Bill > AB1159

This bill expands protections for student personal information by enacting the Higher Education Student Information Protection Act (HESIPA) and amending existing laws like the K–12 Pupil Online Personal Information Protection Act (KOPIPA) and the Early Learning Personal Information Protection Act (ELPIPA). Key provisions include prohibiting operators of educational websites, services, or applications from using student data, including persistent unique identifiers, to train generative artificial intelligence (AI) systems or develop AI systems. The bill also clarifies that "operator" now includes entities working on behalf of the primary operator and extends the scope of these protections to include entities that have actual knowledge that their services are used for educational purposes and were designed or marketed for those purposes. Furthermore, it grants students, or their parents/guardians, the right to file civil lawsuits for actual damages, injunctive relief, punitive damages, and attorney fees if an operator fails to comply with these privacy protections, requiring a 45-day notice period before such action can be taken. HESIPA will become effective on July 1, 2027.

Budget and Finance, Business and Industry, Justice

https://leginfo.legislature.ca.gov/faces/billStatusClient.xhtml?bill_id=202520260AB1159