K-12 Pupil Online Personal Information Protection Act (formerly SOPIPA)

Protects K-12 students' data held by education technology operators. Operators may not use student data for targeted advertising, build non-school profiles, sell it, or disclose it except as listed, and must secure it and delete it on request. AB 1159 (signed Sept. 10, 2026, Chapter 182) widens coverage, bars using student data to train generative AI or develop AI systems, and adds a private right of action from January 1, 2027.