WHAT THIS BILL REGULATES · 4 REQUIREMENT TYPES
How Is This Bill Enforced
Verbatim statutory text on the left; plain-language analysis and a per-section checklist on the right. Numbered markers cross-link to the matching checklist row.
(A) This act shall be known and my be cited as the "ParentParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2) Data Sovereignty Act of 2026".
(B)(1)–(2) 1. The Legislature finds that: a. parentsParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2) possess a fundamental right to direct the upbringing, education, and privacy of their children, b. public agencies exist to serve citizens, not to compile or commercialize data on them, c. current state and federal education data systems collect and retain personally identifiable student information without sufficient transparency, consent, or parental control, and d. the preservation of liberty in the digital age requires explicit limits on the collection, retention, and disclosure of personal data by state agencies. 2. It is the intent of the Legislature to affirm that parentsParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2) are the primary stewards of their children's information, to restrict government data collection to what is legally necessary, and to provide parentsParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2) clear rights of notice, access, and consent.
(C)(1)–(4) As used in this act: 1. "Personally identifiable educational data (PIED)Personally identifiable educational data (PIED)"Personally identifiable educational data (PIED)" means any information maintained by a state education agency or contractor that could identify an individual student or parent, including but not limited to, name, student identification, demographic data, disciplinary history, test results, biometric or health data, or any combination thereof;70 O.S. § 3-168.1(C)(1)" means any information maintained by a state education agencyState education agency"State education agency" means the State Department of Education and any other public entity or vendor authorized to collect or process student data;70 O.S. § 3-168.1(C)(3) or contractor that could identify an individual student or parentParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2), including but not limited to, name, student identification, demographic data, disciplinary history, test results, biometric or health data, or any combination thereof; 2. "ParentParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2)" means a natural parentParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2), guardian, or person with legal authority to make educational decisions for the student; 3. "State education agencyState education agency"State education agency" means the State Department of Education and any other public entity or vendor authorized to collect or process student data;70 O.S. § 3-168.1(C)(3)" means the State Department of Education and any other public entity or vendor authorized to collect or process student data; and 4. "Longitudinal linkageLongitudinal linkage"Longitudinal linkage" means any state database that links student information across years, programs, or agencies for tracking educational or workforce outcomes.70 O.S. § 3-168.1(C)(4)" means any state database that links student information across years, programs, or agencies for tracking educational or workforce outcomes.
Subsections A through C establish the short title (Parent Data Sovereignty Act of 2026), declare legislative findings regarding parental rights and government data collection, and define the bill's four key terms: personally identifiable educational data (PIED), parent, state education agency, and longitudinal linkage. These provisions are foundational — they frame the scope of the act but impose no independent compliance obligations.
(D) 1 All personally identifiable educational data relating to a minor child is the property of the parentParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2) until the student reaches eighteen (18) years of age. State agencies and their contractors shall act only as custodians of personally identifiable educational data and shall not obtain any proprietary or ownership interest of such data. No state education agencyState education agency"State education agency" means the State Department of Education and any other public entity or vendor authorized to collect or process student data;70 O.S. § 3-168.1(C)(3) or local school district shall sell, trade, or license any student data for commercial purposes.
Subsection D establishes three distinct rules. First, it declares that all personally identifiable educational data relating to a minor is the property of the parent until the student reaches age eighteen. Second, it restricts state agencies and contractors to a custodial role, prohibiting them from claiming proprietary or ownership interests in student data. Third, it categorically prohibits state education agencies and local school districts from selling, trading, or licensing any student data for commercial purposes.
(E)(1)–(2) 2 A parentParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2) shall have the right to: 1. Obtain, within thirty (30) days of request, a complete record of all data elements collected or maintained on his or her child by any state education agencyState education agency"State education agency" means the State Department of Education and any other public entity or vendor authorized to collect or process student data;70 O.S. § 3-168.1(C)(3) or local school district; 2. Request correction or deletion of any inaccurate or unnecessary data;
(E)(3)–(4) 3 3. Opt out of any nonessential collection or data linkage beyond what is required by state or federal law for enrollment, funding, or accountability; 4. Opt out of inclusion in any research study, predictive analytics model, artificial intelligence training dataset, or cross-agency workforce linkage;
(E)(5) 4 5. Receive annual written notice from the school district and the State Department of Education listing data elements collected, their purpose, and all authorized data-sharing agreements.
Subsection E enumerates five affirmative parental rights. Parents may (1) obtain a complete record of all data collected on their child within thirty days, (2) request correction or deletion of inaccurate or unnecessary data, (3) opt out of nonessential collection or data linkage, (4) opt out of inclusion in research studies, predictive analytics models, artificial intelligence training datasets, or cross-agency workforce linkage, and (5) receive annual written notice listing data elements collected, their purpose, and all authorized data-sharing agreements. The AI training dataset opt-out in paragraph 4 is the bill's most directly AI-relevant provision.
(F)(1) 5 No personally identifiable educational data shall be collected unless expressly authorized by state or federal law. The following categories shall not be collected or retained without the written consent of a parentParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2): a. political or religious affiliation or beliefs, b. family income or tax information other than free and reduced lunch eligibility, c. biometric, health, or psychological data unrelated to special education services, d. student social media identifiers or Internet activity, and e. any data not directly necessary for educational instruction or accountability.
(F)(2) 6 New data elements proposed for collection by the State Department of Education shall receive legislative approval following public notice and hearing before implementation.
Subsection F imposes two constraints. Paragraph 1 prohibits collection of personally identifiable educational data unless expressly authorized by state or federal law, and enumerates five categories of sensitive data that require written parental consent before collection: political or religious beliefs, family income data beyond lunch-eligibility status, biometric/health/psychological data unrelated to special education, social media identifiers or internet activity, and any data not directly necessary for instruction or accountability. Paragraph 2 requires legislative approval — following public notice and hearing — before the State Department of Education may collect any new data element.
(G)(1) 7 Personally identifiable student data shall not be transferred to any federal or state agencies, including but not limited to, workforce, health, or human services agencies, or to any private contractor or nonprofit organization without the written consent of the parentParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2), or the student if the student has reached eighteen (18) years of age, unless otherwise authorized by law.
(G)(2) 8 Any data-sharing arrangement between multiple agencies shall be disclosed publicly through the Data Transparency Portal established under subsection I of this section.
Subsection G prohibits the transfer of personally identifiable student data to federal or state agencies (including workforce, health, and human services agencies) and to private contractors or nonprofit organizations without written parental consent (or student consent if age eighteen or older), unless otherwise authorized by law. Any data-sharing arrangement between multiple agencies must be disclosed through the Data Transparency Portal established under subsection I.
(H)(1) 9 The State Department of Education shall develop a standardized ParentParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2) Data Opt-Out Form, available electronically and in paper format. Upon receipt of a completed form, the local school district shall exclude the applicable student's records from longitudinal and cross-agency linkage, and only de-identified or aggregate data shall be used for state reporting purposes.
(H)(2) 9 No student shall be penalized, denied enrollment, or suffer academic disadvantage for opting out of data sharing as permitted by this section.
Subsection H requires the State Department of Education to develop a standardized Parent Data Opt-Out Form available both electronically and in paper. Upon receipt of a completed form, the local school district must exclude the student's records from longitudinal and cross-agency linkage, permitting only de-identified or aggregate data for state reporting. The subsection also prohibits any penalization — enrollment denial or academic disadvantage — of students who opt out.
(I)(1)–(5) 10 In addition to the requirements of Section 3-168 of this title, the State Department of Education shall create and maintain a publicly accessible Data Transparency Portal that: 1. Lists all data elements collected by the Department; 2. Identifies which elements are mandatory versus optional; 3. Publishes copies of all active vendor contracts and data-sharing agreements; 4. Reports all data breaches or unauthorized disclosures within thirty (30) days; and 5. Posts annual privacy and security compliance audits required under this section.
Subsection I requires the State Department of Education to create and maintain a publicly accessible Data Transparency Portal. The portal must list all data elements collected, identify which are mandatory versus optional, publish copies of all active vendor contracts and data-sharing agreements, report all data breaches or unauthorized disclosures within thirty days, and post annual privacy and security compliance audits. This is the bill's primary public accountability mechanism — a government-facing transparency requirement analogous to AI system registries in other jurisdictions.
(J)(1)(a)–(d) 11 Any contractor or vendor handling student data shall: a. sign a ParentParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2) Data Privacy Agreement acknowledging its obligations under this section, b. employ industry standard encryption, multi-factor authentication, and secure data storage protocols, c. delete or return all data within ninety (90) days of contract termination, and d. submit to random privacy and security audits by the State Department of Education or an independent third-party auditor.
(J)(2) 11 Vendors found in violation may be barred from future contracts for a period of up to five (5) years.
Subsection J imposes four requirements on any contractor or vendor handling student data: signing a Parent Data Privacy Agreement acknowledging statutory obligations, employing industry-standard encryption, multi-factor authentication, and secure storage, deleting or returning all data within ninety days of contract termination, and submitting to random privacy and security audits by the Department or an independent third-party auditor. Vendors in violation may be debarred from future state contracts for up to five years.
(K)(1) Any person or entity that violates any provision of this section shall be subject to a civil penalty not to exceed Ten Thousand Dollars ($10,000.00) per violation, which may be assessed by a court of competent jurisdiction. Each unauthorized disclosure, transfer, sale, or use of personally identifiable educational data shall constitute a separate violation.
(K)(2) Any person who knowingly or intentionally discloses, sells, transfers, or otherwise makes available personally identifiable educational data in violation of this section shall be guilty of a misdemeanor, punishable by imprisonment in the county jail for a term not to exceed one (1) year, or by a fine not to exceed One Thousand Dollars ($1,000.00), or by both such imprisonment and fine.
(K)(3) ParentsParent"Parent" means a natural parent, guardian, or person with legal authority to make educational decisions for the student;70 O.S. § 3-168.1(C)(2) may bring a private cause of action for injunctive relief and damages in the district court of competent jurisdiction for harm caused by violations of this section.
Subsection K establishes a three-tier enforcement regime. Paragraph 1 authorizes civil penalties up to $10,000 per violation, with each unauthorized disclosure, transfer, sale, or use constituting a separate violation. Paragraph 2 creates criminal liability: knowing or intentional violations are a misdemeanor punishable by up to one year imprisonment and/or a $1,000 fine. Paragraph 3 grants parents a private cause of action for injunctive relief and damages for harm caused by violations.
(L) The State Board of Education shall promulgate rules to implement the provisions of this section within one hundred eighty (180) days of the effective date of this act.
Subsection L directs the State Board of Education to promulgate implementing rules within 180 days of the act's effective date. This is a standard rulemaking directive that imposes an obligation on the Board to act within a defined timeframe but does not itself create compliance duties for regulated entities.
This act shall become effective November 1, 2026.
Section 2 sets the act's effective date as November 1, 2026.