Higher Education Student Information Protection Act (AB 1159, 2026)
HESIPA
Students
Extends K-12-style student data protections to college and university students: limits on targeted advertising, profiling, sale, disclosure, and AI training using student data, plus security and deletion duties. Operative July 1, 2027.
- Where
- California
- Citation
- Cal. Bus. & Prof. Code 22587 et seq. (Chapter 22.2.6, added by Stats. 2026, Ch. 182)
- Status
- Enacted, not yet in force
- In force since
- 2027-07-01
- Enforced by
- California Attorney General and local prosecutors; students actually harmed
- People can sue
- Limited
- Penalties
- Private action for students who suffer actual damages (greater of actual damages or $500 per plaintiff per violation, plus injunction, punitive damages, fees) after 60-day notice, per the bill digest.
- Applies to
- Operators of online services and apps with actual knowledge they are used for higher education purposes and designed or marketed for them
Practices it requires
- Do not use student information for targeted advertising, non-educational profiling, sale, or AI training; disclose only for listed purposes.Cal. Bus. & Prof. Code 22587 et seq. · From 2027-07-01
Security duties
- Maintain reasonable security for covered student information and delete it on request as specified.Cal. Bus. & Prof. Code 22587 et seq. · From 2027-07-01
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Section-level citations inside Chapter 22.2.6 not pinned; obligations summarized from the bill digest and chapter heading.
Research reference, not legal advice.