Utah's student data privacy rules are in Utah Code Title 53E, Chapter 9, Part 3. Most of Part 3 binds education entities, meaning the State Board, school districts and charter schools, and tells them how to handle student data. The section that speaks to outside vendors is 53E-9-309, which covers third-party contractors. It was amended by H.B. 55 in the 2026 session, with an effective date of July 1, 2026, and the changes below reflect that version.
What a contractor can and cannot do
- A third-party contractor uses student data strictly for the purpose in the contract.
- It may use the data for adaptive learning or customized student learning, for recommendations that are not paid for, and to keep its service operating. (H.B. 55 removed an older allowance for responding to a student's own request for information.)
- It may not sell student data, use it in a way inconsistent with the contract, or use it for targeted advertising.
- At the end of the contract it must return or delete all student data, unless a parent gives written consent to keep it.
The section does not apply to general-audience apps.
What the education entity must put in the contract
The school or district has to require terms in the contract, including limits on the collection, use, storage and sharing of data; who the data may be shared with; deletion on request; a possible bar on secondary use; and a right to audit. As amended in 2026, the contract must also say that the entity has a statutory duty to terminate for a privacy violation, with no termination fee.
What happens when something goes wrong
Discovery
The education entity finds unauthorized use that violates state or federal privacy law, including FERPA and COPPA.
Notice
The entity notifies the contractor within 30 days of discovering it.
Remedy
The contractor must fix the violation and set up processes to prevent it happening again.
Termination
If it does not, the entity ends the contract no sooner than 30 days after the notice.
Anyone who suspects a violation can report it to the State Board of Education's student data privacy team.
How ClassSense lines up
- Purpose. We use student data to run the adaptive learning service, which is the use the section expressly permits. We run no advertising and do not sell student data.
- Return or delete. A copy of the school's data is provided on request, and full deletion on request is completed within 30 days. We have no documented process for a parent's written consent to retain data, so raise that if your district expects one.
- Sharing. Who we share with is listed on the data practices page.
- Audit right. We have not published an audit process. A district that wants a contractual audit right should ask, and we will talk through what is practical.
- Termination. The no-fee termination term would have to appear in a Utah contract. We have not signed one.
What we have not done
We have not signed a Utah agreement, we are not on a state or consortium listing, and no outside party has reviewed us against Part 3. Our public documents say uploaded curriculum and student answers may be processed by an AI service; the section's permission for adaptive learning does not replace your own review of that, so read student data and AI. For the mechanics of a district request, see data processing agreements, and for the federal side see FERPA and ClassSense.
Plain-language summary, not legal advice. Last reviewed October 2026. Laws and regulations change, so have your district's counsel confirm anything you rely on. Statute cited: Utah Code 53E-9-309, as amended by H.B. 55 (2026).
Common questions
Is there a Utah statute for ed-tech contractors?
Yes. Utah Code 53E-9-309 sets what a third-party contractor may do with student data and what the school's contract has to include. It was amended by H.B. 55 in 2026.
Can a Utah vendor use student data for adaptive learning?
Yes. The section expressly lets a contractor use data for adaptive learning or customized learning, but not for targeted advertising or sale.
What must happen to student data when a Utah contract ends?
The contractor must return or delete all student data, unless a parent gives written consent to keep it.
Has ClassSense signed a Utah agreement?
No. We have not signed a Utah-specific agreement and are not on a state listing. We will review a district's contract on request.