ABCDEFGHIJKLMNOPQRSTUVWXYZAAAB
1
State(Bill Number )YearCategory of Law (SOPIPA, etc.)Language Barring Sale of DataException for National Assessment CompaniesLink 1Notes
2
ArizonaSB13142017SOPIPA (Student Online Personal Information Protection Act); opt-out of technologyAn operator may not knowingly sell or rent a student's information, including covered information. This paragraph does not apply to the purchase, merger or other type of acquisition of an operator by another entity if the operator or successor entity complies with this section regarding previously acquired student information, or to national assessment providers if the provider secures the express written consent of the student's parent or guardian or the student that is given in response to a clear and conspicuous notice, solely to provide access to employment, educational scholarships or financial aid or postsecondary educational opportunitiesACT/SAT exception: An operator may not knowingly sell or rent a student's information, including covered information. This paragraph does not apply to national assessment providers if the provider secures the express written consent of the student's parent or guardian or the student that is given in response to a clear and conspicuous notice, solely to provide access to employment, educational scholarships or financial aid or postsecondary educational opportunitieshttps://apps.azleg.gov/BillStatus/GetDocumentPdf/453341with consent of student or parent
3
ColoradoHB14232016SOPIPA (Student Online Personal Information Protection Act); contract & on-demand provider requirementsTHIS ARTICLE DOES NOT PROHIBIT THE USE OF STUDENT
PERSONALLY IDENTIFIABLE INFORMATION TO: PROVIDE FOR THE STUDENT, ONLY WITH THE EXPRESS WRITIEN
CONSENT OF The STUDENT OR THE STUDENT'S PARENT GIVEN IN RESPONSE
TO CLEAR AND CONSPICUOUS NOTICE, ACCESS TO EMPLOYMENT
OPPORTUNITIES, EDUCATIONAL SCHOLARSHIPS OR FINANCIAL AID, OR
POSTSECONDARY EDUCATION OPPORTUNITIES, REGARDLESS OF WHETHER
THE SCHOOL SERVICES CONTRACT PROVIDER RECEIVES CONSIDERATION
FROM ONE OR MORE THIRD PARTIES IN EXCHANGE FOR THE STUDENT
PERSONALLY IDENTIFIABLE INFORMATION. THIS EXCEPTION APPLIES ONLY
TO SCHOOL SERVICES CONTRACT PROVIDERS THAT PROVIDE NATIONALLY
RECOGNIZED ASSESSMENTS THAT POSTSECONDARY INSTITUTIONS OF HIGHER
EDUCATION USE IN MAKING ADMISSIONS DECISIONS. 		ACT/SAT exception: Student personally identifiable information may be used to identify for the student, only with the written consent of the student or the student's parent, institutions of higher education or scholarship providers that are seeking students who meet specific criteria, regardless of whether the identified institutions of higher education or scholarship providers provide consideration to the school services contract provider. Student personally identifiable information may be used to provide to the student, only with the express written consent of the student or the student's parent given in response to clear and conspicuous notice, access to employment opportunities, educational scholarships or financial aid, or postsecondary education opportunities, regardless of whether the school services contract provider receives consideration from one or more third parties in exchange for the student personally identifiablehttp://www.leg.state.co.us/clics/clics2016a/csl.nsf/fsbillcont3/65C31D600337BF8787257F2400644D7C?Open&file=1423_enr.pdfwith consent of student or parent
4
District of ColumbiaB21-05782016SOPIPA (Student Online Personal Information Protection Act); (1-to-1 devices, but not included in this analysis)Operators may not knowingly sell, rent, or trade any student personally identifiable information unless; (i) The transaction is part of a sale, merger, or other type of acquisition of an operator by another entity; or (ii) The operator obtained verifiable consent from the student over 13 years of age, or the student's parent, to sell, rent, or trade specific student personally identifiable information for the purpose of providing the student with information about employment, educational scholarship, financial aid, or postsecondary educational opportunitiesACT/SAT exception: Operators may not knowingly sell, rent, or trade any student personally identifiable information unless the operator obtained verifiable consent from the student over 13 years of age, or the student's parent, to sell, rent, or trade specific student personally identifiable information for the purpose of providing the student with information about employment, educational scholarship, financial aid, or postsecondary educational opportunitieshttp://lims.dccouncil.us/Download/35200/B21-0578-SignedAct.pdfwith consent of student over 13 and parents
5
IowaHF23542018SOPIPA (Student Online Personal Information Protection Act)An operator shall not knowingly sell or rent a student’s information, including covered information. This subparagraph does not apply to the purchase, merger, or other type of acquisition of an operator by another entity, if the operator or successor entity complies with this section regarding previously acquired student information, or to national assessment providers if the provider secures the express written consent of the parent or student, given in response to clear and conspicuous notice, solely to provide access to employment, educational scholarships or financial aid, or postsecondary educational opportunitiesACT/SAT exception: An operator shall not knowingly sell or rent a student’s information, including covered information. This subparagraph does not apply to the purchase, merger, or other type of acquisition of an operator by another entity, if the operator or successor entity complies with this section regarding previously acquired student information, or to national assessment providers if the provider secures the express written consent of the parent or student, given in response to clear and conspicuous notice, solely to provide access to employment, educational scholarships or financial aid, or postsecondary educational opportunitieshttps://www.legis.iowa.gov/legislation/BillBook?ga=87&ba=HF2354with consent of student or parents
6
MaineLD16162017
SOPIPA (Student Online Personal Information Protection Act)
An operator may not knowingly engage in any of the following activities with respect to the operator's website, service or application without explicit written or electronic consent from a student's parent or an eligible student: ... Sell student data. This prohibition does not apply to the purchase, merger or other type of acquisition of an operator by another entity as long as the operator or successor entity continues to be subject to the provisions of this section with respect to previously acquired student data subject to this chapter.
https://www.mainelegislature.org/legis/bills/getPDF.asp?paper=SP0183&item=2&snum=127This is an amendment from 2017, and the amendment expanded the privacy protections.
7
NebraskaLB 5122017SOPIPA (Student Online Personal Information Protection Act)An operator shall not knowingly sell or rent a student's covered information. This subdivision does not apply to (i) the purchase, merger, or other type of acquisition of an operator by another entity if the operator or successor entity complies with this section regarding such covered information or (ii) a national assessment provider if the provider secures the express written consent of the student or parent or guardian of the student given in response to clear and conspicuous notice that access to covered information shall only be provided for purposes of obtaining employment, educational scholarships, financial aid, or postsecondary educational opportunities for such studentACT/SAT exception: An operator shall not knowingly sell or rent a student's covered information. This subdivision does no apply to a national assessment provider if the provider secures the express written consent of the student or parent or guardian of the student given in response to clear and conspicuous notice that access to covered information shall only be provided for purposes of obtaining employment, educational scholarships, financial aid, or postsecondary educational opportunities for such studenthttp://nebraskalegislature.gov/FloorDocs/105/PDF/Slip/LB512.pdfwith consent of student or parents
8
New HampshireHB14972016Exception for college entrance exams (ACT/SAT)A school or the department may disclose to a testing entity the student's name or unique pupil identifier, but not both, and birth date for the sole purpose of identifying the test taker. Except when collected in conjunction with the SAT or ACT, when such tests are used for the purpose of the state assessment as defined in RSA 193-C:6, the data shall be destroyed by the testing entity as soon as the testing entity has completed the verification of test takers, shall not be disclosed by the testing entity to any other person, organization, entity or government or any component thereof, other than the district, school or school district, and shall not be used by the testing entity for any other purpose whatsoever, including but not limited to test-data analysisACT/SAT exception: Except when collected in conjunction with the SAT or ACT, when such tests are used for the purpose of the state assessment as defined in RSA 193-C:6, neither a school nor the department shall disclose or permit the disclosure of student or teacher personally-identifiable data, the unique pupil identifier, or any other data listed in RSA 189:68, to any testing entity performing test-data analysis. The testing entity may perform the test analysis but shall not connect such data to other student datahttps://legiscan.com/NH/text/HB1497/2016With consent of student or parents. What about AP? Cassie can you check.

From MR: HB520 (2015): https://www.gencourt.state.nh.us/legislation/2015/HB0520.html
"No operator shall knowingly engage in any of the following activities with respect to their site, service, or application:...Sale, lease, rent, trade, or otherwise make available a student’s information, including covered information. This prohibition does not apply to the purchase, merger, or other type of acquisition of an operator by another entity, provided that the operator or successor entity continues to be subject to the provisions of this section with respect to previously acquired student information."

Not seeing anything about parent or student consent.

9
New JerseyA49782020
Exception: "national assessment providers if the provider secures express written consent of the student or4 the student’s parent or guardian, given in response to clear and conspicuous notice, solely to provide access to employment, educational scholarships, financial aid, or postsecondary educational8
opportunities"
https://legiscan.com/NJ/text/A4978/2018Student consent added in accordance with Governor's recommendations January 13, 2020.
10
North CarolinaHB632 (2015)2016SOPIPA (Student Online Personal Information Protection Act)Operators shall not knowingly sell or rent a student's information, including covered information. This does not apply to the purchase, merger, or other type of acquisition of an operator by another entity, if the operator or successor entity complies with this section regarding previously acquired student information, or to national assessment providers if the provider secures the express written consent of the parent or student who is at least 13 years of age given in response to clear and conspicuous notice, solely to provide access to employment, educational scholarships or financial aid, and to postsecondary educational opportunitiesACT/SAT exception: Operators shall not knowingly sell or rent a student's information, including covered information. This does not apply to national assessment providers if the provider secures the express written consent of the parent or student who is at least 13 years of age given in response to clear and conspicuous notice, solely to provide access to employment, educational scholarships or financial aid, and to postsecondary educational opportunitieshttp://www.ncleg.net/Sessions/2015/Bills/House/PDF/H632v5.pdfwith consent of student over 13 and parents
11
TexasHB 20872017SOPIPA (Student Online Personal Information Protection Act)An operator may not knowingly sell or rent any student’s covered information. This prohibition does not apply to: (1) the purchase, merger, or any other type of acquisition of an operator by another entity, if the operator or successor entity complies with this subchapter regarding previously acquired student information; or (2) a national assessment provider if the provider secures the express affirmative consent of the student or the student’s parent, given in response to clear and conspicuous notice, and if the information is used solely to provide access to employment, educational scholarships, financial aid, or postsecondary educational opportunitiesACT/SAT exception to sell: An operator may not knowingly sell or rent any student’s covered information. This prohibition does not apply to a national assessment provider if the provider secures the express affirmative consent of the student or the student’s parent, given in response to clear and conspicuous notice, and if the information is used solely to provide access to employment, educational scholarships, financial aid, or postsecondary educational opportunities. A national assessment provider of a provider of a college and career counseling service may, in response to a request of a student, and on receiving the express affirmative consent of the student or the student’ s parent given in response to clear and conspicuous notice, use or disclose covered information solely to provide access to employment, educational scholarships, financial aid, or postsecondary educational opportunities.http://www.capitol.state.tx.us/tlodocs/85R/billtext/pdf/HB02087F.pdfwith consent by student or parent
12
UtahSB2072018Amends UT SOPIPA (Student Online Personal Information Protection Act) contracted services requirements; revokes national assessment provider (ACT/SAT) exceptionsA third-party contractor is not required to obtain written consent under Subsection (4)(f)(ii) if the third-party contractor: [(a) is a national assessment provider; and] [(b) (i) secures the express written consent of the student or the student's parent; and] [(ii) the express written consent is given in response to clear and conspicuous notice that the national assessment provider requests consent solely to provide access to information on employment, educational scholarships, financial aid, or postsecondary educational opportunities.] Reverses previous law to provide exceptions for ACT/SAT:https://le.utah.gov/~2018/bills/static/SB0207.htmlUtah (SB 207) - 2018; Reverses previous law, SB 163 2017, to provide exceptions for ACT/SAT: [A third-party contractor is not required to obtain written consent under Subsection (4)(f)(ii) if the third-party contractor: [(a) is a national assessment provider; and] [(b) (i) secures the express written consent of the student or the student's parent; and] [(ii) the express written consent is given in response to clear and conspicuous notice that the national assessment provider requests consent solely to provide access to information on employment, educational scholarships, financial aid, or postsecondary educational opportunities.]
13
Virginia2016Weakens VA SOPIPA (Student Online Personal Information Protection Act) with a college & career assessment (ACT & SAT) exceptionFor the purposes of this section:
"School service" means a website, mobile application, or online service that (i) is designed and marketed solely for use in elementary or secondary schools; (ii) is used at the direction of teachers or other employees at elementary or secondary schools; and (iii) collects and maintains, uses, or shares student personal information. "School service" does not include a website, mobile application, or online service that is (a) used for the purposes of college and career readiness assessment or (b) designed and marketed for use by individuals or entities generally, even if it is also marketed for use in elementary or secondary schools.		ACT/SAT exception in definition of "school service"http://lis.virginia.gov/cgi-bin/legp604.exe?161+ful+CHAP0439had an amendment in 2016, HB750, that; Weakens VA SOPIPA (Student Online Personal Information Protection Act) with a college & career assessment (ACT & SAT) exception. Link to old law: https://lis.virginia.gov/cgi-bin/legp604.exe?151+ful+CHAP0728
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100