§ 2443a. Operator prohibitions
(a) An operator shall not knowingly do any of the following with respect to its site,
service, or application:
(1) Engage in targeted advertising on the operator’s site, service, or application or
target advertising on any other site, service, or application if the targeting of
the advertising is based on any information, including covered information and persistent
unique identifiers, that the operator has acquired because of the use of that operator’s
site, service, or application for PreK-12 school purposes.
(2) Use information, including a persistent unique identifier, that is created or gathered
by the operator’s site, service, or application to amass a profile about a student,
except in furtherance of PreK-12 school purposes. “Amass a profile” does not include
the collection and retention of account information that remains under the control
of the student, the student’s parent or legal guardian, or the school.
(3) Sell, barter, or rent a student’s information, including covered information. This
subdivision (3) does not apply to the purchase, merger, or other type of acquisition
of an operator by another entity if the operator or successor entity complies with
this subchapter regarding previously acquired student information.
(4) Except as otherwise provided in section 2443c of this title, disclose covered information, unless the disclosure is made for one or more of the
following purposes and is proportionate to the identifiable information necessary
to accomplish the purpose:
(A) to further the PreK-12 school purposes of the site, service, or application, provided:
(i) the recipient of the covered information does not further disclose the information
except to allow or improve operability and functionality of the operator’s site, service,
or application; and
(ii) the covered information is not used for a purpose inconsistent with this subchapter;
(B) to ensure legal and regulatory compliance or take precautions against liability;
(C) to respond to judicial process;
(D) to protect the safety or integrity of users of the site or others or the security
of the site, service, or application;
(E) for a school, educational, or employment purpose requested by the student or the student’s
parent or legal guardian, provided that the information is not used or further disclosed
for any other purpose; or
(F) to a third party if the operator contractually prohibits the third party from using
any covered information for any purpose other than providing the contracted service
to or on behalf of the operator, prohibits the third party from disclosing any covered
information provided by the operator to subsequent third parties, and requires the
third party to implement and maintain reasonable security procedures and practices.
(b) This section does not prohibit an operator’s use of information for maintaining, developing,
supporting, improving, or diagnosing the operator’s site, service, or application. (Added 2019, No. 89 (Adj. Sess.), § 4.)