The Student Data Transparency and Security Act is in the Colorado Revised Statutes starting at section 22-16-101. It works on two levels. Local education providers (districts, charter schools and similar bodies) have duties, and so do the school service contract providers they hire. As a teacher you mainly feel the first level, because your district decides what is on its approved list.
Section 22-16-107: what the district must do
Local education providers must post on their websites a list of the school service contract providers they use and copies of the contracts. For contracts made or renewed on or after August 10, 2016, they must require the provider to comply with the provider duties in sections 22-16-108 to 22-16-110. If your district has such a list and ClassSense is not on it, you should not enroll students until that is settled.
Section 22-16-108: transparency
A provider must give clear, layperson-readable information about the student personally identifiable information it collects, the learning purpose, and how it is used and shared. It must give notice before material changes to its privacy policy, help the school correct inaccurate information, and notify the school or district as soon as possible if it misuses or releases information without authorization.
Section 22-16-109: use
A provider may use information only as the contract authorizes or with consent. It may not sell it, use it for targeted advertising, or build a personal profile of a student except as authorized, and it must bind its subcontractors to the same limits.
Section 22-16-110: security and destruction
A provider must keep a comprehensive information security program. During the contract it must destroy information when asked as soon as practicable, and at the end of the contract it must destroy it within the period the contract sets, or when it is no longer needed if the contract is silent, and tell the school the date.
How ClassSense lines up
| Section | What we document | Open point |
|---|---|---|
| Plain-language disclosure | The data practices page and privacy policy list what is collected and why. | Confirm it matches the data elements your district requires. |
| Notice of policy changes | Not documented as a standing commitment. | Ask for it in the contract. |
| Correction | Through the teacher, the parent portal view, or email. | Define a turnaround. |
| Misuse or release | We email affected account holders without undue delay after confirmation. | The act speaks of notifying the school or district. Name the contact in the contract. |
| No sale, no ads, limited use | No advertising, no trackers, no sale. The mastery profile is only for instruction. | Put it in the contract. |
| Subcontractors | Listed on the data practices page. | Confirm how you are told of changes. |
| Security program | See the security overview. | We have not published a document titled as a comprehensive security program. |
| Destruction | Within 30 days of request. Backups age out after five days. | Ask for written confirmation with a date at contract end. |
What we have not done
We have not signed a Colorado district contract, we are not on any Colorado district list that we know of, and no outside party has reviewed us against the act. Our public documents say uploaded curriculum and student answers may be processed by an AI service; see student data and AI. For what we sign and when, see data processing agreements.
Plain-language summary, not legal advice. Last reviewed October 2026. Laws and regulations change, so have your district's counsel confirm anything you rely on. Statute cited: Colorado Revised Statutes sections 22-16-107 to 22-16-110.
Common questions
What does the Colorado Student Data Transparency and Security Act require?
Districts must post lists of their school service providers and contracts, and providers must explain what they collect in plain language, limit use, keep a security program and destroy information on request or at contract end.
Is ClassSense on my Colorado district's approved list?
We are not aware of any Colorado district list that includes us. Check your district's posted list, and ask us if you need to start the process.
Does the act ban targeted advertising?
Yes. Section 22-16-109 bars selling student information, targeted advertising and building a personal profile except as authorized. ClassSense runs no advertising and does not sell student data.
How fast must data be destroyed?
During the contract, as soon as practicable after a request. At the end, within the period the contract sets. ClassSense completes deletion requests within 30 days.