K-12 Pupil Online Personal Information Protection Act (formerly SOPIPA)
KOPIPA (SOPIPA)
Students · Children
Protects K-12 students' data held by education technology operators. Operators may not use student data for targeted advertising, build non-school profiles, sell it, or disclose it except as listed, and must secure it and delete it on request. AB 1159 (signed Sept. 10, 2026, Chapter 182) widens coverage, bars using student data to train generative AI or develop AI systems, and adds a private right of action from January 1, 2027.
- Where
- California
- Citation
- Cal. Bus. & Prof. Code 22584-22585
- Status
- In force
- In force since
- 2016-01-01
- Last amended
- 2025-01-01
- Enforced by
- California Attorney General and local prosecutors; pupils actually harmed (from 2027)
- People can sue
- No
- Penalties
- Currently enforced through general unfair competition remedies. AB 1159 (2026) adds, from January 1, 2027, a private action for pupils who suffer actual damages: the greater of actual damages or $500 per plaintiff per violation, plus injunction, punitive damages, and fees, after 60-day notice and cure.
- Applies to
- Operators of websites, online services (including cloud services), and apps with actual knowledge that they are used primarily for K-12 school purposes and were designed and marketed for those purposes (22584(a)(7))
- AB 1159 (2026) broadens this from January 1, 2027 to services used for school purposes and designed or marketed for them, and to entities acting for operators
Rights it gives people
- Delete a pupil's covered information at the school's request, and CCPA-excluded information at a parent's (or adult former pupil's) request after 60 days of non-enrollment.Cal. Bus. & Prof. Code 22584(d)(2)-(3)
Practices it requires
- Do not disclose covered information except for listed purposes, and bind service providers by contract.Cal. Bus. & Prof. Code 22584(b)(4)
- Do not use student information, including persistent identifiers, to build a profile of a pupil except for K-12 school purposes.Cal. Bus. & Prof. Code 22584(b)(2)
- Do not sell pupil information (acquisitions excepted if the successor stays bound).Cal. Bus. & Prof. Code 22584(b)(3)
- Do not engage in targeted advertising based on information acquired through the K-12 service.Cal. Bus. & Prof. Code 22584(b)(1)
- Do not use covered information to train generative AI or develop AI systems.Cal. Bus. & Prof. Code 22584 (as amended by Stats. 2026, Ch. 182) · From 2027-01-01
Security duties
- Implement and maintain reasonable security procedures and practices for covered information.Cal. Bus. & Prof. Code 22584(d)(1)
Sources
- Official text
- Cal. Bus. & Prof. Code 22584 (California Legislative Information)
- AB 1159 (2026) bill history, Chapter 182
- AB 1159 chaptered text
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Original effective date (Jan. 1, 2016, SB 1177 of 2014) is from background knowledge. | AB 1159 effective date presumed Jan. 1, 2027 except the new higher-education chapter (operative July 1, 2027); private_right_of_action set to 'no' until then. | Renaming to 'K-12 Pupil Online Personal Information Protection Act' taken from the AB 1159 digest describing existing law.
Research reference, not legal advice.