Privacy Law Library

Student Data Privacy Protection Act

SDPPA

Students · Children · Data security · Marketing

Delaware's K-12 ed-tech privacy law bars operators of school-focused online services from using student data for targeted advertising, building non-school profiles, selling student data, or disclosing it except for listed school, legal, safety, or service-provider purposes. Operators must meet state cloud-hosting security standards and delete student data within 45 days when a school asks.

Where
Delaware
Citation
14 Del. C. §§ 8101A to 8106A (Title 14, Chapter 81A)
Status
In force
In force since
2016-08-01
Last amended
2016-08-01
Enforced by
Consumer Protection Unit, Delaware Department of Justice (8103A)
People can sue
No
Penalties
Enforced by the Department of Justice under 29 Del. C. ch. 25, subch. II (8103A); no specific penalty amount stated in the chapter.
Applies to
  • Operators (other than the Department of Education, school districts, and schools) of websites, online or cloud services, and apps used primarily for and designed and marketed for K-12 school purposes, or that collect, maintain, or use student data for K-12 school purposes (8102A(10))
  • Does not apply to general-audience sites and apps (8106A(1))

Practices it requires

  • Delete a student's data within 45 calendar days when a school district or school requests deletion of data under its control.14 Del. C. § 8104A(2)
  • Do not use information acquired through the K-12 service for targeted advertising on any site or app, or to build a student profile except for K-12 school purposes.14 Del. C. § 8105A(1)-(2)
  • Do not sell student data (acquisitions of the operator excepted if the successor stays bound).14 Del. C. § 8105A(3)
  • Disclose student data only for K-12 school purposes, legal requirements, security or safety, legitimate research, or to service providers contractually barred from other uses and onward disclosure.14 Del. C. § 8105A(4)-(5)

Security duties

  • Maintain reasonable security procedures appropriate to student data that at minimum comply with the Department of Technology and Information's Cloud and Offsite Hosting Policy.14 Del. C. § 8104A(1)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Effective date of 80 Del. Laws c. 335's amendments assumed to coincide with the chapter's Aug. 1, 2016 start; not confirmed.

Research reference, not legal advice.