Oliver Page
Case study
August 1, 2025
What to Know About the California Consumer Privacy Act (CCPA) for Schools explores how this landmark privacy law affects educational institutions, mainly through their technology vendors. While most K-12 schools aren't directly subject to CCPA as non-profits, they are significantly impacted through their relationships with for-profit service providers.
Key Points for K-12 Schools:
The CCPA gives consumers unprecedented control over their personal information. For schools, this means navigating new complexities around student data privacy, especially as EdTech adoption has surged.
As one privacy expert noted, "Schools are in the business of educating students, but they need to be very aware of what is in their contracts and make sure they are holding vendors to what is in their contracts."
CCPA violations can result in fines up to $7,500 per intentional incident. More importantly, protecting student data builds trust with families and ensures compliance with evolving privacy regulations.
Think of the California Consumer Privacy Act (CCPA) as California's answer to giving people control over their digital footprint. This law changed how businesses handle personal information, with three main goals: give consumers control over their data, demand transparency from businesses, and hold companies accountable.
For schools, this matters more than you might think. Even if your institution isn't directly covered, the principles behind the CCPA are shaping how we should all protect student and faculty data.
The California Consumer Privacy Act of 2018 launched on January 1, 2020, marking a new era for data privacy. In 2020, voters approved the California Privacy Rights Act (CPRA), which expanded these protections and created the California Privacy Protection Agency (CalPPA) to enforce them.
Under these laws, consumers gained powerful rights. They can demand to know what personal information businesses collect and how it's used. They can request deletion of their personal information (with some exceptions). They can opt-out of having their data sold or shared and have the right to non-discrimination for exercising these rights.
The CPRA added the right to correct inaccurate personal information and the right to limit how sensitive personal information is used. These are real tools that give people meaningful control over their digital lives.
Here's where What to Know About the California Consumer Privacy Act (CCPA) for Schools gets interesting. The law targets for-profit businesses that meet specific thresholds: annual revenue over $25 million, handling personal information of 100,000 or more California residents, or deriving 50% or more revenue from selling personal information.
For-profit educational institutions that hit these thresholds must comply directly. However, non-profit K-12 schools and government agencies aren't directly covered. At first glance, that might seem like you're off the hook, but the reality is more complex.
Your school is almost certainly indirectly impacted through your vendors. Think about your learning management systems, student information systems, and communication platforms. Many are provided by for-profit companies that do fall under CCPA requirements.
When your school contracts with these vendors, you extend your data practices through them. If a vendor must comply with the CCPA, your school needs to ensure your contracts and oversight align with CCPA principles. This indirect connection makes understanding the CCPA essential for protecting student data and maintaining trust with families. Parents want to know their children's information is protected, regardless of who the law applies to directly.
For What to Know About the California Consumer Privacy Act (CCPA) for Schools, understanding consumer rights is essential. The CCPA gives individuals significant control over their personal data, which creates new considerations for how schools and their vendors handle student and family information.
The CCPA grants several powerful rights. The Right to Know allows individuals to see what personal information has been collected about them. The Right to Delete lets consumers request the erasure of their personal information, though this is complex for schools with record retention duties. The Right to Opt-Out of Sale or Sharing prevents businesses from monetizing personal data without consent.
The California Privacy Rights Act (CPRA) added the Right to Correct inaccurate information and the Right to Limit Use of sensitive personal information. The Right to Non-Discrimination ensures that exercising these rights won't result in penalties.
Businesses must provide clear ways for people to make these requests and respond within 45 days. For schools, this means ensuring your EdTech vendors have these systems in place.
The CCPA provides some of the strongest minor privacy protections in U.S. law, going beyond COPPA.
For children under 13, the CCPA requires parental consent before their personal information can be sold. This is similar to COPPA but covers a wider range of data, including IP addresses and browsing history.
The game-changer is for teens between 13 and 16, who get to make their own decisions. The CCPA requires their direct, affirmative "opt-in" consent before their information can be sold. As TheNational Law Review explains, this gives teenagers unprecedented data control. This means high school students have legal rights to control how EdTech platforms use their data, a major shift for school data governance.
The CCPA's definitions are intentionally broad. Understanding them is crucial for What to Know About the California Consumer Privacy Act (CCPA) for Schools.
Personal information goes beyond names and addresses to include unique identifiers (student IDs), biometric data, internet activity (browsing history), geolocation data, and even inferences drawn from student behavior. Education information as defined under FERPA also falls under the CCPA. For more on sensitive data, see our guide on Sensitive Data Definition and Types.
The definition of "selling" data is also broad. It's not just exchanging information for cash. A "sale" occurs when personal information is shared for any "valuable consideration," which could include improved services or analytics. This expansive view makes vendor contract reviews critical for schools.
Data privacy compliance can feel like juggling multiple rulebooks. Schools must steer the CCPA, the long-standing FERPA, COPPA for younger students, and a maze of third-party vendor relationships. What to Know About the California Consumer Privacy Act (CCPA) for Schools becomes tricky when these laws overlap.
With heavy reliance on EdTech and cloud services, this creates a complex compliance puzzle. Our guide on Cybersecurity for Educational Institutions explores these challenges in a broader context. The good news is that these challenges are manageable with the right approach.
Think of CCPA, FERPA, and COPPA as three lenses for viewing student data protection. Each has a different focus, but all aim to keep personal information safe.
These laws generally work together. CCPA focuses on consumer control, FERPA on educational records, and COPPA on young children online. As legal experts note, Generally, CCPA regulations will not affect service providers who are contracted by a school to receive and store personal information for specific business purposes which are explicitly limited. For example, service providers that are already compliant with SOPIPA, FERPA, and COPPA, will likely be compliant with CCPA for specific, limited business purposes. This means vendors already compliant with existing education privacy laws are well-positioned for CCPA.
Your vendors might be subject to CCPA even if your school isn't. If your EdTech platforms, student information systems, or communication apps are for-profit and meet CCPA's thresholds, they must comply when handling your students' data.
This creates a responsibility to ensure you work with vendors who take these obligations seriously. Data Processing Agreements are key. These contracts should specify CCPA compliance, state that the vendor won't "sell" student data, and outline how they'll help with consumer rights requests.
Due diligence is essential before signing any contract. Ask vendors direct questions about their data handling, breach response, and understanding of CCPA's rules for minors. Ongoing monitoring through regular check-ins and contract reviews is also crucial. Our insights on What Rural Schools Teach Us About EdTech Risk Management show how thoughtful vendor management reduces risk.
This is a key challenge in What to Know About the California Consumer Privacy Act (CCPA) for Schools. CCPA gives people the right to delete their data, but schools have legal obligations to retain certain records (e.g., academic transcripts, attendance data) under FERPA and state laws.
These retention requirements exist for good reasons, such as college applications, audits, and protecting student rights. Legal holds for investigations or lawsuits also prevent deletion. As Education Week reports, conflicts can arise if a parent asks a company to delete data that schools must maintain.
The solution is to be transparent and systematic. Develop clear policies for handling deletion requests, explaining which records must be retained and why. When a request can't be fully honored, document the legal requirement and communicate this clearly. Partial deletion may be an option. The key is having processes in place before requests arrive.
Building a strong data privacy foundation is essential. Even if your school isn't directly covered by CCPA, proactive steps will protect students, build trust, and prepare you for future regulations. Think of it as an investment in your school's reputation and safety. Our guide on Cybersecurity Risks: Protecting K-12 Schools from Evolving Threats shows how privacy and security work together.
What to Know About the California Consumer Privacy Act (CCPA) for Schools begins with understanding your data. Here are five critical steps:
Understanding CCPA penalties is important because they affect your vendors. Civil penalties are $2,500 per unintentional violation and $7,500 per intentional violation. These can add up quickly with thousands of student records.
Data breach penalties are even more severe. CCPA's "private right of action" allows individuals to sue for $100 to $750 per person per incident if a breach occurs due to inadequate security. For a breach affecting 10,000 students, that's potentially $7.5 million in damages.
The California Privacy Protection Agency (CalPPA) handles enforcement. While your school may not face direct action, vendor violations can damage your reputation and erode family trust. The stakes are too high to leave privacy to chance.
The California Consumer Privacy Act (CCPA) has fundamentally changed data privacy in education. While most K-12 schools aren't directly covered, understanding What to Know About the California Consumer Privacy Act (CCPA) for Schools is crucial because of its impact on EdTech vendors.
Your learning management systems, student information platforms, and communication tools must comply if they are for-profit companies meeting CCPA thresholds. This means your school must ensure these vendors protect student data according to CCPA standards.
Proactive compliance isn't just about avoiding fines (up to $7,500 per intentional violation). It's about honoring the trust families place in schools. Every piece of student data represents that trust.
The good news is that CCPA compliance steps also strengthen your overall data security. Thorough vendor reviews prevent data breaches, staff training reduces human error, and updated privacy policies build community trust.
The privacy landscape will continue to evolve. Schools that get ahead of these trends now will be better positioned for the future.
At CyberNut, we understand that protecting student data requires strong cybersecurity practices. Our specialized, gamified micro-trainings for K-12 schools make learning about cybersecurity engaging and effective, helping your staff recognize their critical role in data privacy and security.
Ready to strengthen your school's defenses? Get a complimentary phishing audit for your school to identify potential vulnerabilities. You can also explore CyberNut's resources for educational institutions to see how we help schools steer the complex world of cybersecurity and data privacy.
Together, we can create a safe digital environment for students to learn and grow.
Oliver Page
Some more Insigths
Back
hello@cybernut.comStay Ahead of the Hackers
Weekly insights on threats, defenses, and digital resilience.
