Governor Gavin Newsom has signed AB 1159, the student privacy bill we sponsored, authored by Assemblymember Dawn Addis. The legislation updates California's education-technology privacy laws and extends protections to higher education. The higher-education provisions become operative starting next year, on July 1, 2027

Our associate director, Emory Roane, said:

“Students should not have to surrender their privacy to get an education. EdTech companies have extraordinary access to students' lives through the tools they use for class, and that access comes with a responsibility to protect them, not to turn their personal information into a product to sell. AB 1159 finally extends privacy protections to millions of California college students. It puts hard limits on using their data to train AI and protects sensitive information like reproductive health and immigration records from exploitation. And when companies break those rules, students and families can hold them accountable directly. We were proud to sponsor this bill, and we thank Assemblymember Addis for her leadership and Governor Newsom for signing these protections into law.”

Limits on sensitive information and AI

Students rarely get a choice when it comes to the technology in their classrooms. When a course requires a specific platform or digital textbook, using it is the only way to do the work, and whatever a student types into it becomes data the company holds. AB 1159 draws hard lines around the uses of that data that can do the most damage.

The most permanent of those uses is AI training. Once a company feeds student information into a model, there is no getting it back. The model has already learned from it. AB 1159 bars companies from using identifiable student data to train generative AI or build AI systems, so a student's coursework never quietly becomes raw material for a commercial product they will never control. 

AB 1159 also sharply limits how edtech businesses can collect, use, keep, or share a student's reproductive or sexual health information, immigration status, sexual orientation, or gender identity. 

Protections that reach college students

College students face much of the same issues with edtech in the classroom as K-12 students, and often have to buy and use digital courseware to complete required coursework. In our 2024 report Paying Twice to Learn, we examined the privacy risks surrounding those tools, finding unclear data practices and limited protections in higher education. We developed AB 1159 from that research and our work on student privacy.

California has led the country in establishing education-technology privacy laws for preschool and K–12 students. Fundamentally, AB 1159 updates those laws and adds a higher-education chapter, extending the protections that California (and the dozens of states that have followed California's example) currently provides to the millions of higher education students across the state. Covered providers include companies that know their products serve educational purposes and designed or marketed them for that use, including digital course books. The obligations fall on covered operators rather than schools, teachers or families.

A way for students to hold companies accountable

These protections have applied to California's youngest students for a decade, and in that time there has been a single public enforcement action. Enforcement that rests entirely on a state agency has limits, and AB 1159 gives families another path. A student, or a parent, guardian, or education rights holder acting on their behalf, can enforce the law directly. 

Higher-education protections begin July 1, 2027

The higher-education chapter takes effect July 1, 2027. California set the standard for student privacy more than a decade ago, and AB 1159 carries it into the age of AI and up through college. Students, families, and educators can see exactly what the law covers and how it will work in our AB 1159 explainer.