California has significantly expanded its student privacy laws through Assembly Bill 1159 (AB 1159), including by restricting the use of student data to train or develop artificial intelligence systems.
Signed into law in September 2026, the legislation amends and expands two existing California student privacy laws:
- The K-12 Pupil Online Personal Information Protection Act (KOPIPA)
- The Early Learning Personal Information Protection Act (ELPIPA)
AB 1159 also creates a new Higher Education Student Information Protection Act (HESIPA). Together, the laws establish parallel privacy protections for students from preschool through higher education.
The amendments take effect on January 1, 2027, for preschool and K-12. HESIPA is operative on July 1, 2027.
For companies serving California schools and students, AB 1159 expands which businesses and data are covered while sharply limiting how student information can be used, particularly in connection with AI training. Companies should examine their products, data practices, AI systems, and retention policies now to determine whether practices that were previously permissible will need to change before the law takes effect.
AB 1159 Expands the Definition of Covered Operators
For K-12 services, KOPIPA applies to an operator of an online service that has actual knowledge that the service is used for K-12 school purposes and is designed or marketed for those purposes. AB 1159 expands this definition by eliminating the requirement that the service be used primarily for K-12 purposes and replacing the "designed and marketed" for K-12 purposes prong with "designed or marketed."
The law also extends the definition of "operator" to an entity working on behalf of an operator and expressly includes providers of digital educational software or services, including digital course books. ELPIPA and HESIPA contain substantially similar definitions tailored to their respective educational settings.
New Restrictions on AI Training and Sensitive Student Data
AB 1159 prohibits covered operators from knowingly using covered information—including persistent unique identifiers—created or gathered through the covered service to train a generative AI system or service or develop an AI system.
The statute also prohibits operators from processing covered information relating to a student's reproductive or sexual health; immigration status; or sexual orientation or gender identity. For higher education students, precise geolocation information is included in this prohibition.
Restrictions on Advertising, Profiling, and the Sale of Student Data
AB 1159 expands existing limits on the commercial use of student information. Subject to exceptions, operators may not:
- Sell student information,
- Use information acquired through the educational service for targeted advertising, including targeted advertising delivered by email or other direct communications, or
- Profile students using information collected through the service, except for specified educational purposes.
New Data Retention and Deidentification Requirements
AB 1159 requires operators to retain covered information only as long as reasonably necessary to fulfill the specific purpose for which it was collected and to delete the information when that purpose has been accomplished, subject to specified exceptions for certain student records.
Operators must also establish a written data retention policy. For K-12 operators, the retention period may not exceed the retention period used by the school.
The new law also imposes detailed requirements on information treated as deidentified, including safeguards against reidentification and contractual restrictions on recipients. Operators must make their deidentification processes available for review.
Student Access and Deletion Rights
AB 1159 expands access and deletion rights for certain student information excluded from the California Consumer Privacy Act (CCPA), with similar rights applying broadly.
AB 1159 Creates a Private Right of Action
AB 1159 incorporates private rights of action. Available remedies include the greater of actual damages or $500 per plaintiff, per violation, as well as injunctive relief, punitive damages, and reasonable attorneys' fees and costs. At least 60 days before filing suit, the operator must receive written notice describing the alleged violation and a demand to correct and remedy it.
How Companies Can Prepare for AB 1159
Companies that process data from California students should review the requirements of AB 1159 with several considerations in mind.
- Determine whether your company is an "operator" under the expanded definition. Companies that market their services as being designed for the education space may be captured in California, even if not subject to student privacy laws in other states.
- Assess and update any generative AI uses that involve student data. "Covered information" is now prohibited from training or developing generative AI systems.
- Review any collection of newly designated sensitive data categories. These include reproductive or sexual health, immigration status, sexual orientation or gender identity, and precise geolocation (higher ed only).
- Establish a written data retention policy, if you do not have one, or review and align existing policies with AB 1159 requirements.
If you have any questions or need help with determining AB 1159 requirements, please contact Kelly DeMarchis Bastide or Arlyn Upshaw or visit Venable's Privacy and Data Security center to help ensure your organization is prepared.