[ GUIDE ]

State student data privacy laws for AI vendors (not legal advice)

What state student-data laws ask of AI vendors, how the National Data Privacy Agreement works, and what a strong agreement should include. Not legal advice.

Plan a pilot Watch the demo

Facts as of Oct 18, 2026Last reviewed Oct 19, 20263 min read

Not legal advice

This guide summarizes public rules for school leaders. It is not legal advice; ask your school's counsel before relying on it.

State laws that bind ed-tech vendors

A sample of state laws that apply to AI vendors handling student data, as of Oct 18, 2026.

Law	Key rules	Private schools?
California SOPIPA	No targeted ads, sale or unlisted disclosure; no student profiles except for K-12 school purposes; security; delete at the school's request	Operator duties are not limited to public schools
New York Education Law 2-d	A data security and privacy plan; a signed parents' bill of rights; use only as contracted; no sale or marketing; breach notice "in the most expedient way possible"	Public schools and listed publicly funded programs, plus approved private special-education schools
Illinois SOPPA	The same core bans; breach notice to the school within 30 calendar days; a written agreement with set terms	Includes nonpublic schools, which are exempt from the written-agreement duty
Maryland Education Article 4-131	No targeted ads, sale or profiles except for a PreK-12 school purpose; security; delete on request	No; tied to public-school contracts
Maryland Online Data Privacy Act	Above thresholds: no targeted ads to, or sale of data of, a consumer the business "knew or should have known" is under 18; collect only what is reasonably necessary and proportionate	Applies above thresholds; private-school data is not FERPA data
Maryland Kids Code	For larger firms: impact assessments; no profiling of a child by default; data minimization	By vendor size
Maryland breach law	A vendor holding data for another business tells the owner within 10 days	All

State student-data laws for vendors

The National Data Privacy Agreement

Many districts ask vendors to sign the Student Data Privacy Consortium's National Data Privacy Agreement instead of negotiating a custom contract. The current version may not be changed in substance and is for members of the Access 4 Learning Community. A vendor signs the standard agreement with one district in a participating state; it is posted in the SDPC Resource Registry, and other districts in that state can accept the same terms through its general offer, known as Exhibit E. SDPC reports 29 state alliances. Its Maryland page listed no districts on Oct 18, 2026.

What a strong agreement includes

The school owns the data.
School-official terms where FERPA applies, with the purposes listed.
No sale, no ads and no model training on student data.
A list of subprocessors, with notice before any is added.
A written retention schedule and deletion within a set number of days of the school's request.
A breach notice timeline.
A path for parents' requests to see records.
Audit rights for the school.

Breach timelines compared

State timelines vary: Maryland gives a vendor 10 days to tell the data owner, Illinois's SOPPA gives 30 calendar days to tell the school, and New York requires notice "in the most expedient way possible." Nexus tells a school within 72 hours of confirming a breach.

Where Nexus stands

We will sign your data privacy agreement or the National Data Privacy Agreement. Maryland's student-data law for public schools bars targeted ads, sale and profiles outside school purposes; we follow it for every school. Maryland's Online Data Privacy Act and Kids Code apply to vendors above size thresholds; we already follow their core rules for minors: no targeted ads and no sale of their data.

[ FAQ ]

Questions and answers

What is the SDPC National Data Privacy Agreement?

A standard student data privacy contract from the Student Data Privacy Consortium. Districts use it instead of custom contracts, and other districts in a state can accept a signed agreement's terms through its general offer.

Do state student privacy laws apply to private schools?

Some do. Illinois's SOPPA names nonpublic schools, and California's SOPIPA binds operators beyond public schools. New York's 2-d and Maryland's 4-131 are tied to public schools.

How fast must an AI vendor report a breach?

It varies by state: Maryland gives vendors 10 days to tell the data owner, and Illinois's SOPPA gives 30 calendar days to tell the school. Contracts often set shorter deadlines.