Privacy Law Library

Student Data Privacy (Act Concerning Student Data Privacy)

CT Student Data Privacy

Students · Children · Breach notification · Data security

Requires school boards to sign written contracts with ed-tech vendors that keep student data under school control, limit use to school purposes, and require deletion and security. Ed-tech operators may not use student data for targeted advertising, sell it, or build non-school profiles, and both contractors and operators must report student data breaches within set deadlines.

Where
Connecticut
Citation
Conn. Gen. Stat. 10-234aa to 10-234gg (P.A. 16-189, as amended by P.A. 17-200 and 18-125)
Status
In force
In force since
2016-10-01
Last amended
2018-07-01
Enforced by
Not specified; noncompliant contracts are void (10-234bb(e)-(f)); State Department of Education issues guidance (10-234ee)
People can sue
No
Penalties
No civil penalty specified in 10-234aa to 10-234dd; contracts lacking required terms are void after notice and failure to amend (10-234bb(f)).
Applies to
  • Contractors that receive student information, records or student-generated content from local or regional boards of education (10-234bb)
  • Operators of websites, online services or mobile apps that know they are used for school purposes and were designed and marketed for school purposes, and that collect student information (10-234aa(2), 10-234cc)
  • Local and regional boards of education (contracting, posting and notice duties)

What a privacy notice must say

  • Boards must post each vendor contract on their website within five business days and tell families the web address each school year.Conn. Gen. Stat. 10-234bb(g)

Practices it requires

  • Boards must have a written contract with any contractor given student data, stating the data are not the contractor's property, limiting use to contract purposes, providing deletion and correction procedures, and barring retention after the contract ends.Conn. Gen. Stat. 10-234bb(a)
  • Operators may not engage in targeted advertising based on student data, collect or use student data except for school purposes, or sell, rent or trade student data (merger exception).Conn. Gen. Stat. 10-234cc(b)
  • Contractors may not use student data for unauthorized purposes or use personally identifiable student data for targeted advertising.Conn. Gen. Stat. 10-234bb(d)

Security duties

  • Operators must maintain security meeting or exceeding industry standards and delete student data within a reasonable time on request of the student, parent or board.Conn. Gen. Stat. 10-234cc(a)
  • Contractors must maintain security practices consistent with HHS breach-guidance technologies and safeguards for student records.Conn. Gen. Stat. 10-234bb(c)

Breach duties

  • Contractors must notify the board within 30 days of discovering a breach of student information (60 days for directory information, records or content); boards must notify students and parents electronically within two business days and post notice online; operators must notify students or parents within 30 days.Conn. Gen. Stat. 10-234dd

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: No 2026 Supplement changes to 10-234aa to 10-234gg were found in the ch. 170 supplement listing, but the listing was checked only by section-number search.

Research reference, not legal advice.