II 

115TH CONGRESS 

2D SESSION S. 2640 

To require operators that provide online and similar services to educational 

agencies, institutions, or programs to protect the privacy and security 

of personally identifiable information, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

APRIL 10, 2018 

Mr. DAINES (for himself and Mr. BLUMENTHAL) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To require operators that provide online and similar services 

to educational agencies, institutions, or programs to protect the privacy and security of personally identifiable 

information, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Safeguarding Amer5 ican Families from Exposure by Keeping Information and 

6 Data Secure Act’’ or the ‘‘SAFE KIDS Act’’. 

7 SEC. 2. DEFINITIONS. 

8 (a) IN GENERAL.—In this Act: 


rfrederick on DSKBCBPHB2PROD with BILLS
2 

•S 2640 IS

1 (1) COMMISSION.—The term ‘‘Commission’’ 

2 means the Federal Trade Commission. 

3 (2) COVERED INFORMATION.—The term ‘‘cov4 ered information’’ means personally identifiable in5 formation or material, or information that is linked 

6 or reasonably linkable to personally identifiable in7 formation or material, in any media or format, 

8 that— 

9 (A) is created by or provided to an oper10 ator by a student, or the student’s parent, in 

11 the course of the student’s or parent’s use of 

12 the operator’s site or service for preK–12 pur13 poses; 

14 (B) is collected, generated, or maintained 

15 by an educational agency, institution, or pro16 gram, including teachers of such agency, insti17 tution, or program; or 

18 (C) is collected by an operator through the 

19 operation of its site or service for preK–12 pur20 poses and personally identifies a student, in21 cluding— 

22 (i) the student’s first and last name; 

23 (ii) the first and last name of the stu24 dent’s parent or another family member; 


rfrederick on DSKBCBPHB2PROD with BILLS
3 

•S 2640 IS

1 (iii) the home or physical address of 

2 the student or student’s family; 

3 (iv) online contact information, as de4 fined in section 1302 of the Children’s On5 line Privacy Protection Act of 1998 (15 

6 U.S.C. 6501), for the student; 

7 (v) a personal identifier, such as the 

8 student’s Social Security number, student 

9 number, or biometric record; 

10 (vi) an identifier described in subpara11 graph (D), (F), or (G) of section 1302(8) 

12 of such Act (15 U.S.C. 6501(8)) for the 

13 student; 

14 (vii) a photograph, video, or audio re15 cording that contains the student’s image 

16 or voice; 

17 (viii) geolocation information suffi18 cient to identify the street name and name 

19 of a city or town; and 

20 (ix) other indirect identifiers, such as 

21 the student’s date of birth, place of birth, 

22 or mother’s maiden name. 

23 (3) DE-IDENTIFIED COVERED INFORMATION.— 

24 The term ‘‘de-identified covered information’’ means 

25 covered information that— 


rfrederick on DSKBCBPHB2PROD with BILLS
4 

•S 2640 IS

1 (A) has been de-identified by reasonable 

2 measures; 

3 (B) is maintained in a de-identified fashion 

4 without attempt to re-identify; and 

5 (C) is not made available to other entities 

6 absent contractual agreement to not re-identify 

7 the covered information. 

8 (4) EARLY CHILDHOOD EDUCATION PRO9 GRAM.—The term ‘‘early childhood education pro10 gram’’ means a program that meets the require11 ments of clauses (i) and (ii)(III) of section 

12 103(8)(C) of the Higher Education Act of 1965 (20 

13 U.S.C. 1003(8)(C)). 

14 (5) EDUCATIONAL AGENCY, INSTITUTION, OR

15 PROGRAM.—The term ‘‘educational agency, institu16 tion, or program’’ means— 

17 (A) an educational agency or institution, 

18 as defined in section 444(a)(3) of the General 

19 Education Provisions Act (20 U.S.C. 

20 1232g(a)(3)), except that such term does not 

21 include an institution of higher education; or 

22 (B) an early childhood education program. 

23 (6) ELIGIBLE STUDENT.—The term ‘‘eligible 

24 student’’ means a student who— 

25 (A) is 18 years of age or older; 


rfrederick on DSKBCBPHB2PROD with BILLS
5 

•S 2640 IS

1 (B) is enrolled in an institution of higher 

2 education; or 

3 (C) has graduated from a secondary 

4 school. 

5 (7) INSTITUTION OF HIGHER EDUCATION.—The 

6 term ‘‘institution of higher education’’ has the 

7 meaning given such term in section 102 of the High8 er Education Act of 1965 (20 U.S.C. 1002). 

9 (8) OPERATOR.—The term ‘‘operator’’— 

10 (A) means the operator of a website lo11 cated on the Internet or online service that is 

12 used primarily for preK–12 purposes and was 

13 designed and marketed for preK–12 purposes, 

14 to the extent that it is operating in this capac15 ity; and 

16 (B) does not include an educational agen17 cy, institution, or program. 

18 (9) PREK–12 PURPOSES.—The term ‘‘preK–12 

19 purposes’’ means purposes that— 

20 (A) are directed by or that customarily 

21 take place at the direction of an educational 

22 agency, institution, or program; 

23 (B) aid in the administration of activities 

24 by an educational agency, institution, or pro25 gram, including instruction in the classroom or 


rfrederick on DSKBCBPHB2PROD with BILLS
6 

•S 2640 IS

1 at home, administrative activities, and collabo2 ration between students, school personnel, or 

3 parents; or 

4 (C) are otherwise for the use and benefit 

5 of the educational agency, institution, or pro6 gram. 

7 (10) STATE.—The term ‘‘State’’ means each 

8 State of the United States, the District of Columbia, 

9 each territory or possession of the United States, 

10 and each federally recognized Indian tribe. 

11 (11) STUDENT.—The term ‘‘student’’ means 

12 any individual who attends or has attended an early 

13 childhood education program, elementary school, or 

14 secondary school. 

15 (12) TARGETED ADVERTISING.— 

16 (A) IN GENERAL.—The term ‘‘targeted ad17 vertising’’ means presenting advertisements to a 

18 student or the student’s parent, where the ad19 vertisements are selected based on information 

20 obtained or inferred over time from the stu21 dent’s online behavior, use of online services, or 

22 covered information. 

23 (B) EXCLUSION.—Such term does not in24 clude presenting advertisements to a student or 


rfrederick on DSKBCBPHB2PROD with BILLS
7 

•S 2640 IS

1 the student’s parent at an online location or 

2 through an online service, as long as— 

3 (i) information about the student’s 

4 online behavior or use of the online loca5 tion or online service is not retained over 

6 time for the purpose of targeting subse7 quent advertisements; and 

8 (ii)(I) the advertisements are based 

9 solely upon that student’s current visit to 

10 the online location; or 

11 (II) the advertisements are in re12 sponse to a student’s request for informa13 tion or feedback. 

14 (b) TERMS DEFINED IN ELEMENTARY AND SEC15 ONDARY EDUCATION ACT OF 1965.—In this Act, the 

16 terms ‘‘elementary school’’, ‘‘parent’’, and ‘‘secondary 

17 school’’ have the meanings given such terms in section 

18 8101 of the Elementary and Secondary Education Act of 

19 1965 (20 U.S.C. 7801). 

20 SEC. 3. PROTECTING STUDENT PRIVACY. 

21 (a) PROHIBITED PRACTICES.—An operator may 

22 not— 

23 (1) collect, generate, use or disclose any covered 

24 information, or allow third parties to do so, for pur25 poses of engaging in or permitting targeted adverVerDate Sep 11 2014 02:56 Apr 11, 2018 Jkt 079200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2640.IS S2640

rfrederick on DSKBCBPHB2PROD with BILLS
8 

•S 2640 IS

1 tising on the operator’s site or online service, or tar2 get advertising on any other site or service, if the 

3 targeting of the advertising is based on any informa4 tion, including covered information and persistent 

5 unique identifiers, that the operator has acquired be6 cause of the use of that operator’s site or service for 

7 preK–12 purposes; 

8 (2) sell or rent covered information to a third 

9 party, except this paragraph shall not apply to a na10 tionally recognized high school academic assessment 

11 provider solely to the extent that the provider se12 cures the express written consent of the parent or 

13 student, given in response to clear and conspicuous 

14 notice, only to provide access to employment, edu15 cational scholarships or financial aid, or postsec16 ondary educational opportunities; 

17 (3) use information, including covered informa18 tion and persistent unique identifiers, created or 

19 gathered by the operator’s site or service to create 

20 a personal profile of a student other than for preK– 

21 12 purposes, except that for purposes of this para22 graph, creating a personal profile shall not include 

23 the collection and retention of account information 

24 that remains under the control of the student, the 


rfrederick on DSKBCBPHB2PROD with BILLS
9 

•S 2640 IS

1 student’s parent, or the educational agency, institu2 tion, or program; or 

3 (4) disclose covered information, unless the dis4 closure is made— 

5 (A) pursuant to lawful process or to ensure 

6 legal and regulatory compliance with Federal or 

7 State law; 

8 (B)(i) in furtherance of the preK–12 pur9 pose of the site or service; and 

10 (ii) if the recipient of the covered informa11 tion disclosed under this paragraph does not 

12 further disclose the information unless the dis13 closure is done to allow or improve operability 

14 and functionality of the operator’s site or serv15 ice; 

16 (C) for a school, educational, or employ17 ment purpose requested by the student or the 

18 student’s parent, as long as the information is 

19 not used or further disclosed for any other pur20 pose; 

21 (D) to protect the safety or integrity of 

22 users or others or the security of the school 

23 service; or 

24 (E) to a State or local educational agency, 

25 including elementary schools and secondary 


rfrederick on DSKBCBPHB2PROD with BILLS
10 

•S 2640 IS

1 schools, for preK–12 purposes, as permitted by 

2 Federal or State law; or 

3 (5) notwithstanding paragraph (4), disclose cov4 ered information to a third-party service provider of 

5 the school service for purposes of maintaining, devel6 oping, supporting, improving, or diagnosing the op7 erator’s site or service unless the operator contrac8 tually requires the provider to comply with all the 

9 provisions of this Act (including such paragraph). 

10 (b) REQUIREMENTS.—An operator shall— 

11 (1) establish, implement, and maintain reason12 able security procedures appropriate to the nature of 

13 the covered information that are designed to protect 

14 the covered information from unauthorized access, 

15 destruction, use, modification, or disclosure; 

16 (2) unless the educational agency, institution, 

17 or program or a student’s parent consents to the 

18 maintenance of the covered information, delete a 

19 student’s covered information— 

20 (A) within a reasonable time after receiv21 ing a request for deletion through an edu22 cational agency, institution, or program, or 

23 from the student’s parent; or 

24 (B) once the data has outlived the legiti25 mate purpose for which the data was collected; 


rfrederick on DSKBCBPHB2PROD with BILLS
11 

•S 2640 IS

1 (3) obtain consent from the educational agency, 

2 institution, or program, through contracts or privacy 

3 policies in a manner that is clear and easy to under4 stand, regarding the types of covered information 

5 collected, the purposes for which the covered infor6 mation is used or disclosed to third parties, and the 

7 identity of any such third parties; 

8 (4) disclose publicly, on the website of the oper9 ator, every privacy policy that the operator has es10 tablished with an educational agency, institution, or 

11 program; 

12 (5) obtain consent from the educational agency, 

13 institution, or program and provide sufficient notice 

14 on its website before making material changes to a 

15 contract or privacy policy for a school service; and 

16 (6) support access to and correction of covered 

17 information through an educational agency, institu18 tion, or program. 

19 (c) AUTHORIZED USES.— 

20 (1) USES OF COVERED INFORMATION.—An op21 erator may use or disclose covered information of a 

22 student under the following circumstances: 

23 (A) If other provisions of Federal or State 

24 law require the operator to disclose the infor25 mation, and the operator complies with the reVerDate Sep 11 2014 02:56 Apr 11, 2018 Jkt 079200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2640.IS S2640

rfrederick on DSKBCBPHB2PROD with BILLS
12 

•S 2640 IS

1 quirements of Federal and State law in pro2 tecting and disclosing that information. 

3 (B) For legitimate research purposes, as 

4 required by Federal or State law and subject to 

5 the restrictions under applicable Federal and 

6 State law or as allowed by Federal or State law 

7 and under the direction of an educational agen8 cy, institution, or program (including a State 

9 educational agency), if covered information is 

10 not used for advertising or to amass a profile 

11 on the student for purposes other than preK– 

12 12 purposes. 

13 (C) To an educational agency, institution, 

14 or program for preK–12 purposes, as permitted 

15 by Federal or State law. 

16 (d) EFFECT ON MERGERS AND ACQUISITIONS.—The 

17 prohibitions of this section on sale and disclosure of cov18 ered information do not apply to the merger of an operator 

19 with another entity or the acquisition of the operator by 

20 another entity (including any subsequent merger or acqui21 sition), provided that the operator or successor entity con22 tinues to be subject to the provisions of this section with 

23 respect to covered information acquired before the merger 

24 or acquisition. 


rfrederick on DSKBCBPHB2PROD with BILLS
13 

•S 2640 IS

1 (e) CONTINUED APPLICATION.—This section shall 

2 continue to apply, after a student is no longer enrolled 

3 in an educational agency, institution, or program, to cov4 ered information relating to the student that was collected 

5 or generated while the student was enrolled. 

6 SEC. 4. RULES OF CONSTRUCTION. 

7 (a) IN GENERAL.—This Act shall not— 

8 (1) be construed to affect or otherwise alter the 

9 protections and guarantees set forth in section 444 

10 of the General Education Provisions Act (20 U.S.C. 

11 1232g) (commonly known as the ‘‘Family Edu12 cational Rights and Privacy Act of 1974’’), the Chil13 dren’s Online Privacy Protection Act of 1998 (15 

14 U.S.C. 6501 et seq.), or any other Federal statute 

15 relating to privacy protection; 

16 (2) be construed to limit the authority of a law 

17 enforcement agency to obtain content or information 

18 from an operator as authorized by law or pursuant 

19 to an order of a court of competent jurisdiction; 

20 (3) limit the ability of an operator to use infor21 mation, including covered information, for adaptive 

22 or personalized student learning purposes; 

23 (4) limit an educational agency, institution, or 

24 program from providing Internet access service for 


rfrederick on DSKBCBPHB2PROD with BILLS
14 

•S 2640 IS

1 its own use, to other educational agencies or institu2 tions, or to students and their families; 

3 (5) be construed to prohibit an operator’s use 

4 of information, including covered information, for 

5 maintaining, developing, supporting, improving, or 

6 diagnosing the operator’s school service; 

7 (6) impose a duty upon a provider of an elec8 tronic store, gateway, marketplace, or other means 

9 of purchasing or downloading software or applica10 tions, to review or enforce compliance with this Act 

11 by operators of school services; 

12 (7) impede the ability of a student or the stu13 dent’s parent to download, export, transfer, or other14 wise save or maintain data or documents created by 

15 or about the student or noncommercial applications 

16 created by the student; 

17 (8) be construed to apply to general audience 

18 Internet websites or general audience online services, 

19 even if login credentials created for an operator’s 

20 site or service may be used to access those general 

21 audience sites or services; 

22 (9) prohibit an operator of a website or online 

23 service from marketing educational products directly 

24 to parents if the marketing did not result from the 

25 use of covered information obtained by the operator 


rfrederick on DSKBCBPHB2PROD with BILLS
15 

•S 2640 IS

1 through the provision of services covered under this 

2 Act; 

3 (10) limit service providers from providing 

4 Internet connectivity to schools or students and their 

5 families; or 

6 (11) be construed to apply to the sale, under 

7 the direction and control of the educational agency, 

8 institution, or program, of student and class pic9 tures, yearbooks, memory books, and similar tradi10 tional school-sanctioned commemorative activities. 

11 (b) NONPROHIBITED ACTIONS.—Nothing in this Act 

12 prohibits an operator from— 

13 (1) using de-identified covered information 

14 within the operator’s school service or other sites or 

15 online services owned by the operator to improve 

16 educational products; 

17 (2) using de-identified covered information to 

18 demonstrate the effectiveness of the operator’s prod19 ucts or services, including in the marketing of such 

20 products or services; 

21 (3) disclosing de-identified covered information 

22 for the development and improvement of educational 

23 sites and services; or 

24 (4) disclosing de-identified covered information 

25 for research and development, including— 


rfrederick on DSKBCBPHB2PROD with BILLS
16 

•S 2640 IS

1 (A) research, development, and improve2 ment of educational sites, services, and applica3 tions; and 

4 (B) advancements in the science of learn5 ing; 

6 (5) using recommendation engines to rec7 ommend to a student additional content, websites, or 

8 online services for preK–12 purposes offered by an 

9 operator within a website or online service if the rec10 ommendation is based on educational improvement 

11 and is not determined in whole or in part by finan12 cial gain from a third party; and 

13 (6) responding to a student’s request for infor14 mation or for feedback without the information or 

15 response being determined in whole or in part by 

16 payment or other consideration from a third party. 

17 (c) POWER TO CONSENT AND RIGHTS REGARDING

18 INFORMATION ABOUT ELIGIBLE STUDENT.—Any provi19 sion of this Act that refers to the consent of the student’s 

20 parent for the use or disclosure of covered information or 

21 the right of the student’s parent to access or otherwise 

22 obtain, use, correct, request disclosure of, or request dele23 tion of covered information, shall, in the case of covered 

24 information about an eligible student, be considered to 


rfrederick on DSKBCBPHB2PROD with BILLS
17 

•S 2640 IS

1 refer to the consent or right of the student and not the 

2 student’s parent. 

3 (d) NO EFFECT ON CONSENT UNDER OTHER

4 LAW.—This Act does not modify the requirements or 

5 standards for consent, including consent from minors and 

6 employees on behalf of educational institutions, under any 

7 other provision of Federal law or under State law. 

8 SEC. 5. IMPLEMENTATION AND ENFORCEMENT. 

9 (a) ENFORCEMENT BY FEDERAL TRADE COMMIS10 SION.— 

11 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC12 TICES.—A violation of this Act shall be treated as 

13 a violation of a rule prescribed under section 

14 18(a)(1)(B) of the Federal Trade Commission Act 

15 (15 U.S.C. 57a(a)(1)(B)) regarding unfair or decep16 tive acts or practices. 

17 (2) POWERS OF THE COMMISSION.— 

18 (A) IN GENERAL.—The Commission shall 

19 enforce this Act in the same manner, by the 

20 same means, and with the same jurisdiction, 

21 powers, and duties as though all applicable 

22 terms and provisions of the Federal Trade 

23 Commission Act (15 U.S.C. 41 et seq.) were in24 corporated into and made a part of this Act. 


rfrederick on DSKBCBPHB2PROD with BILLS
18 

•S 2640 IS

1 (B) PRIVILEGES AND IMMUNITIES.—Any 

2 person who violates this Act shall be subject to 

3 the penalties entitled to the privileges and im4 munities provided in the Federal Trade Com5 mission Act, except as provided in paragraph 

6 (3). 

7 (3) ENFORCEMENT WITH RESPECT TO NON8 PROFIT ORGANIZATIONS.—Notwithstanding sections 

9 4, 5(a)(2), and 6 of the Federal Trade Commission 

10 Act (15 U.S.C. 44; 45(a)(2); 46), any jurisdictional 

11 limitation of the Commission with respect to non12 profit organizations or common carriers subject to 

13 the Communications Act of 1934, or Acts amending 

14 or supplementing that Act, shall not apply for pur15 poses of this Act. 

16 (b) PRESERVATION OF COMMISSION AUTHORITY.— 

17 Nothing in this Act may be construed in any way to limit 

18 or affect the Commission’s authority under any other pro19 vision of law. 

20 (c) CONSULTATION AND COOPERATION WITH SEC21 RETARY OF EDUCATION.—The Commission shall consult 

22 and cooperate with the Secretary of Education in enforc23 ing this Act in matters involving educational agencies, in24 stitutions, or programs. 

25 (d) RELATIONSHIP TO STATE LAW.— 


rfrederick on DSKBCBPHB2PROD with BILLS
19 

•S 2640 IS

1 (1) IN GENERAL.—This Act does not annul, 

2 alter, or affect, or exempt any person subject to the 

3 provisions of this Act from complying with, the laws 

4 of any State with respect to the treatment of covered 

5 information by operators of school services, except to 

6 the extent that such laws are inconsistent with any 

7 provision of this Act, and then only to the extent of 

8 the inconsistency. For purposes of this paragraph, a 

9 law of a State is not inconsistent with this Act if the 

10 protection such law affords any user of a school 

11 service is greater than the protection provided by 

12 this Act. 

13 (2) RULE OF CONSTRUCTION.—Any reference 

14 in this Act to State law shall be considered also to 

15 refer to the law of a political subdivision of a State. 

16 SEC. 6. EFFECTIVE DATE. 

17 This Act shall take effect on the date that is 18 

18 months after the date of the enactment of this Act. 

Æ 


rfrederick on DSKBCBPHB2PROD with BILLS