An Administrator's Guide to California Private School Law

Chapter 10 - Privacy Rights Of Students And Employees

 Any person who operates a Web site or online service and collects or maintains personal information from, or about, the users or visitors of the online service, or  Any person on whose behalf such information is collected or maintained, or  Any person who offers products or services for sale through that Web site or online services, where such Web site or online service is operated for a commercial purpose. 1673

Personal information is “collected or maintained” on behalf of an operator when: (1) the information is collected or maintained “by an agent or service provider of the operator;” or (2) the operator “benefits” by allowing another person to collect the information “directly from users of such Web site or online service.” 1674 “Operator” does not include any “nonprofit entity that would otherwise be exempt from coverage under section 5 of the Federal Trade Commission Act (15 U.S.C. § 45).” 1675 This includes “corporations, and any community chest, fund, or foundation, organized and operated exclusively for religious, charitable, scientific . . . or educational purposes . . . .” as defined by section 501 of the Internal Revenue Code (“the Code”). 1676 As many private schools are nonprofits, they do not appear to qualify as an “operator” under COPPA. However, private schools may have duties to comply with if information is collected by third party operators working with schools providing services to students. For example, ordinarily commercial website operators provide notice and obtain “verifiable parent consent” prior to collecting, using, or disclosing personal information from children under the age of 13. 1677 An exception to this requirement exists “where an operator is authorized by a school to collect personal information from children after providing notice to the school of the operator’s collection, use and disclosure practices.” 1678 In that case, the operator “can presume that the school’s authorization is based on the school having obtaining the parent’s consent.” 1679 Under these circumstances, the school acts as an intermediary and must obtain parental consent on behalf of the third party operator. 1680 Under this process, the operator must provide the school with “full notice of [the operator’]s collection, use and disclosure practices, so the school may make an informed decision [of whether to authorize the operator to collect student information].” 1681 In addition, if the operator intends to use or disclose the student’s personal information “for its own commercial purposes, in addition to the provision of services to the school,” the operator must obtain parental consent. 1682 b. What Is Personal Information? Personal information includes a: (1) First and last name; (2) Home or other physical address; (3) Online contact information; (4) Screen name or user name which functions in the same way as online contact information; (5) Telephone number;

An Administrator’s Guide to California Private School Law ©2019 Liebert Cassidy Whitmore 376