Bill
HB 2696
Prohibits state assessment vendors from selling or exploiting covered student data and creates a private right of action for SOPPA violations.
Status: Introduced Feb 6, 2025; Passed House (third reading) April 10, 2025 (70–38); transmitted to Senate April 14, 2025. Companion: SB 10. Sponsor: Rep. Anne Stava‑Murray (with multiple House co‑sponsors and later Senate co‑sponsors). House Floor Amendment 001 adopted (adds private right of action).
Purpose
- To strengthen student data privacy protections by (1) prohibiting vendors of certain State assessments from selling or commercially exploiting student information covered by the Student Online Personal Protection Act (SOPPA), and (2) adding an explicit private right of action for persons harmed by violations of SOPPA.
Key provisions
1. School Code (amendment to 105 ILCS 5/2‑3.64a‑5)
- Prohibits the vendor of a State Board of Education assessment used for student application to — or admissions consideration by — public institutions of higher education from selling or otherwise commercially exploiting “covered information” (as defined by SOPPA).
- The ban applies to vendors under contracts that are entered into, amended, renewed, or extended on or after the bill’s effective date.
- Requires that student profile information collected by such assessments, when shared with public institutions for admissions consideration, not be commercially exploited by the vendor.
Who is affected
- Assessment vendors under contract with the State Board of Education for assessments used for college admissions consideration (new or modified contracts after the bill’s effective date).
- School districts and the State Board to the extent they procure or share assessment data.
- Students and parents — increased legal remedies and protections for covered student information.
- Institutions of higher education receiving assessment/profile data (indirectly, via changes in vendor practices).
- Vendors and operators subject to SOPPA: greater compliance obligations and potential civil liability.
Potential impacts
- Stricter limits on monetization or third‑party sale/use of student data collected through state assessments.
- Vendors may need to revise contracts, data‑handling practices, and compliance programs; possible increased costs.
- Greater enforcement options (Attorney General actions plus private lawsuits) could increase litigation risk for noncompliant operators.
- May reduce availability of certain vendor services or require renegotiation of data‑sharing arrangements between vendors and public institutions.
Procedural / timeline notes
- Applies to contracts entered into, amended, renewed or extended on or after the bill’s effective date (effective date not specified in the available text).
- House amendment (April 8, 2025) added the private right of action language now reflected in the engrossed bill.
- After House passage (April 10), bill was transmitted to the Senate (arrived April 14) and placed on that chamber’s calendar.
Definitions / reference
- “Covered information” is a SOPPA term covering student personal data and related identifiers — the bill references SOPPA for that definition rather than restating it.
- Enforcement remains tied to the Consumer Fraud and Deceptive Business Practices Act while enabling individual civil suits.
Compiled from official sources — confirm details with the bill’s official record.
Sign in to ask a question.
