Privacy Law Library

Student Online Personal Information Protection

Iowa Student Online Privacy Law

Students · Children · Data security · Marketing

Iowa's student online privacy law bars K-12 edtech operators from using student information for targeted advertising, building non-school profiles, selling or renting student information, or disclosing it except for listed purposes. Operators must also secure covered information and delete it when a school district asks.

Where
Iowa
Citation
Iowa Code 279.71 (enacted as 279.70 by 2018 Acts ch. 1042)
Status
In force
In force since
2018-07-01
Enforced by
Not specified in the section
People can sue
No
Penalties
The section contains no penalty or enforcement provision.
Applies to
  • Operators of internet sites, online services, and online or mobile applications with actual knowledge that the service is used primarily for K-12 school purposes and was designed and marketed for such purposes (279.71(1)(e))
  • Does not apply to general audience sites or apps, app stores, or interactive computer service providers for third-party content (279.71(6))

Rights it gives people

  • Delete a student's covered information as soon as reasonably practicable when the school district or attendance center requests it, unless the student or parent consents to keeping it.Iowa Code 279.71(3)(b)

Practices it requires

  • Do not engage in targeted advertising based on information acquired through use of the K-12 service, on the operator's service or elsewhere.Iowa Code 279.71(2)(a)(1)
  • Do not use information, including persistent identifiers, to amass a profile about a student except for K-12 school purposes.Iowa Code 279.71(2)(a)(2)
  • Do not sell or rent a student's information, except in a merger or acquisition that keeps the protections or for national assessment providers with express written consent.Iowa Code 279.71(2)(a)(3)
  • Disclose covered information only for listed purposes such as the K-12 purpose, legal compliance, judicial process, safety and security, requests by the student or parent, or to contractors bound to equal protections.Iowa Code 279.71(2)(a)(4)

Security duties

  • Maintain security procedures consistent with current industry standards to protect covered information from unauthorized access, destruction, use, modification, or disclosure.Iowa Code 279.71(3)(a)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Research reference, not legal advice.