Privacy Law Library

Online Education Services and Student Educational Records Act (student data privacy)

NJ Student Online Privacy Law

Students · Children

This student data privacy law bars K-12 ed-tech operators from using students' information for targeted advertising, building non-school profiles, or selling or renting it, and limits when they may disclose it. Operators must secure student data and delete it at the request of the school, the district, or a student who has turned 18.

Where
New Jersey
Citation
N.J.S.A. 56:8-215 to 56:8-221; P.L.2019, c.494 (A4978)
Status
In force
In force since
2020-07-19
Enforced by
New Jersey Attorney General / Division of Consumer Affairs (Consumer Fraud Act), with rulemaking in consultation with the Commissioner of Education
People can sue
Limited
Penalties
Violations are unlawful practices under the Consumer Fraud Act, with civil penalties of up to $10,000 for a first offense and $20,000 for each later offense (56:8-13) and injunctive relief; a person with an ascertainable loss may sue for treble damages and attorney's fees (56:8-19).
Applies to
  • Operators of Internet websites, online services, and apps that are used primarily for, and designed and marketed for, K-12 school purposes, with actual knowledge of that use (56:8-215)
  • Covers public K-12 schools operated by New Jersey school districts; general-audience sites and apps are excluded (56:8-219(c))

Rights it gives people

  • Delete covered information at the request of the K-12 school, the school district, or a student who has reached the age of majority, unless the adult student or a parent asks that it be kept.N.J.S.A. 56:8-217(c)

Practices it requires

  • Do not use information gathered through the service to target advertising to students, on the service or elsewhere.N.J.S.A. 56:8-216(a)(4)
  • Do not amass a student profile for non-K-12 school purposes, and do not sell or rent student information (limited exceptions for mergers and consented national assessment providers).N.J.S.A. 56:8-216(a)(1)-(2)
  • Disclose covered information only for listed purposes, such as furthering school purposes, legal compliance, safety, parent-requested purposes, contractually restricted service providers, or permitted research.N.J.S.A. 56:8-216(a)(3)

Security duties

  • Implement reasonable security procedures appropriate to the covered information and protect it from unauthorized access, destruction, use, modification, or disclosure.N.J.S.A. 56:8-217(a)-(b)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: The DCA courtesy copy shows the source note as 'L.2017, c.494', which conflicts with the chapter law (P.L.2019, c.494, approved January 21, 2020); the chapter law is treated as authoritative. | Operative date computed as 180 days after January 21, 2020 (July 19, 2020). | Implementing rules under 56:8-221 were not located.

Research reference, not legal advice.