I 
114TH CONGRESS 
1ST SESSION H. R. 2092 
To require operators that provide online and similar services to educational 
agencies or institutions to protect the privacy and security of personally 
identifiable information, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 29, 2015 
Mr. MESSER (for himself and Mr. POLIS) introduced the following bill; which 
was referred to the Committee on Energy and Commerce, and in addition 
to the Committee on Education and the Workforce, for a period to be 
subsequently determined by the Speaker, in each case for consideration 
of such provisions as fall within the jurisdiction of the committee con-
cerned 
A BILL 
To require operators that provide online and similar services 
to educational agencies or institutions to protect the 
privacy and security of personally identifiable informa-
tion, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Student Digital Pri-
vacy and Parental Rights Act of 2015’’. 
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
SEC. 2. DEFINITIONS. 
(a) IN GENERAL.—In this Act: 
(1) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(2) COVERED INFORMATION.—The term ‘‘cov-
ered information’’ means personally identifiable in-
formation, and information that is linked or linkable 
to personally identifiable information, that— 
(A) is collected or generated through a 
school service; and 
(B)(i) the operator of the school service 
knows or should know relates to a student; or 
(ii) is collected, generated, or maintained 
at the direction of an educational agency or in-
stitution serving the student or officials of such 
an agency or institution, including teachers. 
(3) EDUCATIONAL AGENCY OR INSTITUTION.— 
The term ‘‘educational agency or institution’’ has 
the meaning given such term in section 444 of the 
General Education Provisions Act (20 U.S.C. 
1232g), except that such term does not include an 
institution of higher education. 
(4) ELIGIBLE
STUDENT.—The term ‘‘eligible 
student’’ means a student who— 
(A) is 18 years of age or older; 
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
(B) is enrolled in an institution of higher 
education; or 
(C) has graduated from a secondary 
school. 
(5) INSTITUTION OF HIGHER EDUCATION.—The 
term ‘‘institution of higher education’’ has the 
meaning given such term in section 102 of the High-
er Education Act of 1965 (20 U.S.C. 1002). 
(6) K-12
PURPOSES.—The term ‘‘K-12 pur-
poses’’ means purposes that— 
(A) aid in the administration of activities 
by an educational agency or institution, includ-
ing instruction in the classroom or at home, ad-
ministrative activities, and collaboration be-
tween students, school personnel, or parents; or 
(B) are for the use and benefit of the edu-
cational agency or institution. 
(7) ONLINE
CONTACT
INFORMATION.—The 
term ‘‘online contact information’’ means, with re-
spect to a student, an email address or any other 
substantially similar identifier that permits direct 
contact with the student online, including an instant 
messaging user identifier, a voice over Internet Pro-
tocol identifier, a video chat user identifier, or a 
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
screen name or user name that permits such con-
tact. 
(8) OPERATOR.—The term ‘‘operator’’ means 
an entity that operates a school service, except that 
such term does not include an educational agency or 
institution. 
(9) 
PERSONALLY
IDENTIFIABLE
INFORMA-
TION.—The term ‘‘personally identifiable informa-
tion’’ includes, with respect to a student— 
(A) the student’s first and last name; 
(B) the first and last name of the stu-
dent’s parent or another family member; 
(C) the home or physical address of the 
student or student’s family; 
(D) online contact information for the stu-
dent; 
(E) a personal identifier, such as the stu-
dent’s social security number, student number, 
or biometric record; 
(F) a persistent identifier that can be used 
to recognize a user over time and across dif-
ferent Internet Web sites, online services, online 
applications, or mobile applications, including a 
customer number held in a cookie, an Internet 
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
Protocol address, a processor or device serial 
number, or another unique identifier; 
(G) a photograph, video, or audio record-
ing that contains the student’s image or voice; 
(H) geolocation information sufficient to 
identify street name and name of a city or 
town; 
(I) other indirect identifiers, such as the 
student’s date of birth, place of birth, or moth-
er’s maiden name; 
(J) other information that, alone or in 
combination, would allow an operator or a rea-
sonable person in the school community, who 
does not have personal knowledge of the rel-
evant circumstances, to identify a specific stu-
dent with reasonable certainty; and 
(K) information requested by a person who 
the educational agency or institution reasonably 
believes knows the identity of the student to 
whom the information relates. 
(10) SCHOOL SERVICE.—The term ‘‘school serv-
ice’’ means an Internet Web site, online service (in-
cluding a cloud computing service), online applica-
tion, or mobile application that is used for K-12 pur-
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
poses and was designed and marketed for K-12 pur-
poses. 
(11) STATE.—The term ‘‘State’’ means each 
State of the United States, the District of Columbia, 
each territory or possession of the United States, 
and each federally recognized Indian tribe. 
(12) STUDENT.—The term ‘‘student’’ means 
any individual who is or has been enrolled in an ele-
mentary school or secondary school. 
(13) TARGETED ADVERTISING.— 
(A) IN GENERAL.—The term ‘‘targeted ad-
vertising’’ means presenting advertisements to a 
student or the student’s parent, where the ad-
vertisements are selected based on information 
obtained or inferred from the student’s online 
behavior or use of online applications or mobile 
applications or from covered information about 
the student maintained by the operator of a 
school service. 
(B) EXCLUSION.—Such term does not in-
clude presenting advertisements to a student or 
the student’s parent at an online location or 
through an online application or mobile applica-
tion, if— 
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
(i) the advertisements are contextually 
relevant; 
(ii) the advertisements are selected 
based on a single visit or session of use 
during which the advertisements are pre-
sented; and 
(iii) information about the student’s 
online behavior or use of online applica-
tions or mobile applications is not collected 
or retained over time. 
(b) TERMS DEFINED IN ELEMENTARY AND SEC-
ONDARY EDUCATION ACT OF 1965.—In this Act, the 
terms ‘‘elementary school’’, ‘‘parent’’, and ‘‘secondary 
school’’ have the meanings given such terms in section 
9101 of the Elementary and Secondary Education Act of 
1965 (20 U.S.C. 7801). 
SEC. 3. PROTECTING STUDENT PRIVACY. 
(a) PROHIBITED PRACTICES.—An operator may not 
knowingly— 
(1) engage in or permit targeted advertising on 
a school service; 
(2) collect, generate, use, or disclose any cov-
ered information for purposes of targeted adver-
tising; 
(3) sell covered information to a third party; 
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
(4) collect, generate, or use covered information 
(including using covered information to create a per-
sonal profile of a student) other than for K-12 pur-
poses; or 
(5) disclose covered information, unless the dis-
closure is made— 
(A) pursuant to lawful process or to ensure 
legal and regulatory compliance with Federal or 
State law; 
(B) in accordance with subsection (c), pur-
suant to a request for disclosure— 
(i) in the case of information about a 
student, from the student’s parent; or 
(ii) in the case of information about a 
student’s parent or another user of the 
school service, from the parent or such 
other user, as the case may be; 
(C) in accordance with subsection (c), pur-
suant to a request for disclosure from a student 
who is or has been enrolled in a secondary 
school or from the student’s parent for the ex-
clusive purpose of— 
(i) providing or authenticating the 
student’s 
transcript, 
standardized 
test 
scores, letters of recommendation, or other 
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
information required by an institution of 
higher education for an application for ad-
mission or by a potential employer for an 
application for employment; or 
(ii) providing information relating 
to— 
(I) admission to an institution of 
higher education; or 
(II) a scholarship or financial aid 
for attendance at an institution of 
higher education; 
(D) to protect the safety of users or others 
or the security of the school service; 
(E) to an educational agency or institution, 
as permitted by Federal and State law; or 
(F) to a third-party service provider of the 
operator, and the operator contractually— 
(i) prohibits the service provider from 
using any covered information for any pur-
pose other than providing the contracted 
service to, or on behalf of, the operator; 
(ii) prohibits the service provider from 
disclosing to subsequent third parties any 
covered information disclosed by the oper-
ator to the service provider; and 
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
(iii) requires the service provider to 
establish, implement, and maintain reason-
able security procedures as described in 
subsection (b)(1). 
(b) REQUIREMENTS.—An operator shall— 
(1) establish, implement, and maintain reason-
able security procedures appropriate to the nature of 
covered information to protect the confidentiality, se-
curity, and integrity of covered information; 
(2) delete a student’s covered information (ex-
cept for information that is required to be main-
tained by Federal or State law) within a reasonable 
time, not to exceed 45 days, after receiving— 
(A) a request from an educational agency 
or institution serving the student; or 
(B) a request (either directly or through 
the educational agency or institution) from the 
student’s parent, except in the case of informa-
tion that is included in the student’s education 
records (as defined in section 444 of the Gen-
eral Education Provisions Act (20 U.S.C. 
1232g)), such as the student’s test scores or 
grades, or that is directed by the educational 
agency or institution to be maintained for edu-
cational or administrative purposes; 
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
(3) disclose publicly and to each educational 
agency or institution to which the operator provides 
a school service, in contracts or privacy policies in a 
manner that is clear and easy to understand, the 
types of covered information collected or generated 
(if any), the purposes for which the covered informa-
tion is used or disclosed to third parties, and the 
identity of any such party; 
(4) facilitate access to and correction of covered 
information, either directly or through an edu-
cational agency or institution— 
(A) in the case of information about a stu-
dent, by the student’s parent; or 
(B) in the case of information about a par-
ent or another user of the school service, by the 
parent or such other user, as the case may be; 
(5) implement policies and procedures for re-
sponding to data breaches involving unauthorized ac-
quisition of or access to personally identifiable infor-
mation that occur on a school service, in compliance 
with any obligations imposed by Federal or State 
law; 
(6) notify the Commission and, as appropriate, 
students, parents, educational agencies or institu-
tions, or officials of such agencies or institutions (in-
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
cluding teachers) of each data breach involving un-
authorized acquisition of or access to personally 
identifiable information that occurs on a school serv-
ice, in compliance with any obligations imposed by 
Federal or State law; and 
(7) delete any covered information maintained 
by a school service (except for information that is re-
quired to be maintained by Federal or State law)— 
(A) except as provided in subparagraph 
(B), within a reasonable time, not to exceed one 
year, after the operator ceases to provide the 
service to the educational agency or institution, 
unless the information is required to be main-
tained at the direction of the educational agen-
cy or institution or the student’s parent; or 
(B) if the operator continues providing the 
service in whole or in part to a student after 
ceasing to provide the service to the educational 
agency or institution, within a reasonable time, 
not to exceed one year, after the operator 
ceases to provide the service to the student, un-
less the information is required to be main-
tained at the direction of the student’s parent. 
(c) REQUIREMENTS FOR CERTAIN DISCLOSURES.— 
An operator may disclose covered information under sub-
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
(C) to establish, implement, and maintain 
reasonable security procedures as described in 
subsection (b)(1); and 
(4) provides a readily available mechanism for 
the requesting party to revoke the request. 
(d) EFFECT ON MERGERS AND ACQUISITIONS.—The 
prohibitions of this section on sale and disclosure of cov-
ered information do not apply to the merger of an operator 
with another entity or the acquisition of the operator by 
another entity (including any subsequent merger or acqui-
sition), provided that the operator or successor entity con-
tinues to be subject to the provisions of this section with 
respect to covered information acquired before the merger 
or acquisition. 
(e) CONTINUED APPLICATION.—This section shall 
continue to apply, after a student is no longer enrolled 
in an elementary school or secondary school, to covered 
information relating to the student that was collected or 
generated while the student was enrolled. 
SEC. 4. RULES OF CONSTRUCTION. 
(a) IN GENERAL.—This Act shall not— 
(1) be construed to affect or otherwise alter the 
protections and guarantees set forth in section 444 
of the General Education Provisions Act (20 U.S.C. 
1232g) (commonly known as the ‘‘Family Edu-
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
cational Rights and Privacy Act of 1974’’), the Chil-
dren’s Online Privacy Protection Act of 1998 (15 
U.S.C. 6501 et seq.), or any other Federal statute 
relating to privacy protection; 
(2) be construed to limit the authority of a law 
enforcement agency to obtain content or information 
from an operator as authorized by law or pursuant 
to an order of a court of competent jurisdiction; 
(3) limit the ability of an operator to use infor-
mation, including covered information, for adaptive 
or personalized student learning purposes; 
(4) limit an educational agency or institution 
from providing Internet access service for its own 
use, to other educational agencies or institutions, or 
to students and their families; 
(5) be construed to prohibit an operator’s use 
of covered information for maintaining, developing, 
supporting, improving, or diagnosing the operator’s 
school service; 
(6) be construed to prohibit an operator of a 
school service from marketing educational products 
directly to parents, provided that the marketing does 
not result from the use of covered information; 
(7) impose a duty upon a provider of an elec-
tronic store, gateway, marketplace, or other means 
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
of purchasing or downloading software or applica-
tions to review or enforce compliance with this Act 
by operators of school services; 
(8) impede the ability of a student or the stu-
dent’s parent to download, export, create, or other-
wise save or maintain data or documents created by 
or about the student or noncommercial applications 
created by the student, except to the extent any such 
activity would result in disclosure prohibited by this 
Act of covered information of other students or 
users of a school service; or 
(9) be construed to prohibit an operator from 
collecting a reasonable fee to cover the administra-
tive costs of making a disclosure under section 
3(a)(5)(C). 
(b) DE-IDENTIFIED AND AGGREGATED COVERED IN-
FORMATION.— 
(1) IN
GENERAL.—Nothing in this Act pro-
hibits an operator from— 
(A) using de-identified and aggregated cov-
ered information— 
(i) within the operator’s school service 
or other sites, services, or applications 
owned by the operator to improve edu-
cational products; or 
VerDate Sep 11 2014 
03:53 May 12, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
(ii) to demonstrate the effectiveness of 
the operator’s products or services, includ-
ing in the marketing of such products or 
services; or 
(B) disclosing de-identified and aggregated 
covered information for research and develop-
ment, including— 
(i) research, development, and im-
provement of educational sites, services, 
and applications; and 
(ii) advancements in the science of 
learning. 
(2) STEPS TO PREVENT RE-IDENTIFICATION OR 
DISAGGREGATION.—If an operator uses or discloses 
covered information as described in paragraph (1), 
the operator shall take reasonable steps to ensure 
that the information cannot be manipulated in a 
manner that would enable— 
(A) identification of an individual to whom 
the information relates; or 
(B) disaggregation of aggregated informa-
tion into its component parts. 
(c) POWER TO CONSENT AND RIGHTS REGARDING 
INFORMATION ABOUT ELIGIBLE STUDENT.—Any provi-
sion of this Act that refers to the consent of the student’s 
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS
parent for the use or disclosure of covered information or 
the right of the student’s parent to access or otherwise 
obtain, use, correct, request disclosure of, or request dele-
tion of covered information, shall, in the case of covered 
information about an eligible student, be considered to 
refer to the consent or right of the student and not the 
student’s parent. 
(d) NO
EFFECT
ON
CONSENT
UNDER
OTHER 
LAW.—Except as provided in section 5(g), this Act does 
not modify the requirements or standards for consent, in-
cluding consent from minors and employees on behalf of 
educational institutions, under any other provision of Fed-
eral law or under State law. 
SEC. 5. IMPLEMENTATION AND ENFORCEMENT. 
(a) ENFORCEMENT BY FEDERAL TRADE COMMIS-
SION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of this Act or a regulation pro-
mulgated under this Act shall be treated as a viola-
tion of a regulation under section 18(a)(1)(B) of the 
Federal 
Trade 
Commission 
Act 
(15 
U.S.C. 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS OF THE COMMISSION.—The Com-
mission shall enforce this Act and the regulations 
VerDate Sep 11 2014 
02:13 May 09, 2015
Jkt 049200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H2092.IH
H2092
SSpencer on DSK4SPTVN1PROD with BILLS