security of student data.

Protecting students when they use K-12 sites and apps

SS1 for SB79 protects a broad range of student data, including student records, emails, searches, and
personally identifiable information, from commercial use by operators of sites and applications used for
school purposes, by drawing bright line prohibitions that forbid:

Targeting students or parents with advertising based on the students data

Creating a student profile based on student data for use outside of school
Selling student data
Disclosing student data to third parties (except in limited, specified circumstances)

SS1 for SB79 will also require operators to ensure the security of student data they collect or maintain,
protect that student data from unauthorized access or use, and to delete data when requested by a
school. Modeled on Californias Student Online Personal Information Protection Act, SS1 for SB79 is
supported by Common Sense Media, one of the countrys leading advocates for protecting children
online, and by Microsoft, a major provider of educational technology services. The Department of
Justices Consumer Protection Unit will enforce the Act.

Protecting student data held by schools and DOE

Protecting student data does not stop with commercial entities and uses. To ensure the privacy and
security of student data held at all levels of our public school system while allowing legitimate academic
and research uses, SS1 for SB79 establishes a task force of stakeholders, including parents and
educators, to make findings and recommendations for the development of a comprehensive framework
of protections and implementing legislation.

Maintaining students protections in SS1 for SB79

While many suggestions from stakeholders to improve language in SS1 for SB79 have been accepted
and incorporated, others have been rejected as undermining the bills aims, including:

Exempting accounts under student, family, school, or district control or other vaguely-worded
exceptions will allow companies to assemble profiles for non-educational purposes, such as
determining creditworthiness or insurability.
Allowing targeted advertising based on single searches, even if data isnt retained, still exposes
children to commercial, non-educational, and possibly age-inappropriate advertising in school.
Narrowing bill to cover only personally identifiable information instead of all student data will gut
protections children and privacy advocates see as crucial to adequately protecting student data.
Exempting recommendation engines would allow companies to target advertising to students
within K-12 apps and services based on a students prior activity. Educators, not companies,
should be making the recommendations.
Allowing targeted advertising, profiling, or disclosure of student data if a student or parent
affirmatively consents will create a loophole allowing operators to bypass the bills protections,
such as by having students do something as minimal as clicking on a yes box on their device
screens in order to access the K-12 apps and services.