Regulon.AI — IL-SB-3735 · IL SB 3735 (Ed-Tech Rights / Biometric Info)

Summary

IL SB 3735 creates the Student Educational Technologies Rights Act and amends the School Code and the Student Online Personal Protection Act (SOPPA). The new Act establishes state policy that students and parents have the right to opt out of school-issued electronic devices and assignments, request human teacher review of AI-generated grades, and opt out of predictive analytics without academic penalty. The School Code amendments prohibit school districts from purchasing or acquiring biometric systems (including facial recognition) for use on students, require destruction of existing student biometric data within 30 days, and bar third-party agreements for biometric data. SOPPA amendments expand the definition of 'covered information' to include AI-derived data and digital replicas, prohibit operators from permitting AI training on covered information except for K-12 school purposes, and require written parental or student consent before an operator's AI model may train on and indefinitely retain a student's covered information. Enforcement is through the Attorney General under existing SOPPA authority; no private right of action is created.

Enforcement & Penalties

Enforcement Authority

No private right of action is created by this bill. Enforcement of the Student Online Personal Protection Act amendments is by the Attorney General under existing 105 ILCS 85/30. Enforcement of the School Code biometric provisions and the new Student Educational Technologies Rights Act is through existing State Board of Education oversight and school district compliance mechanisms. No new enforcement authority or mechanism is established.

Penalties

The bill does not specify monetary penalties, statutory damages, or remedies. Existing enforcement under 105 ILCS 85/30 provides for Attorney General enforcement of the Student Online Personal Protection Act. No damages provisions are created by this bill.

Who Is Covered

"Operator" means, to the extent that an entity is operating in this capacity, the operator of an Internet website, online service, online application, or mobile application, or artificial intelligence model with actual knowledge that the site, service, or application, or model is used primarily for K through 12 school purposes and was designed and marketed for K through 12 school purposes.

"School" means (1) any preschool, public kindergarten, elementary or secondary educational institution, vocational school, special educational facility, or any other elementary or secondary educational agency or institution or (2) any person, agency, or institution that maintains school student records from more than one school.

Compliance Obligations 7 obligations · click obligation ID to open requirement page

H-01 Human Oversight of Automated Decisions · H-01.4 · Government · EducationMinors

Student Educational Technologies Rights Act § 15(a)(2)

Plain Language

Students and their parents have the right to request that a human teacher review any grade that was scored automatically or generated by AI. This creates a right to human review of automated educational decisions. Schools must honor such requests, though the statute does not specify a timeframe for completing the review.

Statutory Text

It is the policy of this State that a student and the student's parent have the right to: (2) request a human teacher review any automated scored grade or scored grade generated by artificial intelligence;

D-01 Automated Processing Rights & Data Controls · D-01.3 · Government · EducationMinors

Student Educational Technologies Rights Act § 15(a)(1), (a)(3), (b)

Plain Language

Students and parents have the right to opt out of school-issued electronic devices, electronic textbooks, electronic assignments, and predictive analytics systems. Opting out of predictive analytics may not result in academic penalty. When a student or parent exercises any of these opt-out rights, the school must provide a comparable analog alternative — such as paper assignments, physical textbooks, or physical copies of required reading. This creates an affirmative obligation on schools to maintain non-digital alternatives.

Statutory Text

(a) It is the policy of this State that a student and the student's parent have the right to: (1) opt out of school-issued personal electronic devices, electronic textbooks, electronic required reading, or electronic or online assignments; (3) opt out of predictive analytics systems without academic penalty. (b) If a student or a student's parent exercises the right outlined in subsection (a), the school shall provide the student with a comparable analog version of what the educational technology provides. As used in this subsection, "comparable analog version" includes, but is not limited to, providing the assignment on physical paper, a physical copy of the required reading, or the option of a physical paper textbook.

S-02 Prohibited Conduct & Output Restrictions · S-02.2 · Government · EducationBiometricsMinors

105 ILCS 5/10-20.40(b), (b-5)

Plain Language

School districts are categorically prohibited from purchasing, acquiring, or otherwise obtaining biometric systems — including facial recognition software — for use on students. The prohibition extends beyond direct acquisition to bar school districts from obtaining, retaining, possessing, accessing, requesting, or using biometric systems or biometric information derived from such systems with respect to students. School districts also may not enter into third-party agreements to circumvent this prohibition. This is a complete ban on student-facing biometric surveillance in the school district context, replacing the prior regime that permitted collection subject to policy safeguards.

Statutory Text

(b) A school district is prohibited from purchasing or otherwise acquiring biometric systems, including facial recognition software, to use on students. (b-5) A school district may not do any of the following with respect to students: (1) Obtain, retain, possess, access, request, or use biometric systems or biometric information derived from biometric systems. (2) Enter into an agreement with a third party for the purpose of obtaining, retaining, possessing, accessing, or using, by or on behalf of the school district, biometric systems, including facial recognition software or biometric information derived from biometric systems.

Other · EducationBiometricsMinors

105 ILCS 5/10-20.40(b-10), (b-15), (b-20), (d)

Plain Language

School districts that possess student biometric information must destroy it within 30 days of the Act's effective date and provide certified proof of destruction to the State Board of Education. Districts that contracted with third parties for biometric data collection or storage must require those third parties to destroy the data and confirm destruction in writing. During the 30-day wind-down period, districts may not sell, lease, or disclose biometric information except with custodial consent or by court order. The Local Records Act's approval requirements are waived for destruction during this period. The identical obligation applies to the Chicago School District under 105 ILCS 5/34-18.34(b-10) through (b-20).

Statutory Text

(b-10) Within 30 days after the effective date of this amendatory Act of the 104th General Assembly, if a school district is in possession of student biometric information, then the school district shall destroy the biometric information and provide certified documentation of destruction to the State Board of Education. (b-15) Within 30 days after the effective date of this amendatory Act of the 104th General Assembly, any school district that has contracted with a third party to obtain, collect, or store student biometric information shall require the third party to destroy the biometric information in its possession and confirm in writing the completion of this destruction to the school district. (b-20) During the 30-day period in which a school district may still have student biometric information in its possession under subsection (b-10), the school district is prohibited from selling, leasing, or otherwise disclosing the biometric information to another person or entity unless: (1) the individual who has legal custody of the student or the student, if he or she has reached the age of 18, consents to the disclosure; or (2) the disclosure is required by court order. (d) Student biometric information may be destroyed without notification to or the approval of a local records commission under the Local Records Act if destroyed within 30 days after the effective date of this amendatory Act of the 104th General Assembly.

D-01 Automated Processing Rights & Data Controls · D-01.4 · Deployer · EducationMinors

105 ILCS 85/10(3), (3.5)

Plain Language

Ed-tech operators may not sell or rent student information or data — including covered information or any other person's information collected for K-12 school purposes. Separately, operators may not permit AI to train on covered information unless the training is for K-12 school purposes or to improve the operability and functionality of the operator's own service. The sale/rent prohibition has a narrow carve-out for corporate acquisitions where the successor entity continues to comply with the Act. The definition of covered information has been expanded to include data gathered through AI and digital replicas.

Statutory Text

(3) Sell or rent a student's information or data, including covered information or any other person's information collected by the operator for K through 12 school purposes. This subdivision (3) does not apply to the purchase, merger, or other type of acquisition of an operator by another entity if the operator or successor entity complies with this Act regarding previously acquired student information. (3.5) Permit artificial intelligence to train on covered information unless for K through 12 school purposes or in furtherance of improving operability and functionality of the operator's service.

D-01 Automated Processing Rights & Data Controls · D-01.4 D-01.8 · Deployer · EducationMinors

105 ILCS 85/15(2), 105 ILCS 85/10(4)(A)

Plain Language

An operator's AI model may not train on a student's covered information and retain that training data indefinitely unless the operator first provides written notice to the student or parent that data will be retained indefinitely, and obtains written consent. This is an affirmative opt-in consent requirement — the default is that indefinite retention of training data derived from student covered information is prohibited. The consent must be obtained before the training and retention occurs. This requirement also limits the 'improving operability' exception in Section 10(4)(A): disclosing covered information to third parties to train AI that is not for K-12 school purposes does not qualify as improving operability, even with consent.

Statutory Text

An operator's artificial intelligence model shall not train on a student's covered information and retain the training data indefinitely, unless it first: (A) informs the student or his or her parent in writing that the operator's artificial intelligence model will retain training data indefinitely; and (B) receives a written consent from the student or his or her parent.

D-01 Automated Processing Rights & Data Controls · D-01.4 · Deployer · EducationMinors

105 ILCS 85/10(4)(A)

Plain Language

Operators may disclose covered information for K-12 school purposes, but the recipient may not further disclose it except to improve the operator's own service operability. Critically, the 'improving operability' exception is now explicitly limited: disclosing covered information to any third party for the purpose of training AI that is not for K-12 school purposes does not qualify as improving operability. This prevents operators from using the operability exception as a loophole to feed student data into general-purpose AI training pipelines.

Statutory Text

(A) In furtherance of the K through 12 school purposes of the site, service, application, or model if the recipient of the covered information disclosed under this clause (A) does not further disclose the information, unless done to allow or improve operability and functionality of the operator's site, service, or application. Improving operability does not include disclosing covered information to any third party to train artificial intelligence that is not for K through 12 school purposes.