Student Data Privacy Protection Act

Delaware's K-12 ed-tech privacy law bars operators of school-focused online services from using student data for targeted advertising, building non-school profiles, selling student data, or disclosing it except for listed school, legal, safety, or service-provider purposes. Operators must meet state cloud-hosting security standards and delete student data within 45 days when a school asks.