(1) use information, including covered information, created or gathered by the operator’s online education service, to amass a profile about a student for any purpose other than K-12 school purposes. A profile shall not include the collection and retention of account information that remains under the control of the student, the student’s parents or guardian, or K-12 school;

(2) sell or rent a student’s information, including covered information. This paragraph shall not apply to the purchase, merger, or other type of acquisition of an operator by another entity if the operator or successor entity complies with this section concerning previously acquired student information, including covered information, or to national assessment providers if the provider secures express written consent of the student or the student’s parent or guardian, given in response to clear and conspicuous notice, solely to provide access to employment, educational scholarships, financial aid, or postsecondary educational opportunities;

(3) disclose covered information unless the disclosure is:

(a) made in furtherance of the K-12 school purposes purpose of the service, provided the recipient of the covered information shall not further disclose the information unless done to allow or improve the operability and functionality of the operator’s online education service;

(b) required by federal or State law to protect against liability;

(c) made to respond to or participate in a judicial process;

(d) to protect the safety of students or security of the service;

(e) for educational or employment purposes requested by the student’s parent or guardian, provided that the covered information is not used or further disclosed for any other purpose not requested by the student’s parent or guardian;

(f) to a third party if the operator contractually prohibits the third party from using any covered information for any purpose other than providing the contracted service to or on behalf of the operator, prohibits the third party from disclosing any covered information provided by the operator with subsequent third parties, and requires the third party to implement and maintain reasonable security procedures and practices; or

(g) for legitimate research purposes, subject to the requirements of paragraphs (1) through (3) of this subsection:

(i) as required by federal or State law and subject to the restrictions of the application of federal or State law;

(ii) as allowed by federal or State law and under the direction of a K-12school, school district, or the Department of Education, if no covered information is used for any purpose in furtherance of advertising or to amass a profile on the student for any purpose that is not in furtherance of a K-12 school purpose; or

(iii) for use by a federal, State, or local educational agency, including K-12 schools and school districts, for K-12 school purposes, as permitted by federal or State law; and

(4) engage in targeted advertising on the operator’s service, or target advertising on any other Internet website, online service, online computer application, or mobile application if the targeted advertising is based on any information, including covered information, that the operator’s service has acquired because of the use of the operator’s service for K-12 school purposes.

b. Nothing in this section shall be construed to prohibit the operator’s use of covered information for maintaining, developing, supporting, diagnosing, or improving the operator’s online education service.

L.2017, c.494, s.2.