Bill > AB1159

This bill expands and updates California's existing student privacy laws—specifically the K–12 Pupil Online Personal Information Protection Act and the Early Learning Personal Information Protection Act—by broadening their reach to any digital educational operator with actual knowledge that their technology is used for school purposes, while also enacting the Higher Education Student Information Protection Act (HESIPA) to similarly protect college and university students starting July 1, 2027. To provide necessary context, these laws regulate ed-tech providers, such as websites, apps, and cloud services marketed to schools, by prohibiting practices like targeted advertising, selling student data, and building student profiles outside of educational purposes. Furthermore, this legislation explicitly bans operators from using collected student data—including persistent unique identifiers, which are strings of numbers or characters that can track a specific device or user over time—to train generative artificial intelligence systems or develop general artificial intelligence. Finally, the bill empowers harmed students or their parents to bring civil lawsuits seeking actual damages, statutory penalties of at least five hundred dollars per violation, and attorney's fees against noncompliant operators, provided they give a 60-day advance notice and send a copy of any filed complaint to the state Attorney General.