New California Bill Would Close Student Data Privacy Loopholes

(TNS) — When Morro Bay mom Jen Ford’s kids turned 18 years old, they began receiving credit card offers, student loan advertisements and telemarketing calls to their personal cellphones.

Though Ford believes that information can be valuable for young adults, she said the fact that big companies were tracking her kids’ birthdays and knew exactly when they were going to turn 18 — and then used that information to market their services to them — was alarming.

“It was really unnerving that they were immediately bombarded with all of this,” she told The Tribune.

Ford’s experience is just one example of how a child’s online data can be extracted and used by companies to fuel their own incentives — and one that ultimately helped inform a new bill authored by Ford’s employer, Assemblymember Dawn Addis, D-Morro Bay, that intends to restrict how and when student data can be captured.

Assembly Bill 1159 will not limit any student’s access to information about scholarships, college recruitment or admission opportunities, Addis said — but if passed, it would close a slew of loopholes in the state’s data protection laws that are creating dangerous circumstances where young peoples’ information can be collected, sold or stolen.

The bill also aims to extend a group of data privacy protections currently offered to preschool and grade-school students through the K-12 Pupil Online Personal Information Protection Act (KOPIPA) and the Early Learning Personal Information Protection Act (ELPIPA) to college students as well, by creating the Higher Education Student Information Protection Act.

Addis said many college students may not even be aware that their writing submitted on online platforms, which could include personal information ranging from their immigration status to gender identity, could be obtained and held indefinitely by tech companies or even the federal government.

“We’re seeing the Trump administration really try to get at people’s personal records through the subpoena process,” Addis said. “And then there’s really no guardrails in terms of selling data or using that data for AI training.”

HOW COULD SLO COUNTY LAWMAKER’S BILL PROTECT STUDENT DATA?
Addis’ wide-ranging bill would expand student data privacy protections currently in place for K-12 students to students attending higher education institutions.

Previously, the state passed a major child privacy law in 2014 that restricted technology companies from collecting or selling student data, disclosing minors’ personal information or compiling data to advertise to kids.

Currently, no such safeguards are in place for college students.

Addis said higher education continues to be the “big missing piece” in the state’s student data privacy laws, which is why she decided to craft the legislation.

If signed by the governor this fall, the bill would enact the Higher Education Student Information Protection Act on July 1, 2027, banning companies from collecting, retaining or sharing sensitive information — such as gender identity or sexuality, immigration status, reproductive or sexual health information — from students enrolled in community colleges or four-year universities.

It would prohibit educational technology operators from selling student information, using student data for targeted advertising or disclosing covered information, according to CalMatter’s Digital Democracy database.

“We want to make sure that students aren’t unknowingly subjected to having that private information used in a way that they would regret or really would be taken advantage of or be put in a dangerous situation,” Addis told The Tribune.

The legislation would also bolster California’s privacy protections for younger students by barring companies from collecting student data through platforms typically used for extracurricular activities, such as apps built for purchasing prom tickets, on-campus concert tickets, messaging platforms for sports teams or any other online operator designed or marketed for K-12 purposes.

Addis said the “jam-packed” legislation would also create a private right of action, a built-in enforcement mechanism that allows students to sue if they’re privacy protections have been violated, as well as restrict technology companies from using student information to train or develop artificial intelligence systems.

“The more people wake up to what’s happening, the more concerned they are. I think a lot of it is people just haven’t known,” Addis added. “There’s also been an information gap, and it’s not like the companies want you to know that they’re selling your kid’s information.”

COMPANIES ACCUSED OF SELLING DATA PRESENTS ‘CHALLENGE’ FOR SLO SCHOOLS
Jeremy Koellish works as the IT director for the San Luis Coastal school district, which means he oversees the district’s compliance with state and federal technology and data privacy regulations.

Koellish said he goes through the company terms of use “with a fine-tooth comb” to ensure that the district’s technology uses are compliant with the law — but sometimes, that still isn’t enough.

In the last year, at least two popular educational technology — commonly known as edtech — companies have come under fire for allegedly sharing student data in violation of state law.

CalMatters reported in March that GoFan, a school sports ticketing platform owned by parent company PlayOn, was fined $1.1 million by the State of California after it was found to have collected and sold user data in violation of existing student privacy law.

Meanwhile, the popular learning platform iReady has come into the limelight after two California parents filed a lawsuit accusing parent company Curriculum Associates of collecting student data and sharing it with third parties, though the company denied the allegations, The Guardian reported in June.

Koellish told The Tribune that San Luis Coastal does use subsidiaries of PlayOn, including GoFan and MaxPreps, because the programs are used for CIF activities. The district also uses iReady, he said.

“That’s a challenge that we have,” he said, adding that despite efforts to ensure legal compliance, companies can “promise to do the right thing” and then be found doing the opposite.

“It does happen, even when we do our due diligence, and that sucks,” Koellish told The Tribune. “It’s terrible because, you know, a lot of the time the heat gets pushed back onto us.”

But he believes Addis’ bill is a step in the right direction.

“Technology is moving fast, and our privacy laws need to keep up,” he wrote in an emailed statement. “I support the direction of AB 1159 because it modernizes KOPIPA putting real guardrails around how student data is used in AI, banning the collection of sensitive personal information and requiring strict data minimization.”

The Tribune also reached out to Cal Poly about Addis’ bill, but university spokesperson Keegan Koberl elected not to comment on pending legislation.

SLO COUNTY PARENTS CONCERNED ABOUT TECH USE, PRIVACY PROTECTIONS
Meanwhile, concerns about data privacy and technology use also exist among parents in San Luis Coastal.

According to assistant superintendent of educational services Lisa Yamashita, the district heard from one family last year who requested complete digital anonymity for their student.

“KOPIPA in its current form doesn’t give us the ability to support that parent,” Koellish added. “You know, that would be great to make all of our students anonymous with their data and stuff like that to kind of hide the footprint. But like, the software within education meets the goals, they don’t really ever like, exceed the goals.”

Instead, the district made accommodations to allow the student not to use any devices at all, to avoid creating any digital footprint, Yamashita said.

“We do accommodate, are prepared to accommodate any family or parent that requests that their child has no access to technology,” she said.

Koellish added that he’s also heard from parents with concerns about the use of artificial intelligence as the popularity of chatbots and other AI services continues to grow — another aspect of data privacy that Addis’ bill attempts to further regulate.

“It is new,” Koellish said. “It’s evolving excessively rapidly, and government is not … keeping up because it moves so quickly.”

As of now, the district does not allow students to access chatbots or AI apps on school devices, Yamashita said.

Ultimately, district officials said they’re prioritizing community feedback and ongoing conversations during a time of technological growth and mixed opinion.

“We want our teachers and students to be able to benefit from educational technologies without asking them to trade away their privacy,” Yamashita said. “I believe that innovation and privacy don’t have to be competing priorities. Really, the goal is that it should be built into every technology we select and use.”

SOME PARENTS ARGUE SOLUTION IS LIMITING CLASSROOM TECHNOLOGY
San Luis Obispo parent Chad Worth is one parent whose opinions about school technology have grown stronger in recent years.

When his now-second-grade daughter was in kindergarten, he recalled she talked about another student who had a watch with games on it that they would bring to school. Later, in first grade, she mentioned that she used a Chromebook to do work during the school day.

Worth believes that some edtech has outstayed its welcome.

“School districts across the country and the world did what they had to do during COVID,” he told The Tribune. “That’s when, you know, the Chromebook subscriptions ramped up, and everyone got a one-to-one device.”

“We kind of say it’s like a Band-Aid that never came off,” he continued.

And when San Luis Coastal has already undergone around $10 million in cuts over the last three years due to a budget deficit, Worth questioned whether technology is a necessary expense.

“Is this the right place to be spending our limited resources on, you know, technology that there isn’t a lot of data that shows that it helps?” he said. “In fact, there’s plenty of data that shows that it hurts.”

To help start conversations, Worth recently founded the San Luis Coastal Unified School District’s chapter of Schools Beyond Screens, a national group formed to lobby for limitations on classroom technology. The group originated in the Los Angeles Unified School District.

Similarly, a petition was recently launched by a separate parent group that also aims to place limits on screen time in San Luis Coastal classrooms.

While Worth believes Addis’ bill is a decent effort toward expanding protections for K-12 and college-aged students, he also thinks limiting technology use would help avoid privacy risks while also reducing classroom distractions.

“Anything you put on the Internet will live somewhere forever,” he said. “And we can try to legislate different components of this, but it’s risky. The more you expose yourself to these tools, the more likely that it’s going to leak and, you know, perhaps be used in ways you don’t want it to.”

WHAT’S NEXT FOR HIGH-PROFILE STUDENT DATA PROTECTION BILL?
So far, several major organizations have thrown their support for and against the high-profile student data privacy bill.

Addis’ legislation has faced fierce opposition from technology and business lobbying groups and higher education test companies, including College Board, the ACT Education Corporation, California Association of College Stores, the National Association Of College Stores, the California Chamber or Commerce, the Computer and Communications Industry Association and Technet, according to CalMatter’s Digital Democracy site.

The Software & Information Industry Association said it was against the bill because it would create vague AI restrictions, possibly expose ed tech providers to “crippling litigation costs” and put in place too broad data limitations that could stop adult students from sharing their own information for scholarships and financial aid.

“AB 1159 would drive smaller and mid-sized ed tech providers out of the California market, reduce competition, raise costs for school districts, and ultimately limit access to high-quality digital tools for students,” the private trade organization said in a news release.

During a committee hearing on June 22, Sara Noceto, a spokesperson for National and California Association of College Stores, said the bill should exempt higher education institutions and auxiliary organizations that handle student information, like bookstores, student unions, housing and food services, that are already subject to existing privacy laws.

“We do believe AB 1159 should be more carefully tailored so it does not reduce access to beneficial student services,” she said at the hearing.

Since then, the bill has been amended to state that operators do not include the Department of Education, local education agencies or schools.

“The goal is to walk that very fine line when we’re protecting student data and allowing students the access that they need,” Addis told The Tribune.

More than 30 organizations have also pledged their support for the measure, such as the California Faculty Association, the American Federation of Teachers, the California School Employees Association, the California Labor Federation and the California Police Chiefs Association, among others.

The bill passed the Senate Appropriations Committee on Thursday and will head to a vote on the Senate floor next.

© 2026 The Tribune (San Luis Obispo, Calif.). Distributed by Tribune Content Agency, LLC.