Connecticut's student data privacy law is Public Act 16-189, codified at Connecticut General Statutes sections 10-234aa to 10-234dd. It distinguishes between a contractor, who has a contract with a board of education, and an operator, who runs a school-purpose online service without necessarily having one. It matters which one you are dealing with, because the duties differ.
Contractors: section 10-234bb
A board of education that gives student information to a contractor must have a written contract. The statute lists what it has to say, including:
- the contractor does not own the student information;
- how the board can ask for deletion;
- the contractor uses the information only as the contract authorizes;
- how a parent or student can review and correct information;
- the security measures the contractor uses;
- the procedures for notifying the board of a breach;
- that the contractor will not retain the information after the contract expires;
- that FERPA applies; and
- that Connecticut law governs, along with a severability clause.
Student-generated content remains the student's property, and the contractor may not use student information for targeted advertising.
Operators: section 10-234cc
An operator must use security practices that meet or exceed industry standards, delete student information when asked (with an exception for disaster-recovery copies), and may not engage in targeted advertising, collect information beyond what school purposes require, or sell student information.
Breach clocks: section 10-234dd
| Who | Deadline |
|---|---|
| Contractor to the board, for student information that is not directory information | Within 30 days |
| Contractor to the board, for directory information, student records or student-generated content | Within 60 days |
| Board to affected parents | Within two business days of being notified |
| Operator to affected students or parents | Within 30 days |
How ClassSense lines up
- Ownership, limited use, no advertising. Our terms say teachers own the curriculum they upload and give us a license to process it solely to provide the service. The terms do not spell out ownership of student records or student-generated content, so a Connecticut contract would need to. We run no advertising and do not sell student data.
- Deletion. On request within 30 days. Daily backups are kept for five days, which is the kind of copy the operator exception contemplates, though we would still disclose it in a contract.
- Review and correction. Linked parents see their child's information in the parent portal. Corrections go through the teacher or by email.
- Breach notice. Our public statement has no day count: we email affected account holders without undue delay after confirmation. A Connecticut contract would need to set the 30 and 60 day limits explicitly.
- Security. See the security overview. Nobody outside has assessed it against industry standards.
What we have not done
We have not signed a Connecticut board of education contract, we are not on a state vendor listing, and no outside party has reviewed us against this law. Our public documents say uploaded curriculum and student answers may be processed by an AI service, which a Connecticut board will want to read about on student data and AI.
If a board sends a contract, we will go through it with you. Start with data processing agreements.
Plain-language summary, not legal advice. Last reviewed October 2026. Laws and regulations change, so have your district's counsel confirm anything you rely on. Statute cited: Connecticut General Statutes sections 10-234aa to 10-234dd (Public Act 16-189).
Common questions
Does Connecticut require a written contract with ed-tech vendors?
Yes. Section 10-234bb requires a board of education to have a written contract with a contractor that receives student information, and lists terms it must contain.
What are Connecticut's breach deadlines?
A contractor must notify the board within 30 days for student information other than directory information, and within 60 days for directory information, student records or student-generated content. Boards then notify parents within two business days.
Has ClassSense signed a Connecticut agreement?
No. We have not signed one and are not on a state vendor listing. We will review a board's contract on request.
Who owns student-generated content?
Under the statute, student-generated content remains the student's property.