CA AB 801

Title: Student privacy: online personal information.
Author: Joe Patterson

Summary
AB 801, as amended, Joe Patterson. Student privacy: online personal information. The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The act establishes a variety of exceptions to the obligations imposed on a business under these provisions. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA.Existing law, the Early Learning Personal Information Protection Act and the Student Online Personal Information Protection Act, prohibits the operator of specified internet websites, online services, online applications, or mobile applications from knowingly engaging in targeted advertising to amass a profile about a preschool or prekindergarten pupil or K–12 student, selling a pupil’s or student’s information, or disclosing covered information, except as otherwise provided. Existing law defines “covered information” as personally identifiable information or materials, in any media or format that, among other things, is gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or student or otherwise identifies a pupil or student.This bill would instead refer to a K–12 student as a “pupil,” and make conforming changes. The bill would additionally provide that, when applied to K–12 pupils, “covered information” does not include mandatory pupil records, official records, files, and data directly related to a pupil and maintained by the school or local educational agency, including information within records encompassing all the material kept in the pupil’s cumulative folder.Existing law requires an operator to take specified other actions relating to the protection of a pupil’s or student’s covered information, including implementing and maintaining reasonable security procedures and practices, and deleting a pupil’s or student’s covered information if the school or district requests deletion of data under the control of the school or district.This bill would require an operator to delete a preschool, prekindergarten, or K–12 pupil’s covered information that is not subject to the CCPA if the pupil’s parent or legal guardian, the pupil’s education rights holder, or the pupil, as provided, requests an operator to delete the covered information under the operator’s control if the pupil is no longer enrolled in the local educational agency, preschool, prekindergarten, or district, as applicable, and would require an operator to require documentation that the pupil is no longer enrolled. The bill would also specify that these provisions shall not be interpreted to limit or supersede any rights or requirements under specified federal law.

Status
In Senate. Read first time. To Com. on RLS. for assignment.

Bill Documents
CA AB 801 - 01/12/24 - Amended Assembly
01/12/24 - CA AB 801 (01/12/24 - Amended Assembly)