K-12 Student Data: Rules for EdTech Operators

Texas Education Code chapter 32, subchapter D, limits how education technology companies collect, use, and sell student data, and it requires security and deletion on a district's request. This guide covers who is an operator, what is prohibited, and what district contracts should require.

What the law requires

Who is covered. Subchapter D applies to the operator of a website, online service, or app that knows its service is used primarily for school purposes and was designed and marketed for them (§32.151). Covered information is personally identifiable information, or information linked to it, that a student, parent, or school employee provides or that the operator gathers for a school purpose, such as grades, discipline records, health records, biometric data, search activity, photographs, voice recordings, and geolocation.

Prohibitions. An operator may not knowingly (§32.152):

• use information gathered for a school purpose for targeted advertising;
• build a profile of a student except for a school purpose; or
• sell or rent a student's covered information.

The sale ban does not apply to a merger or acquisition if the successor complies with the subchapter, or to a national assessment provider that obtains express consent and uses the information only to give students access to employment, scholarship, financial aid, or postsecondary opportunities.

Duties. An operator must maintain reasonable security procedures and practices that protect covered information from unauthorized access, deletion, use, modification, or disclosure (§32.155(a)). An operator approved or adopted by the Texas Education Agency must use the state student identifier rather than personally identifiable information when it creates accounts and transmits or reports data (§32.155(b)). On a school district's request, an operator must delete the student's covered information that the district controls within 60 days, unless a contract sets a different timeline or the student or a parent consents to its retention (§32.156). Disclosures and uses are limited to those subchapter D allows (§§32.153, 32.154).

Standards for districts

HB 18 (2023) directed the Texas Education Agency to adopt standards for the devices and software that districts use (§32.1021). The standards must minimize data collection on students, require direct and informed parental consent before students use most software applications, keep applications from conducting unrelated assessments without parental consent, give parents cybersecurity and online-safety resources, and give districts ways to make contracted operators comply with subchapter D. Operators should expect districts to pass these requirements through in their contracts.

Federal overlap

The Family Educational Rights and Privacy Act (FERPA) and the Children's Online Privacy Protection Act (COPPA) may also apply. A district's authorization under either does not waive chapter 32.

Related topics

• Education and Student Data
• Processors, Data Sharing, Vendor Contracts, and Diligence
• COPPA and Children Under Thirteen
• What Is COPPA

Sources and legal update

• Texas Education Code §§32.151 to 32.157
• Texas Education Code §32.1021 (HB 18, 2023)

Current through October 12, 2026.

This material is for general information and is not legal advice. Law and enforcement practice change. Consult counsel about specific facts.