Student Data Protections for Cloud Computing Service Providers
KY Student Cloud Data
Students · Children
Limits how cloud service providers serving K-12 schools may use student data, such as names, emails, messages, documents, and photos. Providers may use it only to provide and maintain the service unless a parent expressly permits more, and may never use it for advertising, ad profiling, sale, or other commercial purposes.
- Where
- Kentucky
- Citation
- KRS 365.734 (enacted 2014 Ky. Acts ch. 84, sec. 2)
- Status
- In force
- In force since
- 2014-07-15
- Enforced by
- Not specified; the Kentucky Board of Education may issue implementing regulations
- People can sue
- No
- Penalties
- The section states no penalty or enforcement mechanism.
- Applies to
- Any person other than an educational institution that operates an account-based online computing service marketed and designed for public or private K-12 schools and school administrative units
Practices it requires
- Process student data only to provide, improve, develop, or maintain the integrity of the cloud service, unless the student's parent gives express permission; FERPA-permitted educational research assistance is allowed.KRS 365.734(2)
- Never process student data for advertising or to build individual or household advertising profiles, and never sell, disclose, or process it for any commercial purpose.KRS 365.734(2)
Other duties
- Certify in writing to each contracting educational institution that the provider will comply with the use restrictions.KRS 365.734(3)
Sources
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Research reference, not legal advice.