Bill Text: IL SB0600 | 2017-2018 | 100th General Assembly | Introduced

---

Bill Title: Creates the Student Online Personal Information Protection Act. Provides that the operator of an Internet website, online service, online application, or mobile application used primarily for K-12 school purposes and designed and marketed for K-12 school purposes shall not knowingly (1) engage in targeted advertising on the operator's site, service, or application or target advertising on any other site, service, or application when the targeting of the advertising is based upon any information that the operator has acquired because of the use of that operator's site, service, or application; (2) use information created or gathered by the operator's site, service, or application to amass a profile about a K-12 student except in furtherance of K-12 school purposes; (3) sell a student's information; or (4) disclose covered information, as defined in the Act, without the consent of a student's parent or legal guardian. Sets forth exceptions and other provisions concerning the construction and application of the Act. Effective January 1, 2018.

Spectrum: Bipartisan Bill

Status: (Failed) 2019-01-09 - Session Sine Die [SB0600 Detail]

Download: Illinois-2017-SB0600-Introduced.html

---

100TH GENERAL ASSEMBLY State of Illinois 2017 and 2018 SB0600 Introduced 1/24/2017, by Sen. Michael Connelly SYNOPSIS AS INTRODUCED:
New Act
Creates the Student Online Personal Information Protection Act. Provides that the operator of an Internet website, online service, online application, or mobile application used primarily for K-12 school purposes and designed and marketed for K-12 school purposes shall not knowingly (1) engage in targeted advertising on the operator's site, service, or application or target advertising on any other site, service, or application when the targeting of the advertising is based upon any information that the operator has acquired because of the use of that operator's site, service, or application; (2) use information created or gathered by the operator's site, service, or application to amass a profile about a K-12 student except in furtherance of K-12 school purposes; (3) sell a student's information; or (4) disclose covered information, as defined in the Act, without the consent of a student's parent or legal guardian. Sets forth exceptions and other provisions concerning the construction and application of the Act. Effective January 1, 2018.
LRB100 06925 MLM 16976 b
FISCAL NOTE ACT MAY APPLY
A BILL FOR
SB0600 LRB100 06925 MLM 16976 b
AN ACT concerning education.
Be it enacted by the People of the State of Illinois,
represented in the General Assembly:
Section 1. Short title. This Act may be cited as the
Student Online Personal Information Protection Act.
Section 5. Definitions. In this Act:
"Covered information" means personally identifiable
information or materials, in any media or format, that meets
any of the following:
(1) Is created or provided by a student or the
student's parent or legal guardian to an operator in the
course of the student's, parent's, or legal guardian's use
of the operator's site, service, or application for K-12
school purposes.
(2) Is created or provided by an employee or agent of a
school or school district to an operator.
(3) Is gathered by an operator through the operation of
a site, service, or application described in the definition
of "operator" under this Section and is descriptive of a
student or otherwise identifies a student, including
without limitation information in the student's
educational record or e-mail, first and last name, home
address, telephone number, e-mail address, or other

SB0600 - 2 - LRB100 06925 MLM 16976 b
information that allows physical or online contact,
discipline records, test results, special education data,
juvenile dependency records, grades, evaluations, criminal
records, medical records, health records, social security
number, biometric information, disabilities, socioeconomic
information, food purchases, political affiliations,
religious information, text messages, documents, student
identifiers, search activity, photos, voice recordings, or
geolocation information.
"K-12" means grades kindergarten through 12 in the public
school system.
"K-12 school purposes" means K-12 purposes that
customarily take place at the direction of a school, teacher,
or school district or aid in the administration of school
activities, including without limitation instruction in the
classroom or at home, administrative activities, and
collaboration between students, school personnel, or parents,
or are for the use and benefit of a school.
"Online service" includes cloud computing services, which
must comply with this Act if they otherwise meet the definition
of an operator.
"Operator" means the operator of an Internet website,
online service, online application, or mobile application with
actual knowledge that the site, service, or application is used
primarily for K-12 school purposes and was designed and
marketed for K-12 school purposes.

SB0600 - 3 - LRB100 06925 MLM 16976 b
"School" means a public school in this State.
Section 10. Prohibited activities and duties of operators.
(a) An operator shall not knowingly engage in any of the
following activities with respect to its site, service, or
application without the consent of a student's parent or legal
guardian:
(1) Engage in targeted advertising on the operator's
site, service, or application or target advertising on any
other site, service, or application when the targeting of
the advertising is based upon any information, including
covered information and persistent unique identifiers,
that the operator has acquired because of the use of that
operator's site, service, or application described in the
definition of "operator" under Section 5 of this Act.
(2) Use information, including persistent unique
identifiers, created or gathered by the operator's site,
service, or application, to amass a profile about a K-12
student, except in furtherance of K-12 school purposes.
(3) Sell a student's information, including covered
information. The prohibition under this subdivision (3)
does not apply to the purchase, merger, or other type of
acquisition of an operator by another entity, provided that
the operator or successor entity continues to be subject to
the provisions of this Act with respect to previously
acquired student information.

SB0600 - 4 - LRB100 06925 MLM 16976 b
(4) Disclose covered information, unless the
disclosure is made:
(A) in furtherance of the K-12 school purposes of
the site, service, or application, provided that the
recipient of the covered information disclosed
pursuant to this subdivision (4) (i) shall not further
disclose the information unless done to allow or
improve operability and functionality within that
student's classroom or school and (ii) is legally
required to comply with subsection (c) of this Section;
(B) to ensure legal and regulatory compliance;
(C) to respond to or participate in the judicial
process;
(D) to protect the safety of users or others or the
security of the site; or
(E) to a service provider, provided that the
operator contractually (i) prohibits the service
provider from using any covered information for any
purpose other than providing the contracted service to
or on behalf of the operator, (ii) prohibits the
service provider from disclosing any covered
information provided by the operator with subsequent
third parties, and (iii) requires the service provider
to implement and maintain reasonable security
procedures and practices as provided in subsection (c)
of this Section.

SB0600 - 5 - LRB100 06925 MLM 16976 b
(b) Nothing in subsection (a) of this Section shall be
construed to prohibit the operator's use of information for
maintaining, developing, supporting, improving, or diagnosing
the operator's site, service, or application.
(c) An operator shall do both of the following:
(1) Implement and maintain reasonable security
procedures and practices appropriate to the nature of the
covered information and protect that information from
unauthorized access, destruction, use, modification, or
disclosure.
(2) Delete a student's covered information if the
school or school district requests deletion of data under
the control of the school or school district.
(d) Notwithstanding subdivision (4) of subsection (a) of
this Section, an operator may disclose covered information of a
student, as long as subdivisions (1), (2), and (3) of
subsection (a) of this Section are not violated, under the
following circumstances:
(1) If other provisions of federal or State law require
the operator to disclose the information and the operator
complies with the requirements of federal and State law in
protecting and disclosing that information.
(2) For legitimate research purposes (i) as required by
State or federal law and subject to the restrictions under
applicable State and federal law or (ii) as allowed by
State or federal law and under the direction of a school or

SB0600 - 6 - LRB100 06925 MLM 16976 b
school district or the State Board of Education if no
covered information is used in furtherance of advertising
or to amass a profile on the student for purposes other
than K-12 school purposes.
(3) To a State or local educational agency, including
schools and school districts, for K-12 school purposes, as
permitted by State or federal law.
(e) Nothing in this Section prohibits an operator from
using de-identified student covered information as follows:
(1) Within the operator's site, service, or
application or other sites, services, or applications
owned by the operator to improve educational products.
(2) To demonstrate the effectiveness of the operator's
products or services, including in their marketing.
(f) Nothing in this Section prohibits an operator from
sharing aggregated de-identified student covered information
for the development and improvement of educational sites,
services, or applications.
Section 15. Construction and application of Act.
(a) This Act shall not be construed to limit the authority
of a law enforcement agency to obtain any content or
information from an operator as authorized by law or pursuant
to an order of a court of competent jurisdiction.
(b) This Act does not limit the ability of an operator to
use student data, including covered information, for adaptive

SB0600 - 7 - LRB100 06925 MLM 16976 b
learning or customized student learning purposes.
(c) This Act does not apply to general audience Internet
websites, general audience online services, general audience
online applications, or general audience mobile applications,
even if login credentials created for an operator's site,
service, or application may be used to access those general
audience sites, services, or applications.
(d) This Act does not limit Internet service providers from
providing Internet connectivity to schools or students and
their families.
(e) This Act shall not be construed to prohibit an operator
of an Internet website, online service, online application, or
mobile application from marketing educational products
directly to parents so long as the marketing did not result
from the use of covered information obtained by the operator
through the provision of services covered under this Act.
(f) This Act does not impose a duty upon a provider of an
electronic store, a gateway, a marketplace, or other means of
purchasing or downloading software or applications to review or
enforce compliance of this Act on those applications or
software.
(g) This Act does not impose a duty upon a provider of an
interactive computer service, as defined in Section 230 of
Title 47 of the United States Code, to review or enforce
compliance with this Act by third-party content providers.
(h) This Act does not impede the ability of students to

SB0600 - 8 - LRB100 06925 MLM 16976 b
download, export, or otherwise save or maintain their own
student-created data or documents.
Section 97. Severability. The provisions of this Act are
severable under Section 1.31 of the Statute on Statutes.
Section 99. Effective date. This Act takes effect January
1, 2018.