HB 55: Privacy Compliance for Education Technology Vendors - Utah

Amended 2/3/2026 11:02:140 → Substitute #1 · 5 edits

MODERATE

The bill was significantly expanded from a privacy-focused amendment to include a new grant program for rural school districts to install internet connectivity on school buses. While the core privacy requirements for third-party vendors remain largely intact, the bill now appropriates $325,000 for FY 2027 to fund these connectivity upgrades and establishes specific rules for grant eligibility and administration.

Scope change

The bill's scope expanded from solely regulating third-party data privacy to also funding and regulating rural school bus internet connectivity projects.

FISCAL

Added a new Section 2 enacting 53F-2-402.5 to create a grant program for rural school districts to retrofit school buses with internet connectivity systems.

Added Section 3 to appropriate $325,000 from the Public Education Economic Stabilization Restricted Account for fiscal year 2027 to fund the new grant program.

ELIGIBILITY

Defined eligibility for grants to rural school districts operating schools in specific county classes or with fewer than 3,000 students, prioritizing districts without existing bus connectivity.

REQUIREMENT

Established requirements for grant recipients, including maintaining connectivity for at least three years and ensuring content filtering matches district school building policies.

TECHNICAL

Corrected a typo in the privacy section regarding the contractor's unauthorized 'saleusage' of data, changing it to 'sale or use' for clarity.

Amended 1/23/2026 11:01:559 → Amended 2/3/2026 11:02:140 · 3 edits

MINOR

The bill was amended to strengthen data privacy enforcement by requiring the State Board of Education to create educational materials for vendors and clarifying consent requirements for data retention. Additionally, the audit trigger for suspected violations was refined to ensure investigations are initiated only when reports meet specific credibility standards.

Scope change

The scope of enforcement and vendor obligations was expanded to include mandatory educational resources for contractors, while the scope of the audit process was narrowed to prevent action on unsubstantiated reports.

REQUIREMENT

Added a new requirement for state board staff to create materials or resources to help third-party contractors understand data protection laws and avoid misconceptions.

Modified the consent requirement for data retention to explicitly require 'written consent' from students or parents, rather than just general consent.

ENFORCEMENT

Modified the audit trigger to require that a report be credible, relevant, and sufficiently specific before the state board initiates a compliance audit or investigation.

Amended Excerpts 2/3/2026 11:02:140 → Amended 1/23/2026 11:01:559 · 5 edits

MODERATE

The bill was amended to strengthen privacy protections by clarifying that contracts must be terminated if a vendor fails to fix unauthorized data usage after notification. It also adds a requirement for the State Board of Education to conduct audits within six months of new contracts or privacy agreement changes, and expands the list of specific federal privacy laws that trigger these requirements.

Scope change

The bill's scope was expanded to explicitly include government agencies contracting on behalf of education entities and to clarify the specific federal laws (such as COPPA) that trigger privacy violations.

REQUIREMENT

Amended the trigger for contract termination to focus on 'unauthorized sale or usage' of student data, replacing the previous ambiguous language regarding 'sale' only.

Updated the list of applicable federal privacy laws to explicitly include the Children's Online Privacy Protection Act (COPPA) and specific sections of the Family Education Rights and Privacy Act (FERPA).

Added a new provision allowing third-party contractors to use student data for adaptive learning and marketing educational products, provided the data was not used to target the marketing.

ENFORCEMENT

Added a new mandate requiring the State Board of Education to conduct compliance audits within six months of signing new contracts or revising data privacy agreements.

TECHNICAL

Reorganized sections to clarify the distinction between permitted uses of data (like adaptive learning) and prohibited uses (like targeted advertising).

Amended Excerpts 1/23/2026 11:01:559 → Amended Excerpts 2/3/2026 11:02:140 · 3 edits

MINOR

The bill was amended to clarify that third-party contractors must return or delete student data unless the student or parent provides written consent to keep it. The amendments also update terminology to refer to 'vendors' and 'third-party contractors' more consistently and require the state board to create educational materials to help contractors understand data protection rules.

REQUIREMENT

Clarified that student data must be returned or deleted at the end of a contract unless the student or parent explicitly consents to its retention.

Updated language to consistently refer to 'third-party contractors' and 'vendors' instead of mixing terms like 'contractor' and 'vendor'.

Added a new mandate for the state board to create and distribute educational materials to help third-party contractors understand data privacy obligations.

Enrolled → Amended Excerpts 1/23/2026 11:01:559 · 3 edits

MINOR

The bill was amended to clarify that the termination requirement applies specifically to the unauthorized 'sale' of student data rather than all unauthorized usage. Additionally, the amendment expands enforcement by mandating that the State Board of Education conduct compliance audits within six months of new contracts or data privacy agreement revisions, and it clarifies that audits should investigate 'vendors or contractors' rather than just contractors.

Scope change

The scope of the termination requirement was narrowed to focus on data sales, while the enforcement scope was broadened to include mandatory periodic audits of all relevant agreements.

REQUIREMENT

Changed the trigger for contract termination from general 'unauthorized usage' to specifically 'unauthorized sale' of student data.

ENFORCEMENT

Added a new requirement for the State Board of Education to conduct compliance audits within six months of executing new contracts or revising data privacy agreements.

Updated language to ensure audits investigate both 'vendors and contractors' to cover all third-party entities.

Introduced → Enrolled · 4 edits · Feb 27, 2026

MODERATE

The bill was amended to add a new requirement for the State Board of Education to investigate suspected privacy violations and conduct audits, while also clarifying that the State Board must create educational resources for vendors. Additionally, the effective date was updated to July 1, 2026, and minor wording adjustments were made regarding consent and unauthorized data usage.

Scope change

The bill's scope expanded to include a specific enforcement mechanism requiring the State Board of Education to handle reports of violations and conduct compliance audits.

ENFORCEMENT

Added a new subsection requiring the State Board of Education to receive reports of suspected violations, review their credibility, and initiate compliance audits or investigations.

REQUIREMENT

Added a requirement for state board staff to create materials or resources to help third-party contractors understand data protection laws.

TIMELINE

Updated the effective date of the bill from December 19, 2025, to February 17, 2026, with the law taking effect on July 1, 2026.

TECHNICAL

Changed the wording regarding student consent from 'consents' to 'gives written consent' and updated 'unauthorized sale' to 'unauthorized usage' in the notice provision.

Privacy Compliance for Education Technology Vendors

What changed between versions

How they voted

Actions timeline

Sponsors