California regulates student data in two places that matter to a teacher choosing a tool. One binds the company. The other binds the district contract. Neither is a certification program, and no state agency approves products under them.
SOPIPA: the rules for the vendor
The Student Online Personal Information Protection Act is Business and Professions Code section 22584. It applies to operators of an online service that they know is used primarily for K-12 school purposes and that was designed and marketed for those purposes. General-audience sites are outside it. For covered operators it:
- prohibits targeted advertising based on student information;
- prohibits building a profile of a student except for K-12 school purposes;
- prohibits selling student information;
- limits disclosure of student information to listed situations;
- requires reasonable security practices; and
- requires deletion of student information when the school or district asks.
Education Code 49073.1: what a district contract must contain
When a California local educational agency buys a digital tool that touches student records, section 49073.1 lists what the contract must say. Among the items:
- student records stay the property of and under the control of the agency;
- how a student can keep control of content they create;
- the vendor may not use records for anything beyond what the contract allows;
- how a parent or student can review and correct their records;
- the security actions the vendor takes, including designating and training the people responsible;
- how and when the vendor will notify affected parties of an unauthorized disclosure;
- certification that records will not be kept after the contract ends;
- a statement that both sides will comply with FERPA; and
- a ban on targeted advertising.
A contract that leaves these out is voidable under the statute once the vendor has been notified and had the chance to fix it. That is why California districts often ask for a signed agreement before a teacher starts.
How ClassSense lines up
| Requirement | What we document | What to ask for |
|---|---|---|
| No targeted advertising, no sale | We run no advertising, use no advertising trackers and do not sell student data. | Put it in the contract. |
| Profiles only for school purposes | The adaptive engine profiles mastery solely to choose what a student practices next. | Put it in the contract. |
| Records stay the school's | Teachers can delete materials at any time. A copy of the school's data is provided on request. | A clause stating ownership. |
| Review and correction | Linked parents see their child's information in the parent portal. Users can export their data. | A defined process for correction requests. |
| Deletion | Full deletion on request within 30 days. | Written confirmation that it happened, since the statute asks for a certification. |
| Security | See the security overview. | Named responsible people and staff training are not documented; ask. |
| Breach notice | Email to affected account holders without undue delay after confirmation. | Any number of days or named contacts your contract needs. |
What we have not done
- We have not signed a California-specific student data agreement with any district or consortium, and we are not on a state registry.
- No outside party has reviewed our practices against SOPIPA or Education Code 49073.1. The table above is our own reading.
- Daily backups are kept for five days, so deleted data can remain in a backup until it ages out. If your contract requires certified non-retention, say so and we will work out the wording together.
- Our public documents say uploaded curriculum and student answers may be processed by an AI service. The student data and AI page explains what that means in practice.
A sensible order for a California teacher
- Ask your district whether it keeps an approved-vendor list or requires a signed agreement.
- If it does, send the district contact to our data practices page and the agreement page.
- Do not enroll students until you hear back. If you are only trying the product, use the sample course, which has pretend students.
Plain-language summary, not legal advice. Last reviewed October 2026. Laws and regulations change, so have your district's counsel confirm anything you rely on. Statutes cited: Business and Professions Code 22584 and Education Code 49073.1.
Common questions
Is ClassSense SOPIPA compliant?
We cannot honestly give a stamp. ClassSense does not advertise to students, does not sell their information and uses it to run the learning service, which are the core SOPIPA prohibitions. No outside party has reviewed that, and compliance is a legal conclusion your counsel should reach.
Does ClassSense have a California student data agreement?
No. We have not signed a California-specific agreement and are not on a state registry. We will work through your district's agreement on request.
What does Education Code 49073.1 require?
It lists terms a California local educational agency's contract must include for digital tools that handle student records, such as ownership of records, limits on use, review and correction, security, breach notice and non-retention after the contract ends.
Can a parent ask for their child's data to be deleted?
Parents can ask through the teacher or school, or by emailing us. We complete deletion requests within 30 days, and deleted data can remain in backups for up to five days.