Student Data Privacy: Technology Providers and School-Issued Devices (Educational Data)

MN Student Data Privacy

Students · Children · Location · Government records

Minnesota's 2022 student data privacy provisions bar technology providers serving public schools from selling, sharing, or commercially using student educational data, including for advertising, and require them to protect the data, report breaches to the school, and return or destroy data at contract end. Schools and providers generally may not remotely access a school-issued device's location tracking, camera, microphone, keystrokes, or browsing, except for listed purposes such as noncommercial instruction with advance notice, warrants, stolen devices, or imminent threats.

Where: Minnesota
Citation: Minn. Stat. 13.32, subds. 1(d), (g), 13-15 (within 13.32, Educational Data)
Status: In force
In force since: 2022-08-01
Enforced by: Minnesota Government Data Practices Act remedies; technology providers are bound as if government entities under 13.05, subd. 11 (13.32, subd. 13(a))
People can sue: Limited
Penalties: No penalty specific to these subdivisions; technology providers are subject to chapter 13 as if they were government entities (13.05, subd. 11), so chapter 13 remedies apply.
Applies to: Technology providers: persons that contract with a Minnesota public educational agency or institution to provide school-issued devices and create, receive, or maintain educational data under the contract (13.32, subd. 1(g))
Public school districts and other public educational agencies (notice and device-monitoring limits)
Exempt: postsecondary institutions and their technology providers; nonprofit national assessment providers acting with express student or parent consent for scholarships, financial aid, and similar access (subd. 15)

What a privacy notice must say

Schools must notify parents and students within 30 days of the start of each school year of curriculum, testing, or assessment technology providers with access to educational data, and let them inspect provider contracts.Minn. Stat. 13.32, subd. 13(h)-(i)

Practices it requires

Technology providers must not sell, share, or disseminate educational data except as the section allows, and must not use it for any commercial purpose, including marketing or advertising to students or parents.Minn. Stat. 13.32, subd. 13(e)-(f)
Within 90 days after the contract expires (unless renewal is reasonably anticipated), destroy or return all educational data; educational data is not the provider's property.Minn. Stat. 13.32, subd. 13(b), (d)
Do not remotely access or monitor a school-issued device's location tracking, audio or video features, or student keystrokes and browsing, except for noncommercial educational purposes with advance notice, a judicial warrant, a missing or stolen device, an imminent threat (with notice to the student or parent within 72 hours), or legal or funding-program compliance.Minn. Stat. 13.32, subd. 14

Security duties

Contracts must include security safeguards limiting provider employee and contractor access to authorized persons whose duties require it.Minn. Stat. 13.32, subd. 13(g)

Breach duties

After discovering a breach of educational data, the technology provider must give the school all information needed for the school's breach notice under 13.055.Minn. Stat. 13.32, subd. 13(c)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: The session law makes the provisions effective 'for the 2022-2023 school year and later'; 2022-08-01 is used as an approximation of that start. | Later amendments to 13.32 (Laws 2023, ch. 55, art. 4; 2024, ch. 109, art. 2; 2025, ch. 35, art. 9; 2025 1st Spec. Sess. ch. 10, art. 12) were not read, so whether they changed subds. 13 to 15 and their dates are unconfirmed; last_amended left null.

Research reference, not legal advice.