Maryland Student Data Privacy Act (operators of PreK-12 online services)
MD Student Data Privacy Act
Students · Children
Maryland's student data privacy law limits what education-technology operators working under contract with public schools may do with student information. Operators must secure covered information and delete it on school request, and may not use it for targeted advertising, build non-educational student profiles, sell it, or disclose it outside listed exceptions. The 2022 amendments (ch. 164) expanded covered information, added persistent identifiers, and tied coverage to school contracts.
- Where
- Maryland
- Citation
- Md. Code, Educ. § 4-131
- Status
- In force
- Last amended
- 2022-06-01
- Enforced by
- No enforcement provision in § 4-131 (contract remedies by schools; see unverified)
- People can sue
- No
- Penalties
- Section 4-131 does not specify penalties or an enforcing agency.
- Applies to
- Operators: individuals or entities acting under FERPA's school-official exception under a contract or agreement with a Maryland public school or local school system whose site, service, or application processes covered student information for a PreK-12 school purpose or at a school's direction (4-131(a)(3))
- Not general-audience websites, services, or apps, even if operator login credentials can be used to access them (4-131(b))
What a privacy notice must say
- Other uses or disclosures (never sale) require clear and conspicuous notice and affirmative consent from the parent or guardian, or the student if 18 or older.Educ. 4-131(h)
Practices it requires
- Delete covered information within a reasonable time when the public school or local school system requests it.Educ. 4-131(c)(3)
- Do not use information acquired through the service, including persistent unique identifiers, for targeted advertising.Educ. 4-131(d)(1)(i)
- Do not build a student profile except for a PreK-12 school purpose, and do not sell student information.Educ. 4-131(d)(1)(ii)-(iii)
- Disclose covered information only for school purposes, legal compliance, safety and security, contracted service providers bound to the same limits, required research, or education agencies; successors in a merger remain bound.Educ. 4-131(d)(1)(iv), (e), (f)
Security duties
- Protect covered information from unauthorized access, destruction, use, modification, or disclosure with reasonable security procedures and practices.Educ. 4-131(c)(1)-(2)
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Original enactment (Student Data Privacy Act of 2015) and effective date not verified. | No enforcement mechanism appears in § 4-131; whether the Consumer Protection Act or another statute applies was not verified. | The Student Data Privacy Council provisions created by 2019 and 2022 legislation were not reviewed (government body).
Research reference, not legal advice.