Student privacy: online personal information.

The California Consumer Privacy Act of 2018 (CCPA) grants to a consumer various rights with respect to personal information, as defined, that is collected by a business, as defined, including the right to request that a business delete personal information about the consumer that the business has collected from the consumer. The act establishes a variety of exceptions to the obligations imposed on a business under these provisions. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA. The Early Learning Personal Information Protection Act and the Student Online Personal Information Protection Act prohibit the operator of specified internet websites, online services, online applications, or mobile applications from knowingly engaging in targeted advertising to amass a profile about a preschool or prekindergarten pupil or K–12 student, selling a pupil's or student's information, or disclosing covered information, except as otherwise provided. Existing law defines "covered information" as personally identifiable information or materials, in any media or format that, among other things, is gathered by an operator through the operation of a site, service, or application and is descriptive of a pupil or student or otherwise identifies a pupil or student. This bill would instead refer to a K–12 student as a "pupil," and make conforming changes. Existing law requires an operator to take specified other actions relating to the protection of a pupil's or student's covered information, including implementing and maintaining reasonable security procedures and practices and deleting a pupil's or student's covered information if the school or district requests deletion of data under the control of the school or district. This bill would except from that deletion requirement, with respect to K-12 pupils, pupil records held by a national assessment provider, as defined, and that only include standardized test results. The bill would additionally require, except as prescribed, an operator to delete a preschool, prekindergarten, or K–12 pupil's covered information under the operator's control that is not subject to the CCPA if the pupil's parent or legal guardian, the pupil's education rights holder, or the pupil, as prescribed, requests an operator to delete the covered information under the operator's control if the pupil has been no longer enrolled in the local educational agency, preschool, prekindergarten, or district, as applicable, for at least 60 days and would require an operator to require documentation that the pupil is no longer enrolled. The bill would also specify that these provisions shall not be interpreted to limit or supersede any rights or requirements under specified federal law.