II 

114TH CONGRESS 

1ST SESSION S. 1788 

To require operators that provide online and similar services to educational 

agencies, institutions, or programs to protect the privacy and security 

of personally identifiable information, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JULY 16, 2015 

Mr. DAINES (for himself and Mr. BLUMENTHAL) introduced the following bill; 

which was read twice and referred to the Committee on Commerce, 

Science, and Transportation 

A BILL 

To require operators that provide online and similar services 

to educational agencies, institutions, or programs to protect the privacy and security of personally identifiable 

information, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Safeguarding Amer5 ican Families from Exposure by Keeping Information and 

6 Data Secure Act’’ or the ‘‘SAFE KIDS Act’’. 

7 SEC. 2. DEFINITIONS. 

8 (a) IN GENERAL.—In this Act: 


SSpencer on DSK4SPTVN1PROD with BILLS
2 

•S 1788 IS

1 (1) COMMISSION.—The term ‘‘Commission’’ 

2 means the Federal Trade Commission. 

3 (2) COVERED INFORMATION.—The term ‘‘cov4 ered information’’ means personally identifiable in5 formation, and information that is linked or linkable 

6 to personally identifiable information, that— 

7 (A) is collected or generated through a 

8 school service; and 

9 (B)(i) the operator of the school service 

10 knows or should know relates to a student; or 

11 (ii) is collected, generated, or maintained 

12 at the direction of an educational agency, insti13 tution, or program serving the student or offi14 cials of such an agency, institution, or program, 

15 including teachers. 

16 (3) EARLY CHILDHOOD EDUCATION PRO17 GRAM.—The term ‘‘early childhood education pro18 gram’’ means a program that meets the require19 ments of clauses (i) and (ii)(III) of section 

20 103(8)(C) of the Higher Education Act of 1965 (20 

21 U.S.C. 1003). 

22 (4) EDUCATIONAL AGENCY, INSTITUTION, OR

23 PROGRAM.—The term ‘‘educational agency, institu24 tion, or program’’ means— 


SSpencer on DSK4SPTVN1PROD with BILLS
3 

•S 1788 IS

1 (A) an educational agency or institution, 

2 as defined in section 444(a)(3) of the General 

3 Education Provisions Act (20 U.S.C. 

4 1232g(a)(3)), except that such term does not 

5 include an institution of higher education; or 

6 (B) an early childhood education program. 

7 (5) ELIGIBLE STUDENT.—The term ‘‘eligible 

8 student’’ means a student who— 

9 (A) is 18 years of age or older; 

10 (B) is enrolled in an institution of higher 

11 education; or 

12 (C) has graduated from a secondary 

13 school. 

14 (6) INSTITUTION OF HIGHER EDUCATION.—The 

15 term ‘‘institution of higher education’’ has the 

16 meaning given such term in section 102 of the High17 er Education Act of 1965 (20 U.S.C. 1002). 

18 (7) PREK-12 PURPOSES.—The term ‘‘PreK-12 

19 purposes’’ means purposes that— 

20 (A) aid in the administration of activities 

21 by an educational agency, institution, or pro22 gram, including instruction in the classroom or 

23 at home, administrative activities, and collabo24 ration between students, school personnel, or 

25 parents; or 


SSpencer on DSK4SPTVN1PROD with BILLS
4 

•S 1788 IS

1 (B) are for the use and benefit of the edu2 cational agency, institution, or program. 

3 (8) ONLINE CONTACT INFORMATION.—The 

4 term ‘‘online contact information’’ means, with re5 spect to a student, an email address or any other 

6 substantially similar identifier that permits direct 

7 contact with the student online, including an instant 

8 messaging user identifier, a voice over Internet pro9 tocol identifier, a video chat user identifier, or a 

10 screen name or user name that permits such con11 tact. 

12 (9) OPERATOR.—The term ‘‘operator’’ means 

13 an entity that operates a school service, except that 

14 such term does not include an educational agency, 

15 institution, or program. 

16 (10) PERSONALLY IDENTIFIABLE INFORMA17 TION.—The term ‘‘personally identifiable informa18 tion’’ includes, with respect to a student— 

19 (A) the student’s first and last name; 

20 (B) the first and last name of the stu21 dent’s parent or another family member; 

22 (C) the home or physical address of the 

23 student or student’s family; 

24 (D) online contact information for the stu25 dent; 


SSpencer on DSK4SPTVN1PROD with BILLS
5 

•S 1788 IS

1 (E) a personal identifier, such as the stu2 dent’s social security number, student number, 

3 or biometric record; 

4 (F) a persistent identifier that can be used 

5 to recognize a user over time and across dif6 ferent Internet websites, online services, online 

7 applications, or mobile applications, including a 

8 customer number held in a cookie, an Internet 

9 Protocol address, a processor or device serial 

10 number, or another unique identifier; 

11 (G) a photograph, video, or audio record12 ing that contains the student’s image or voice; 

13 (H) geolocation information sufficient to 

14 identify the street name and name of a city or 

15 town; 

16 (I) other indirect identifiers, such as the 

17 student’s date of birth, place of birth, or moth18 er’s maiden name; 

19 (J) other information that, alone or in 

20 combination, would allow an operator or a rea21 sonable person in the school community, who 

22 does not have personal knowledge of the rel23 evant circumstances, to identify a specific stu24 dent with reasonable certainty; and 


SSpencer on DSK4SPTVN1PROD with BILLS
6 

•S 1788 IS

1 (K) information requested by a person who 

2 the educational agency, institution, or program 

3 reasonably believes knows the identity of the 

4 student to whom the information relates. 

5 (11) SCHOOL SERVICE.—The term ‘‘school serv6 ice’’ means an Internet website, online service (in7 cluding a cloud computing service), online applica8 tion, or mobile application that is used for PreK-12 

9 purposes and was designed and marketed for PreK10 12 purposes. 

11 (12) STATE.—The term ‘‘State’’ means each 

12 State of the United States, the District of Columbia, 

13 each territory or possession of the United States, 

14 and each federally recognized Indian tribe. 

15 (13) STUDENT.—The term ‘‘student’’ means 

16 any individual who is or has been enrolled in an 

17 early childhood education program, elementary 

18 school, or secondary school. 

19 (14) TARGETED ADVERTISING.— 

20 (A) IN GENERAL.—The term ‘‘targeted ad21 vertising’’ means presenting advertisements to a 

22 student or the student’s parent, where the ad23 vertisements are selected based on information 

24 obtained or inferred from the student’s online 

25 behavior or use of online applications or mobile 


SSpencer on DSK4SPTVN1PROD with BILLS
7 

•S 1788 IS

1 applications or from covered information about 

2 the student maintained by the operator of a 

3 school service. 

4 (B) EXCLUSION.—Such term does not in5 clude presenting advertisements to a student or 

6 the student’s parent at an online location or 

7 through an online application or mobile applica8 tion, if— 

9 (i) the advertisements are contextually 

10 relevant; 

11 (ii) the advertisements are selected 

12 based on a single visit or session of use 

13 during which the advertisements are pre14 sented; and 

15 (iii) information about the student’s 

16 online behavior or use of online applica17 tions or mobile applications is not collected 

18 or retained over time. 

19 (b) TERMS DEFINED IN ELEMENTARY AND SEC20 ONDARY EDUCATION ACT OF 1965.—In this Act, the 

21 terms ‘‘elementary school’’, ‘‘parent’’, and ‘‘secondary 

22 school’’ have the meanings given such terms in section 

23 9101 of the Elementary and Secondary Education Act of 

24 1965 (20 U.S.C. 7801). 


SSpencer on DSK4SPTVN1PROD with BILLS
8 

•S 1788 IS

1 SEC. 3. PROTECTING STUDENT PRIVACY. 

2 (a) PROHIBITED PRACTICES.—An operator may not 

3 knowingly— 

4 (1) engage in or permit targeted advertising on 

5 a school service; 

6 (2) collect, generate, use, or disclose any cov7 ered information for purposes of targeted adver8 tising; 

9 (3) sell covered information to a third party; 

10 (4) collect, generate, or use covered information 

11 (including using covered information to create a per12 sonal profile of a student) other than for PreK-12 

13 purposes; 

14 (5) disclose covered information, unless the dis15 closure is made— 

16 (A) pursuant to lawful process or to ensure 

17 legal and regulatory compliance with Federal or 

18 State law; 

19 (B) in accordance with subsection (e), pur20 suant to an affirmative express request through 

21 a student’s educational agency, institution, or 

22 program for disclosure of information specified 

23 in the request— 

24 (i) in the case of information about a 

25 student, from the student’s parent; or 


SSpencer on DSK4SPTVN1PROD with BILLS
9 

•S 1788 IS

1 (ii) in the case of information about a 

2 student’s parent or another user of the 

3 school service, from the parent or such 

4 other user, as the case may be; 

5 (C) in accordance with subsection (e), pur6 suant to an affirmative express request through 

7 a student’s educational agency, institution, or 

8 program from a student who is or has been en9 rolled in a secondary school, or the parent of 

10 such student, to disclose covered information 

11 specified in the request about the student to a 

12 third party in furtherance of postsecondary 

13 education or employment opportunities, for the 

14 purpose of— 

15 (i) providing or authenticating the 

16 student’s transcript, standardized test 

17 scores, letters of recommendation, or other 

18 information required by an institution of 

19 higher education for an application for ad20 mission or by a potential employer for an 

21 application for employment; or 

22 (ii) providing information relating 

23 to— 

24 (I) admission to an institution of 

25 higher education; or 


SSpencer on DSK4SPTVN1PROD with BILLS
10 

•S 1788 IS

1 (II) a scholarship or financial aid 

2 for attendance at an institution of 

3 higher education; or 

4 (D) to protect the safety of users or others 

5 or the security of the school service; or 

6 (6) notwithstanding paragraph (5), disclose cov7 ered information to a third-party service provider of 

8 the school service unless the operator contractually 

9 requires the provider to comply with all the provi10 sions of this Act (including such paragraph). 

11 (b) REQUIREMENTS.—An operator shall— 

12 (1) establish, implement, and maintain reason13 able security procedures appropriate to the nature of 

14 covered information to protect the confidentiality, se15 curity, and integrity of covered information; 

16 (2) delete a student’s covered information that 

17 is not included in a student’s education records (as 

18 defined in section 444(a)(4) of the General Edu19 cation Provisions Act (20 U.S.C. 1232g(a)(4))) 

20 (commonly known as the ‘‘Family Educational 

21 Rights and Privacy Act of 1974’’) within— 

22 (A) a reasonable time, not to exceed 45 

23 days, after receiving a request for deletion 

24 through an educational agency, institution, or 

25 program from the student’s parent; or 


SSpencer on DSK4SPTVN1PROD with BILLS
11 

•S 1788 IS

1 (B) within a reasonable time, not to exceed 

2 2 years, after— 

3 (i) the information is no longer being 

4 used for PreK-12 purposes; and 

5 (ii) providing notification, through an 

6 educational agency, institution, or pro7 gram, to each student’s parent of the im8 pending deletion of the student’s covered 

9 information; 

10 (3) obtain consent from the educational agency, 

11 institution, or program, through contracts or privacy 

12 policies in a manner that is clear and easy to under13 stand, regarding the types of covered information 

14 collected or generated (if any), the purposes for 

15 which the covered information is used or disclosed to 

16 third parties, and the identity of any such third 

17 party; 

18 (4) disclose publicly, on the website of the oper19 ator, every privacy policy that the operator has es20 tablished with an educational agency, institution, or 

21 program; 

22 (5) obtain consent from the educational agency, 

23 institution, or program and provide sufficient notice 

24 on its website before making material changes to a 

25 contract or privacy policy for a school service; and 


SSpencer on DSK4SPTVN1PROD with BILLS
12 

•S 1788 IS

1 (6) facilitate access to and correction of covered 

2 information, through an educational agency, institu3 tion, or program— 

4 (A) in the case of information about a stu5 dent, by the student’s parent; or 

6 (B) in the case of information about a par7 ent or another user of the school service, by the 

8 parent or such other user, as the case may be. 

9 (c) EFFECT ON MERGERS AND ACQUISITIONS.—The 

10 prohibitions of this section on sale and disclosure of cov11 ered information do not apply to the merger of an operator 

12 with another entity or the acquisition of the operator by 

13 another entity (including any subsequent merger or acqui14 sition), provided that the operator or successor entity con15 tinues to be subject to the provisions of this section with 

16 respect to covered information acquired before the merger 

17 or acquisition. 

18 (d) CONTINUED APPLICATION.—This section shall 

19 continue to apply, after a student is no longer enrolled 

20 in an educational agency, institution, or program, to cov21 ered information relating to the student that was collected 

22 or generated while the student was enrolled. 

23 (e) REQUIREMENTS FOR CERTAIN DISCLOSURES.— 

24 An operator may disclose covered information under subVerDate Sep 11 2014 23:55 Jul 20, 2015 Jkt 049200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6201 E:\BILLS\S1788.IS S1788

SSpencer on DSK4SPTVN1PROD with BILLS
13 

•S 1788 IS

1 paragraph (B) or (C) of subsection (a)(5) only after the 

2 operator— 

3 (1) ensures that the third-party recipient has 

4 provided assurances that it will not further disclose 

5 covered information to subsequent third parties, use 

6 any covered information pursuant to the request for 

7 any purpose other than fulfilling the purpose for 

8 which the request was made, nor take any other ac9 tion inconsistent with this Act; 

10 (2) ensures that the third-party recipient has 

11 provided assurances that it will establish, implement 

12 and maintain reasonable security procedures as de13 scribed in subsection (b)(1); and 

14 (3) provides a readily available mechanism for 

15 the requesting party to revoke the request. 

16 SEC. 4. RULES OF CONSTRUCTION. 

17 (a) IN GENERAL.—This Act shall not— 

18 (1) be construed to affect or otherwise alter the 

19 protections and guarantees set forth in section 444 

20 of the General Education Provisions Act (20 U.S.C. 

21 1232g) (commonly known as the ‘‘Family Edu22 cational Rights and Privacy Act of 1974’’), the Chil23 dren’s Online Privacy Protection Act of 1998 (15 

24 U.S.C. 6501 et seq.), or any other Federal statute 

25 relating to privacy protection; 


SSpencer on DSK4SPTVN1PROD with BILLS
14 

•S 1788 IS

1 (2) be construed to limit the authority of a law 

2 enforcement agency to obtain content or information 

3 from an operator as authorized by law or pursuant 

4 to an order of a court of competent jurisdiction; 

5 (3) limit the ability of an operator to use infor6 mation, including covered information, for adaptive 

7 or personalized student learning purposes; 

8 (4) limit an educational agency, institution, or 

9 program from providing Internet access service for 

10 its own use, to other educational agencies or institu11 tions, or to students and their families; 

12 (5) be construed to prohibit an operator’s use 

13 of covered information for maintaining, developing, 

14 supporting, improving, or diagnosing the operator’s 

15 school service; 

16 (6) impose a duty upon a provider of an elec17 tronic store, gateway, marketplace, or other means 

18 of purchasing or downloading software or applica19 tions to review or enforce compliance with this Act 

20 by operators of school services; or 

21 (7) impede the ability of a student or the stu22 dent’s parent to download, export, create, or other23 wise save or maintain data or documents created by 

24 or about the student or noncommercial applications 

25 created by the student, except to the extent any such 


SSpencer on DSK4SPTVN1PROD with BILLS
15 

•S 1788 IS

1 activity would result in disclosure prohibited by this 

2 Act of covered information of other students or 

3 users of a school service. 

4 (b) DE-IDENTIFIED COVERED INFORMATION.— 

5 (1) IN GENERAL.—Nothing in this Act pro6 hibits an operator from— 

7 (A) using de-identified covered information 

8 within the operator’s school service or other 

9 sites, services, or applications owned by the op10 erator to improve educational products; 

11 (B) using de-identified covered information 

12 to demonstrate the effectiveness of the opera13 tor’s products or services, including in the mar14 keting of such products or services; or 

15 (C) disclosing de-identified covered infor16 mation for research and development, includ17 ing— 

18 (i) research, development, and im19 provement of educational sites, services, 

20 and applications; and 

21 (ii) advancements in the science of 

22 learning. 

23 (c) POWER TO CONSENT AND RIGHTS REGARDING

24 INFORMATION ABOUT ELIGIBLE STUDENT.—Any provi25 sion of this Act that refers to the consent of the student’s 


SSpencer on DSK4SPTVN1PROD with BILLS
16 

•S 1788 IS

1 parent for the use or disclosure of covered information or 

2 the right of the student’s parent to access or otherwise 

3 obtain, use, correct, request disclosure of, or request dele4 tion of covered information, shall, in the case of covered 

5 information about an eligible student, be considered to 

6 refer to the consent or right of the student and not the 

7 student’s parent. 

8 (d) NO EFFECT ON CONSENT UNDER OTHER

9 LAW.—This Act does not modify the requirements or 

10 standards for consent, including consent from minors and 

11 employees on behalf of educational institutions, under any 

12 other provision of Federal law or under State law. 

13 SEC. 5. IMPLEMENTATION AND ENFORCEMENT. 

14 (a) ENFORCEMENT BY FEDERAL TRADE COMMIS15 SION.— 

16 (1) UNFAIR OR DECEPTIVE ACTS OR PRAC17 TICES.—A violation of this Act or a regulation pro18 mulgated under this Act shall be treated as a viola19 tion of a regulation under section 18(a)(1)(B) of the 

20 Federal Trade Commission Act (15 U.S.C. 

21 57a(a)(1)(B)) regarding unfair or deceptive acts or 

22 practices. 

23 (2) POWERS OF THE COMMISSION.—The Com24 mission shall enforce this Act and the regulations 

25 promulgated under this Act in the same manner, by 


SSpencer on DSK4SPTVN1PROD with BILLS
17 

•S 1788 IS

1 the same means, and with the same jurisdiction, 

2 powers, and duties as though all applicable terms 

3 and provisions of the Federal Trade Commission Act 

4 (15 U.S.C. 41 et seq.) were incorporated into and 

5 made a part of this Act, and any person who violates 

6 this Act or a regulation promulgated under this Act 

7 shall be subject to the penalties entitled to the privi8 leges and immunities provided in the Federal Trade 

9 Commission Act, except as provided in paragraph 

10 (3). 

11 (3) ENFORCEMENT WITH RESPECT TO NON12 PROFIT ORGANIZATIONS.—Notwithstanding sections 

13 4 and 5(a)(2) of the Federal Trade Commission Act 

14 (15 U.S.C. 44; 45(a)(2)), any jurisdictional limita15 tion of the Commission with respect to nonprofit or16 ganizations shall not apply for purposes of this Act. 

17 (b) PRESERVATION OF COMMISSION AUTHORITY.— 

18 Nothing in this Act may be construed in any way to limit 

19 or affect the Commission’s authority under any other pro20 vision of law. 

21 (c) REGULATIONS.—The Commission may promul22 gate regulations under section 553 of title 5, United 

23 States Code, to carry out this Act. Such regulations shall 

24 further define the terms ‘‘targeted advertising’’, ‘‘re25 search, development, and improvement of educational 


SSpencer on DSK4SPTVN1PROD with BILLS
18 

•S 1788 IS

1 sites, services, and applications’’, ‘‘advancements in the 

2 science of learning’’, ‘‘postsecondary education or employ3 ment opportunities’’, and ‘‘adaptive or personalized stu4 dent learning purposes’’, as used in this Act. 

5 (d) CONSULTATION AND COOPERATION WITH SEC6 RETARY OF EDUCATION.—The Commission shall consult 

7 and cooperate with the Secretary of Education in imple8 menting and enforcing this Act, including in promulgating 

9 any regulations to carry out this Act, in matters involving 

10 educational agencies or institutions. 

11 (e) RELATIONSHIP TO STATE LAW.— 

12 (1) IN GENERAL.—This Act does not annul, 

13 alter, or affect, or exempt any person subject to the 

14 provisions of this Act from complying with, the laws 

15 of any State with respect to the treatment of covered 

16 information by operators of school services, except to 

17 the extent that such laws are inconsistent with any 

18 provision of this Act, and then only to the extent of 

19 the inconsistency. For purposes of this paragraph, a 

20 law of a State is not inconsistent with this Act if the 

21 protection such law affords any user of a school 

22 service is greater than the protection provided by 

23 this Act. 


SSpencer on DSK4SPTVN1PROD with BILLS
19 

•S 1788 IS

1 (2) RULE OF CONSTRUCTION.—Any reference 

2 in this Act to State law shall be considered also to 

3 refer to the law of a political subdivision of a State. 

4 SEC. 6. EFFECTIVE DATE. 

5 This Act shall take effect on the date that is 18 

6 months after the date of the enactment of this Act. 

Æ 


SSpencer on DSK4SPTVN1PROD with BILLS