Student personal information.

The entire formal bill document (with line numbers, amendment dates, legislative counsel digest, and section-by-section text) was replaced with a web page layout containing navigation menus, search fields, version selectors, and tab links (Text, Votes, History, Bill Analysis, etc.). No policy language was added, removed, or altered.

A new exclusion was added to the definition of 'operator' stating that it does not include the State Department of Education, a local educational agency, or a school. This means public education entities themselves are not subject to the bill's data protection requirements.

The definition of 'deidentified information' was expanded to require that information cannot identify a 'school' in addition to an individual or household. Four new subparagraphs (D through G) were added requiring operators to apply FERPA deidentification measures, make their deidentification processes available for review by the school or local educational agency upon request, comply with any school-maintained deidentification policy, and cease using information as deidentified if the school determines it is not sufficiently deidentified.

The term 'education rights holder' was added throughout the bill alongside 'parent' and 'guardian' in provisions governing who may request deletion of covered information, who may request disclosure of covered information, and who may access the operator's written data retention policy. This expands the group of people with privacy rights over student data.

A new requirement was added to the bill summary stating that a person bringing a civil action for noncompliance must furnish a copy of the complaint to the Attorney General within 10 days after filing the action. This gives the AG early visibility into private enforcement actions.

A drafting error in the bill summary was corrected: 'operator operator' was changed to 'operator.' Page numbering was also adjusted from 96 to 95, reflecting minor reorganization of text.

The definition of 'operator' in both KOPIPA and ELPIPA was broadened from requiring a site be 'designed and marketed' for school purposes to 'designed or marketed,' meaning meeting only one condition is now sufficient to trigger compliance obligations.

Entirely new Higher Education Student Information Protection Act (HESIPA, Chapter 22.2.6, Section 22587) extending similar protections to students enrolled in higher education institutions, with an operative date of July 1, 2026.

New exceptions and carve-outs: operators may use deidentified data to improve products and demonstrate effectiveness; may share aggregated deidentified data; may use pupil data for adaptive learning; may market educational products directly to parents (not based on covered information); app stores and interactive computer services are not required to enforce compliance; pupils may download their own data.

New prohibition on using information (including persistent unique identifiers) gathered through the operator's site, service, or application to train a generative AI system or develop an AI system, unless done in furtherance of the relevant school purpose and for the use and benefit of the school. This applies across KOPIPA, ELPIPA, and the new HESIPA.

New prohibition on collecting, using, retaining, or disclosing covered information relating to a pupil's reproductive or sexual health, immigration status, or sexual orientation or gender identity, unless strictly necessary for school purposes. Applies across all three acts.

New data retention and deletion requirements: operators must retain covered information only as long as reasonably necessary, delete data upon request from the school or (for former pupils no longer enrolled for at least 60 days) from the pupil/parent, and maintain a written data retention policy available upon request.

New private right of action (Sections 22585 and 22586.1) allowing a pupil or parent to sue an operator for the greater of actual damages or $500 per plaintiff per violation, plus injunctive relief, punitive damages, and attorney's fees. Requires 45 days' written notice before filing and provides a 30-day cure period for individual claims.

New definitions added including 'artificial intelligence,' 'generative artificial intelligence,' 'train a generative artificial intelligence system or service' (all referencing Civil Code Section 3110), 'CCPA-excluded covered information,' and 'national assessment provider.'

The operative date provisions were restructured. The old KOPIPA operative date of January 1, 2016 and ELPIPA operative date of July 1, 2017 were repealed and replaced with new operative date sections, while HESIPA is set to become operative on July 1, 2026.

The definition of 'operator' now includes 'an entity working on behalf of the operator,' expanding liability beyond the direct operator to contractors and agents acting on its behalf.

The prohibition on using covered information to train generative AI or develop an AI system is now absolute. The previous version allowed such use if it was 'in the furtherance of the relevant type of school purpose and for the use and benefit of the school system.' That exception has been removed entirely.

The prohibition on collecting, using, retaining, or disclosing covered information relating to a pupil's reproductive or sexual health, immigration status, or sexual orientation or gender identity is now absolute. The previous version included an exception when the information was relevant and limited to a K-12 school purpose and any disclosure was strictly necessary. That exception has been removed.

The exception for building profiles about a pupil now permits profiling 'in furtherance of K-12 school purposes and for the use and benefit of the K-12 school and the teacher, pupil, or parent,' expanding beyond just the school's benefit to also include individual teachers, pupils, and parents.

The operative date for HESIPA (the Higher Education Student Information Protection Act) is delayed by one year from July 1, 2026 to July 1, 2027.

The operator definition was broadened: removed 'primarily' from the use requirement and changed 'designed and marketed for K-12 school purposes' to 'designed or marketed for K-12 school purposes.' This means an operator now falls under the law if the service is used for K-12 purposes AND was either designed OR marketed for those purposes, rather than requiring both design and marketing alignment plus primarily being used for school purposes.

The federal law savings clause now explicitly includes the Family Educational Rights and Privacy Act (FERPA) alongside IDEA and the Rehabilitation Act, clarifying that this chapter does not limit or supersede FERPA rights.

The AI training prohibition in subdivision (b)(5) was expanded from covering only 'generative artificial intelligence system or service' to any 'artificial intelligence system or service.' Operators can no longer use student data to develop non-generative AI systems unless it is for the school's benefit.

The profiling prohibition in subdivision (b)(2) was broadened from 'Use information, including persistent unique identifiers' to 'Use any information, including covered information and persistent unique identifiers,' making the ban on building pupil profiles more explicit and comprehensive.

A new data retention policy cap was added: an operator's written data retention policy shall not exceed the retention period for the same information or record if that information is maintained by the school or local educational agency.

A new pupil data access right was added (paragraph 6 of subdivision (d)): operators must disclose a pupil's CCPA-excluded covered information to the pupil upon request, mirroring the existing deletion right but providing an access mechanism.

A new definition of 'deidentified information' was added with three criteria: taking reasonable measures to prevent re-identification, publicly committing to maintain and use the information in deidentified form (with a limited exception for testing deidentification processes), and contractually obligating recipients to meet the same standards.

The 'covered information' definition was expanded to include 'demographics,' 'extracurricular activities,' 'behavioral information,' and 'device identifiers' as types of protected data.

The operative date for HESIPA (Higher Education Student Information Protection Act) was delayed from July 1, 2026 to July 1, 2027, giving higher education institutions an additional year to comply.

The legislative digest removed 'Commercial internet websites: privacy policies' as a subject, indicating the nonsubstantive changes to commercial website privacy policy provisions (Section 22575) were dropped from this bill. The fiscal committee vote changed from 'no' to 'yes.'