Privacy Law Library

Student Online Personal Information Protection Act

Florida SOPIPA

Students · Children

Enacted by SB 662 (2023), this is Florida's version of California's SOPIPA. It bars K-12 edtech operators from targeted advertising, building student profiles for non-school purposes, and selling or renting student information, and requires data minimization, reasonable security, and deletion of student data after the course ends.

Where
Florida
Citation
Fla. Stat. 1006.1494
Status
In force
In force since
2023-07-01
Enforced by
Florida Department of Legal Affairs (Attorney General), exclusively, under FDUTPA
People can sue
No
Penalties
Any violation is a deceptive and unfair trade practice under FDUTPA (part II of ch. 501), enforceable only by the Department of Legal Affairs (1006.1494(7)).
Applies to
  • Operators of websites, online services, and apps that know the service is used primarily for K-12 school purposes, or that designed and marketed it for K-12 school purposes (1006.1494(1)(e))
  • Does not apply to general-audience sites and apps, app stores, or interactive computer services policing third-party content (1006.1494(6)(c), (f)-(g))

Practices it requires

  • Disclose covered information only for listed purposes, such as the school purpose, legal compliance, safety, or to contractors bound not to use or re-disclose it and to keep it secure.Fla. Stat. 1006.1494(2)(d)
  • Do not use covered information to build a student profile except for K-12 school purposes.Fla. Stat. 1006.1494(2)(b)
  • Do not share, sell, or rent students' information, with limited exceptions for mergers and for consented national assessment providers.Fla. Stat. 1006.1494(2)(c)
  • Do not engage in targeted advertising to students based on information acquired through the K-12 service.Fla. Stat. 1006.1494(2)(a)
  • Collect no more covered information than reasonably necessary to operate the service.Fla. Stat. 1006.1494(3)(a)
  • Unless a parent expressly consents to retention, delete a student's covered information at the end of the course or program and no later than 90 days after the student leaves the district, upon district notice.Fla. Stat. 1006.1494(3)(c)

Security duties

  • Implement and maintain reasonable security procedures and practices to protect covered information.Fla. Stat. 1006.1494(3)(b)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Research reference, not legal advice.