Regulon — MO-HB-3281 · MO HB 3281 (PROTECT Students Act)

WHAT THIS BILL REGULATES · 9 REQUIREMENT TYPES

How Is This Bill Enforced

Enforcement Authority

Attorney general enforcement authority. Parents may submit written complaints to the state board of education; meritorious complaints may be referred to the attorney general for investigation and enforcement. The attorney general may also initiate investigations independently. The state board of education monitors and enforces compliance through periodic audits of contracting entities and vendors. A cure period is available for vendor violations under timelines established by rule.

Private Right of Action

No private right of action. Enforcement is exclusive to the designated authority.

Penalties

A court may impose civil fines or penalties for violations, including graduated penalties for repeated or willful violations. The court may award reasonable attorney's fees, investigative costs, and litigation expenses to the state. Injunctive relief, court orders requiring corrective action, compliance plans, or cessation of unlawful practices are available. Contracting entities face withholding of state technology funds. Vendors may be barred from new contracts for up to twenty-four months.

Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.

Statutory Text

Analysis & Obligations

§ 160.071(1)–(2)

Short title and definitions

(1) This section shall be known and may be cited as the "PROTECT Students Act".

(2) As used in this section, the following terms mean: (1) "Addictive design feature", any feature or component of a digital or online product that encourages or increases a student's frequency, time spent, or engagement with the product including, but not limited to: (a) Infinite scroll or autoplay; (b) Points, badges, or other gamification rewards tied to time spent on the product; (c) Persistent notifications or push alerts prompting reengagement when not actively in use; and (d) Personalized recommendation systems or addictive algorithms that promote extended or compulsive use; (2) "Contracting entity", a local educational agency or the Missouri state board of education; (3) "Digital privacy agreement", a required contract between a local educational agency and a digital provider that strictly governs access, use, protection, retention, and disclosure of student data and ensures compliance with applicable laws. Digital privacy agreements prohibit advertising use, profiling, resale, or any noneducational use of student data and termination clause; (4) (a) "Educational purpose", a purpose directly tied to: a. Instruction; b. Assessment; c. Student learning; or d. School operations necessary for instruction. (b) "Educational purpose" does not include: a. Marketing; b. Advertising; c. Behavioral profiling; or d. Any commercial purpose; (5) "Independently verified", a product that has been checked for its safety, effectiveness, and compliance by an impartial, separate third party who is not involved with its creation or management, ensuring objectivity and trust by removing potential bias from the original source; (6) "Instructional software": (a) Software that has successfully: a. Executed a digital privacy agreement; and b. Been verified for academic effectiveness, compliant with the provisions of this section; (b) Any instructional software that has not successfully completed the steps under paragraph (a) of this subdivision shall be deemed noncompliant software and shall not be used for student learning or school-sponsored activities in Missouri schools; (7) "Local educational agency", the same meaning as defined in section 167.225; (8) "School-issued device", any laptop, tablet, mobile device, or hardware provided to a student by a local educational agency for educational use; (9) (a) "Software", any application, web-based service, cloud application, mobile application, plug-in, or other code-based product, whether free or paid, that: a. Runs on or is accessed from a school-issued device, or from a student-owned device when used under the authority of a local educational agency; and b. Is assigned, required, recommended, installed, or otherwise made available by a local educational agency for student use in connection with: (i) Classroom instruction; (ii) A school-sponsored activity; or (iii) Any curricular, co-curricular, or extracurricular activity. (b) "Software" includes, without limitation, software used for instruction, assessment, communication, collaboration, enrichment, or recreation in connection with school-related purposes. (c) "Software" does not include the physical device itself; (10) "Student data", includes: (a) Personally identifiable information; (b) Metadata, device identifiers, and clickstream data; (c) Behavioral, engagement, or usage data; and (d) Information collected, generated, or inferred by the software during student use; (11) "Vendor", any company, developer, organization, or individual who provides software, digital tools, digital services, or related technology to a contracting entity for student use, whether free or paid.

Subsections 1 and 2 establish the short title — the PROTECT Students Act — and define eleven terms that govern the scope of the entire section. The definition of Software is notably broad, reaching any code-based product (free or paid) that runs on a school-issued or student-owned device under a local educational agency's authority. Student data extends well beyond PII to include metadata, behavioral signals, and any information inferred by the software during use. The bill creates a two-tier covered-entity structure: Vendors who supply the software, and Contracting entities (local educational agencies and the state board) who adopt it.

§ 160.071(3)

Vendor pre-deployment requirements and statewide digital privacy agreement

DeployerDeveloperGovernment

(3)(1) 1 Before any software may be installed, assigned, recommended, or otherwise made available for student use, the vendor shall: (a) Execute a statewide digital privacy agreement; and (b) Complete an independent review demonstrating that the software is academically effective.

(3)(2)(a)–(e) 2 The state board of education shall adopt a single statewide digital privacy agreement governing the use of software and digital services by students in Missouri public schools. (b) All vendors shall execute the statewide digital privacy agreement as a condition of providing software or digital services to any local educational agency or the state board of education. (c) The statewide digital privacy agreement shall not be altered, supplemented, replaced, modified, or negotiated by a vendor, local educational agency, or contracting entity. (d) Any vendor-proposed privacy agreement, end-user license agreement, click-through terms, terms of service, or substitute contract is void and unenforceable with respect to student data or student use. (e) The contracting entity shall execute the statewide digital privacy agreement before software may be installed, assigned, recommended, or otherwise made available for student use.

(3)(3) 3 The statewide digital privacy agreement shall incorporate and comply with state statutes governing data minimization, secondary use limitations, targeted advertising prohibitions, security safeguards, privacy notices, breach response, retention and deletion, and directory-information protections, where applicable.

(3)(4) 4 The statewide digital privacy agreement shall require full compliance with state statues and state board of education rules governing sensitive materials in schools. Software shall not display, recommend, algorithmically generate, link to, embed, or provide access to any material that: (a) Is pornographic; (b) Is harmful to minors; (c) Is indecent or obscene; (d) Contains descriptions or depictions of sexual conduct, sexual excitement, arousal, or stimulation; (e) Contains violent, graphic, or self-harm or suicidal content inconsistent with safety standards; or (f) Otherwise is prohibited under Missouri law.

(3)(5) 5 The statewide digital privacy agreement shall require that software shall not display, recommend, algorithmically generate, or provide access to any instructional or supplemental content that constitutes: a. Human sexuality instruction; b. Sexual education; c. Maturation instruction; d. Content relating to reproduction, contraception, sexual activity, or sexually transmitted diseases; or e. Sexual- or health-related information unless affirmative written parental consent has been obtained by the local educational agency in accordance with any rule or law. (b) Such requirement applies to core content, supplemental content, adaptive learning pathways, embedded media, hyperlinks, and AI-generated or AI-recommended content.

(3)(6)(a)–(b) 6 The statewide digital privacy agreement shall also include the following protections: (a) Software shall not require open-internet access for core educational functions. All external links, embedded media, and third-party content shall be reviewed and approved by the contracting entity; (b) Software shall not include: a. Infinite scroll; b. Auto-play video; c. Gamified reward loops unrelated to learning; or d. Behavioral nudges or engagement mechanics designed to increase screen time;

(3)(6)(c) 7 Vendors shall not collect, store, or analyze: a. Biometric identifiers; b. Behavioral or emotional signals; c. Voiceprints or keystroke dynamics; or d. Precise geolocation unless strictly necessary for the educational purpose and disclosed in the digital privacy agreement;

(3)(6)(d) 8 Software shall not: a. Use student data to train machine-learning models; b. Employ AI systems that analyze or influence a student's emotions, behavior, or attention; c. Generate or recommend content intended to shape student beliefs or preferences; d. Produce or enable content that circumvents Missouri laws relating to sensitive materials or instructional materials;

(3)(6)(e) 9 Software shall not: a. Display commercial or sponsored content; b. Use session replay, heat-mapping, or behavioral analytics; c. Create persistent identifiers; or d. Track students outside the educational purpose;

(3)(6)(f) 10 Vendors shall: a. Use encryption for data in transit and at rest; b. Store and process all student data within the United States; c. Disclose all subprocessors and obtain approval before use; and d. Prohibit background data collection when software is minimized or inactive;

(3)(6)(g) 11 Vendors shall disclose to the contracting entity: a. All data elements collected; b. All third-party recipients; c. All embedded libraries, software development kits, and analytics tools; d. All device-level permissions; and e. All AI components and functions;

(3)(6)(h)–(i) 12 Camera, microphone, and system-level access shall not be used unless strictly necessary for the educational function and disclosed in the digital privacy agreement; and (i) A vendor shall not condition access, features, pricing, or support on any form of usage quota or screen-time expectation.

(3)(7) The statewide digital privacy agreement shall include a termination-for-cause provision that: (a) Requires the vendor to cure any violation of the digital privacy agreement within a timeline established by rule; (b) Authorizes the contracting entity to terminate the contract if the vendor fails to cure the violation; (c) Provides that termination under this subdivision may occur without penalty, early-termination fee, or additional obligation to the contracting entity; (d) Requires the vendor to acknowledge that termination under this subdivision does not constitute a breach by the contracting entity; and (e) In order to protect students and ensure compliance with this section, authorizes the state board of education when a local educational agency does not cure or terminate a noncompliant contract within the required timeline to: a. Direct the contracting entity to terminate the contract; or b. Terminate the contracting entity's participation in the contract on its behalf.

(3)(8) 13 The independent review of academic effectiveness shall be performed by an evaluator that: a. Has no financial or contractual relationship with the vendor or any subsidiary of the vendor; b. Is not compensated by the vendor whose product is being reviewed; c. Uses transparent, publicly available evaluation methods; and d. Demonstrates expertise appropriate to the type of software being evaluated. (b) a. For purposes of this paragraph, "academic effectiveness" means: (i) Evidence, supported by independent studies, research, or evaluation, demonstrating that the software measurably improves student learning, skill development, or academic performance in the intended subject area; (ii) Alignment with Missouri core standards or state board of education–adopted standards for the relevant grade level or course; (iii) Demonstrated instructional value that meaningfully supplements or improves upon traditional, nondigital instructional practices; (iv) Absence of addictive design features that interfere with learning, distract from instruction, or reduce academic focus; and (v) Independent findings, based on transparent methodology, showing that the software produces positive, reliable, and replicable academic outcomes when used as intended in a classroom setting. b. Each evaluation of academic effectiveness shall include: (i) A description of the research or evaluation methods used; (ii) Identification of the student populations, grade levels, or instructional contexts evaluated; (iii) Evidence that the results were not produced, funded, or influenced by the vendor; (iv) Disclosure of any limitations in the evidence or methodology; and (v) A determination of whether the software provides educational value sufficient to justify classroom use. c. The state board of education shall maintain a public list of independent evaluators that meet the standards described in this subdivision. Inclusion on the list does not constitute endorsement of an evaluator's findings. d. Before software may be installed, assigned, recommended, or otherwise made available for student use, the contracting entity shall obtain documentation of an independent evaluation demonstrating that the software meets the academic-effectiveness standards described in this subsection.

Subsection 3 is the operative heart of the bill. It imposes two gatekeeping prerequisites on vendors before any software may reach students: execution of the statewide digital privacy agreement and completion of an independent academic-effectiveness review. It then specifies in granular detail the mandatory terms of the statewide digital privacy agreement — covering content restrictions, addictive-design prohibitions, data-collection limits, AI-specific prohibitions, security requirements, vendor disclosures, and termination-for-cause provisions. The state board of education is required to adopt a single statewide agreement that cannot be altered by any vendor or contracting entity, and all vendor-proposed substitute agreements are declared void.

The AI-specific prohibitions are notable: software may not use student data to train machine-learning models, may not employ AI that analyzes or influences student emotions, behavior, or attention, and may not generate or recommend content intended to shape student beliefs. The academic-effectiveness verification requirements are detailed, requiring independent evaluators with no vendor relationship and evidence of measurable positive academic outcomes.

Compliance actions 13 items

Vendors must execute the statewide digital privacy agreement and complete an independent academic-effectiveness review before any software may be installed, assigned, recommended, or otherwise made available for student use.

—

The state board of education must adopt a single statewide digital privacy agreement; all vendors must execute it as a condition of providing software; the agreement may not be altered by any party; and any vendor-proposed substitute contract is void and unenforceable with respect to student data or use. Contracting entities must execute the agreement before making software available for student use.

—

The statewide digital privacy agreement must incorporate and comply with state statutes governing data minimization, secondary use limitations, targeted advertising prohibitions, security safeguards, privacy notices, breach response, retention and deletion, and directory-information protections.

D-01.4

Vendors must ensure software does not display, recommend, algorithmically generate, link to, embed, or provide access to material that is pornographic, harmful to minors, indecent, obscene, contains sexual content, contains violent or self-harm or suicidal content inconsistent with safety standards, or is otherwise prohibited under Missouri law.

MN-01.6

Vendors must ensure software does not display, recommend, algorithmically generate, or provide access to instructional or supplemental content relating to human sexuality, sexual education, maturation, reproduction, contraception, sexual activity, sexually transmitted diseases, or sexual- or health-related information — including via AI-generated or AI-recommended content — unless affirmative written parental consent has been obtained by the local educational agency.

MN-01.6

Vendors must ensure software does not include infinite scroll, auto-play video, gamified reward loops unrelated to learning, or behavioral nudges or engagement mechanics designed to increase screen time. Software must not require open-internet access for core educational functions, and all external links, embedded media, and third-party content must be reviewed and approved by the contracting entity.

CP-01.2

Vendors must not collect, store, or analyze biometric identifiers, behavioral or emotional signals, voiceprints or keystroke dynamics, or precise geolocation unless strictly necessary for the educational purpose and disclosed in the digital privacy agreement.

D-01.4

Vendors must ensure software does not (1) use student data to train machine-learning models, (2) employ AI systems that analyze or influence a student's emotions, behavior, or attention, (3) generate or recommend content intended to shape student beliefs or preferences, or (4) produce or enable content that circumvents Missouri laws relating to sensitive materials or instructional materials.

S-02

Vendors must ensure software does not display commercial or sponsored content, use session replay, heat-mapping, or behavioral analytics, create persistent identifiers, or track students outside the educational purpose.

D-01.4

Vendors must use encryption for data in transit and at rest, store and process all student data within the United States, disclose all subprocessors and obtain contracting entity approval before use, and prohibit background data collection when software is minimized or inactive.

D-01.4

Vendors must disclose to the contracting entity all data elements collected, all third-party recipients, all embedded libraries, software development kits, and analytics tools, all device-level permissions, and all AI components and functions.

T-03.3

Vendors must not use camera, microphone, or system-level access unless strictly necessary for the educational function and disclosed in the digital privacy agreement, and must not condition access, features, pricing, or support on any form of usage quota or screen-time expectation.

D-01.4

Vendors must complete an independent academic-effectiveness review by a qualified evaluator with no financial relationship to the vendor, using transparent and publicly available methods. The evaluation must demonstrate measurable improvement in student learning, alignment with Missouri standards, absence of addictive design features, and positive, reliable, and replicable academic outcomes. Contracting entities must obtain the evaluation documentation before software is made available for student use.

G-01.5

§ 160.071(4)

Statewide master list of software

Government

(4)(1)–(2) 14 The state board of education shall create and maintain a statewide master list of software used by students in Missouri public schools. The master list is a transparency tool and does not constitute an approval or endorsement by the state board. (2) (a) Software shall be placed on the master list when the contracting entity has: a. Executed the statewide digital privacy agreement required under subsection 3 of this section; and b. Obtained the academic-effectiveness verification required under subsection 3 of this section. (b) Completion of the requirements under paragraph (a) of this subdivision shall be met before student use.

(4)(3)–(4) 15 The contracting entity shall: a. Execute the statewide digital privacy agreement for any software it adopts; b. Obtain the academic-effectiveness verification; and c. Submit the digital privacy agreement, verification, and required software information to the state board of education for listing. (b) Local educational agencies shall continue to maintain their local software inventory. (4) (a) The state board of education shall: a. Receive documentation submitted by contracting entities; b. Publish and update the statewide master list on an ongoing basis; and c. Conduct compliance audits as provided in this subsection. (b) The state board of education does not approve or certify software and is not responsible for a local educational agency's contracting decisions.

Subsection 4 requires the state board of education to create and maintain a statewide master list of all software used by students in Missouri public schools. The list functions as a transparency tool — not an approval or endorsement mechanism. Software may only be placed on the list after the contracting entity has executed the statewide digital privacy agreement and obtained academic-effectiveness verification. Contracting entities bear the responsibility for executing agreements, obtaining verifications, and submitting documentation to the state board. Local educational agencies must also continue to maintain their own local software inventories.

Compliance actions 2 items

The state board of education must create and maintain a statewide master list of all software used by students in Missouri public schools as a public transparency tool. Software may only be listed after the contracting entity has executed the statewide digital privacy agreement and obtained academic-effectiveness verification, and these requirements must be met before student use.

PS-01.1

Contracting entities must execute the statewide digital privacy agreement, obtain academic-effectiveness verification, and submit all documentation to the state board of education for listing for each software product adopted. Local educational agencies must also maintain their local software inventory. The state board must publish and update the statewide master list on an ongoing basis and conduct compliance audits.

PS-01.1

§ 160.071(5)

Compliance monitoring and enforcement audits

DeveloperGovernment

(5)(1)–(4) 16 The state board of education shall monitor and enforce compliance with this section through periodic audits of contracting entities and software vendors. (2) (a) The state board of education shall audit each local education agency to confirm that, for every software product used by students, the local educational agency has: a. Executed the statewide digital privacy agreement required under subsection 3 of this section; and b. Obtained the academic-effectiveness verification required under subsection 3 of this section. (b) Audits shall occur at least once every three years, with additional spot checks as needed. (3) As part of the audit process, the state board of education shall review vendor compliance with: (a) The statewide digital privacy agreement; and (b) The academic-effectiveness verification requirements established under subsection 3 of this section. (4) As part of vendor compliance reviews under subdivision (3) of this subsection, the state board of education shall verify whether the vendor discloses student data to unauthorized third parties in violation of the statewide digital privacy agreement or any rule or law.

(5)(5)–(7) 17 Contracting entities and vendors shall provide the state board of education access to all records, documents, and data necessary to complete compliance audits and vendor reviews. (6) Following each audit, the state board of education shall issue a written compliance report identifying: (a) Findings of noncompliance; (b) Required corrective actions; and (c) Applicable timelines for remediation. (7) The state board of education may publish summary audit findings to support statewide transparency and allow parents and the public to identify compliant and noncompliant practices.

Subsection 5 establishes the state board of education's compliance monitoring and enforcement framework. The board must conduct periodic audits of every local educational agency at least once every three years, with spot checks as needed, to confirm that each software product in use has the required digital privacy agreement and academic-effectiveness verification. Vendor compliance is also reviewed as part of these audits, including verification of whether vendors are disclosing student data to unauthorized third parties. Both contracting entities and vendors must provide the board with access to all records needed for audits. Written compliance reports must be issued after each audit, identifying findings, corrective actions, and remediation timelines.

Compliance actions 2 items

The state board of education must audit each local educational agency at least once every three years, with spot checks as needed, to confirm compliance with statewide digital privacy agreement and academic-effectiveness verification requirements. The board must also review vendor compliance, including verification of unauthorized third-party data disclosures.

G-01.4

Contracting entities and vendors must provide the state board of education access to all records, documents, and data necessary for compliance audits and vendor reviews. Following each audit, the state board must issue a written compliance report identifying noncompliance findings, required corrective actions, and remediation timelines. The board may publish summary audit findings for public transparency.

R-02.2

§ 160.071(6)

Noncompliance and enforcement actions

DeveloperGovernment

(6)(1)–(2) 18 A local educational agency is out of compliance with this section if the local educational agency: (a) Uses or assigns software for student use without a fully executed statewide digital privacy agreement; or (b) Uses or assigns software for student use without obtaining the academic-effectiveness verification required under subsection 3 of this section. (2) Upon finding a local educational agency is in noncompliance, the state board of education shall require the local educational agency to: (a) Discontinue use of the noncompliant software; (b) Remedy the deficiency by executing the statewide digital privacy agreement or obtaining the academic-effectiveness verification; (c) Implement a corrective-action plan to prevent future violations; and (d) Comply with any withholding of state technology funds imposed by the state board of education until corrective action is completed.

(6)(3)–(5) 19 A vendor is out of compliance with this section if the vendor: a. Violates any term of the statewide digital privacy agreement; or b. Provides false, misleading, or incomplete academic-effectiveness documentation. (b) Vendor violations under this subdivision are limited to violations of the statewide digital privacy agreement or the independent-verification requirements. (4) Upon finding vendor noncompliance, the contracting entity may: (a) Require the vendor to cure the violation within a timeline established by rule; (b) Terminate the contract under the terms of the digital privacy agreement if the vendor fails to cure the violation; and (c) Bar the vendor from entering into new contracts with that contracting entity for up to twenty-four months. (5) (a) If a local privacy agreement does not cure or terminate a noncompliant contract within the timeline required by rule, the state board of education may: a. Direct the contracting entity to terminate the contract; or b. Terminate the contracting entity's participation in the contract on its behalf, if necessary to protect students and ensure compliance with this section. (b) The authority under this subdivision applies only after a violation and does not include preapproval or certification of software.

(6)(6) A parent or guardian may submit a written complaint to the state board of education alleging: a. Use of software without a statewide digital privacy agreement; b. Use of software without required academic-effectiveness verification; or c. A vendor's violation of the statewide digital privacy agreement. (b) Upon receiving a complaint, the state board of education shall: a. Review the complaint; b. Determine whether a violation has occurred; c. Notify the parent of the determination; and d. Take appropriate enforcement action under this section if noncompliance is found. (c) The state board of education shall adopt rules establishing procedures and timelines for parent complaints submitted under this subdivision.

(6)(7) Teachers, school employees, and staff acting within the normal course of duties shall not be held personally responsible for the noncompliance with this section by a local educational agency.

(6)(8) A local educational agency or vendor may appeal a finding of noncompliance or enforcement actions imposed under this subsection through the administrative process established by the state board of education.

Subsection 6 establishes the enforcement consequences for both local educational agencies and vendors. An LEA is out of compliance if it uses software without a fully executed digital privacy agreement or without academic-effectiveness verification. Consequences include discontinuation of noncompliant software, corrective-action plans, and withholding of state technology funds. Vendor noncompliance triggers cure periods, contract termination, and potential debarment from new contracts for up to twenty-four months. The state board retains backstop authority to directly terminate contracts when an LEA fails to act. A parent complaint mechanism is established, with procedures and timelines to be set by board rule. Teachers and staff are protected from personal liability for institutional noncompliance.

Compliance actions 2 items

Local educational agencies must not use or assign software for student use without a fully executed statewide digital privacy agreement and academic-effectiveness verification. Upon a finding of noncompliance, the agency must discontinue the software, remedy the deficiency, implement a corrective-action plan, and comply with any withholding of state technology funds.

—

Vendors are out of compliance if they violate any term of the statewide digital privacy agreement or provide false, misleading, or incomplete academic-effectiveness documentation. Contracting entities may require vendors to cure violations, terminate contracts, and bar vendors from new contracts for up to twenty-four months. If a contracting entity fails to act, the state board of education may direct or execute contract termination on the entity's behalf.

—

§ 160.071(7)

Phase-in period for existing contracts

(7)(1)–(5) All existing software contracts used by students in Missouri public schools shall be brought into compliance with this section within twenty-four months of the effective date of this section. (2) The state board of education shall provide: (a) Technical guidance to local educational agencies and vendors regarding the transition to the statewide digital privacy agreement and academic-effectiveness requirements; and (b) Implementation timelines and instructions necessary for contracting entities to achieve full compliance. (3) During the phase-in period, local educational agencies may continue to use existing software contracts, provided that the contracting entity is actively working toward compliance with the statewide digital privacy agreement and academic-effectiveness requirements. (4) The state board may prioritize technical guidance and transition support for: (a) Software used across multiple local educational agencies; (b) Statewide or consortium contracts; or (c) Software with known privacy, safety, or effectiveness concerns. (5) The phase-in period does not waive the requirements of this section. All software shall meet compliance requirements within twenty-fours months after the effective date of this section.

Subsection 7 provides a twenty-four-month phase-in period for all existing software contracts to come into compliance. During this period, local educational agencies may continue using existing software provided they are actively working toward compliance. The state board must provide technical guidance and implementation timelines, and may prioritize support for widely-used software, consortium contracts, and software with known concerns. The phase-in period does not waive the section's requirements — all software must meet compliance requirements within twenty-four months.

§ 160.071(8)

Parent transparency and notification requirements

Government

(8)(1) 20 Each local educational agency shall provide parents and guardians with an annual list of all instructional software products that: a. Have a fully executed statewide digital privacy agreement; b. Have completed the required independent academic-effectiveness verification under subsection 3 of this section; and c. Will be assigned, required, recommended, or otherwise made available for student use during the upcoming school year. (b) The list shall include, at a minimum: a. The product name and vendor; b. The product's primary instructional purpose; and c. A link to the product's statewide digital privacy agreement and academic-effectiveness verification summary. (c) The list shall be: a. Published on the local educational agency's public website in an easily accessible, searchable format; and b. Updated within ten business days of any addition or removal of a software product.

(8)(2) 21 If any new instructional software product is added during the school year that was not included in the annual list, the local educational agreement shall: (a) Provide written notice to parents within five school days of the product's approval; (b) Include links to the product's statewide digital privacy agreement and academic-effectiveness verification summary; and (c) Provide this notice prior to assigning the software or making it available for student use.

(8)(3) 22 Local educational agencies shall provide parents with timely written notice of any significant software update or change in data-collection or data-sharing practices that: a. May affect compliance with the statewide digital privacy agreement; or b. May trigger new consent requirements under state or federal law. (b) Local educational agencies shall maintain a publicly accessible archive of instructional software previously used by students, including: a. The product name and vendor; and b. The dates during which the product was in active use for a minimum of two years after the software is retired.

Subsection 8 imposes detailed transparency obligations on local educational agencies toward parents and guardians. Each LEA must annually publish on its website a searchable list of all instructional software products with executed digital privacy agreements and academic-effectiveness verification, including product names, vendors, instructional purposes, and links to agreements and verification summaries. The list must be updated within ten business days of changes. Mid-year additions require five-school-day written notice to parents before the software is assigned. LEAs must also notify parents of significant changes to data-collection or data-sharing practices and maintain a publicly accessible two-year archive of retired software.

Compliance actions 3 items

Local educational agencies must annually publish on their public website a searchable list of all instructional software products with executed digital privacy agreements and academic-effectiveness verification, including product name, vendor, instructional purpose, and links to the agreement and verification summary. The list must be updated within ten business days of any software addition or removal.

G-02.4

Local educational agencies must provide written notice to parents within five school days when a new instructional software product is added mid-year, including links to the product's digital privacy agreement and academic-effectiveness verification summary, before making the software available for student use.

G-02.4

Local educational agencies must provide parents with timely written notice of any significant software update or change in data-collection or data-sharing practices that may affect digital privacy agreement compliance or trigger new consent requirements, and must maintain a publicly accessible two-year archive of previously used instructional software including product name, vendor, and dates of active use.

G-02.4

§ 160.071(9)

Attorney general enforcement authority

(9)(1)–(3) The attorney general shall have authority to enforce the provisions of this section to ensure compliance by covered entities. (2) (a) A parent or legal guardian may submit a complaint through the established complaint process provided for under this section alleging a violation of this section. (b) If the complaint is determined to have merit after initial review by the designated administrative body, the complaint may be referred to the attorney general for investigation and enforcement. (c) The attorney general may initiate an investigation upon referral or upon independent determination that a violation may have occurred. (3) For purposes of enforcing this section, the attorney general may: (a) Issue subpoenas to compel testimony or production of documents, records, or data relevant to an investigation; (b) Conduct audits or require production of compliance records from covered entities; (c) Require written responses or compliance reports; and (d) Take other lawful investigative actions necessary to determine compliance.

(9)(4)–(7) A court may impose civil fines or penalties for violations of this section, including graduated penalties for repeated or willful violations, as determined appropriate by rule or statute. (5) In any enforcement action in which the attorney general prevails, the court may award reasonable attorney's fees, investigative costs, and litigation expenses to the state. (6) The attorney general may seek injunctive relief or court orders requiring corrective action, compliance plans, or cessation of unlawful practices. (7) The attorney general may promulgate rules necessary to implement enforcement procedures consistent with this subsection. Any rule or portion of a rule, as that term is defined in section 536.010, that is created under the authority delegated in this section shall become effective only if it complies with and is subject to all of the provisions of chapter 536 and, if applicable, section 536.028. This section and chapter 536 are nonseverable and if any of the powers vested with the general assembly pursuant to chapter 536 to review, to delay the effective date, or to disapprove and annul a rule are subsequently held unconstitutional, then the grant of rulemaking authority and any rule proposed or adopted after the effective date of this act shall be invalid and void.

Subsection 9 establishes the attorney general's enforcement authority over the PROTECT Students Act. Parents may submit complaints through the established process, and meritorious complaints may be referred to the attorney general. The attorney general may also initiate investigations independently. Enforcement tools include subpoenas, compliance audits, written responses, and other lawful investigative actions. Courts may impose civil fines or penalties, including graduated penalties for repeated or willful violations. Attorney's fees, investigative costs, and litigation expenses are recoverable by the state. Injunctive relief and court-ordered corrective action are available. The attorney general may promulgate enforcement rules subject to chapter 536 procedural requirements.

§ 160.071(10)

Rulemaking authority

(10) The state board of education shall promulgate all necessary rules and regulations for the administration of this section. Any rule or portion of a rule, as that term is defined in section 536.010, that is created under the authority delegated in this section shall become effective only if it complies with and is subject to all of the provisions of chapter 536 and, if applicable, section 536.028. This section and chapter 536 are nonseverable and if any of the powers vested with the general assembly pursuant to chapter 536 to review, to delay the effective date, or to disapprove and annul a rule are subsequently held unconstitutional, then the grant of rulemaking authority and any rule proposed or adopted after the effective date of this act shall be invalid and void.

Subsection 10 grants the state board of education rulemaking authority for the administration of the entire section, subject to the same chapter 536 procedural constraints and nonseverability provisions that apply to the attorney general's rulemaking under subsection 9.

Public Sector Procurement restrictions · government use

2 items

PS-01.1