Illinois student privacy (SOPPA) and ClassSense

The Student Online Personal Protection Act, 105 ILCS 85 (usually shortened to SOPPA), covers operators of websites, online services and apps used for K-12 school purposes. The statute was amended in recent years to add duties for operators and for schools. The rules for each side are in different sections, so it helps to read them separately.

What the statute asks of an operator

Prohibitions (section 10). An operator may not knowingly engage in targeted advertising on its service, may not use covered information to amass a profile of a student for purposes other than K-12 school purposes, may not sell or rent covered information, and may not disclose it except in the listed situations.

Duties (section 15). Among them:

• use reasonable security procedures and practices that meet or exceed industry standards;
• delete a student's covered information when the school asks;
• publish its terms and a privacy policy;
• enter a written agreement with the school containing the items the statute lists;
• notify the school of a breach no later than 30 calendar days after determining one occurred; and
• keep a list of the third parties that receive covered information and update it each year.

Section 26 sets matching duties for schools. The written-agreement requirement there does not apply to nonpublic schools, though a private school can still ask for one.

How ClassSense lines up

• Targeted advertising, profiles, sale. We run no advertising and no advertising trackers, do not sell student data, and build the mastery profile solely to decide what a student practices next.
• Security. We describe the controls we can verify in the security overview. We cannot say they meet or exceed industry standards in the statute's sense, because no outside party has assessed them. That judgment belongs to your district.
• Deletion. Deletion on request within 30 days. If your agreement sets a shorter period, raise it before signing.
• Published terms and privacy policy. See the terms and privacy policy.
• Third parties. The data practices page lists who handles data for us. That is the single list we maintain. We have not set up a separate annual update schedule for it.
• Breach notice. Email to affected account holders without undue delay after confirmation. That is a different kind of commitment from a fixed 30-day outer limit to the school. We have not committed to a 30-day outer limit in writing, so a school should put one in the agreement.

What we have not done

• We have not signed an Illinois-specific agreement with any school or district.
• We are not part of any state or consortium registry or listing.
• No outside party has assessed us against SOPPA.
• Our public documents say uploaded curriculum and student answers may be processed by an AI service. See student data and AI.

What an Illinois school should ask for

For how we handle a request, see data processing agreements.

Common questions