Can Schools Use Children's Data to Train AI? California's New Student Privacy Rules Explained

Schools use more digital tools than ever. From reading apps and homework platforms to AI-powered tutoring, technology has become part of how our children learn. But there is a question many parents may not have thought to ask: What happens to the information children share with these tools?

Could a child's writing, grades, classroom conversations, or learning habits become training material for an artificial intelligence company?

California has introduced stronger protections to address these concerns. Its new student privacy law limits how education technology companies can collect and use children's personal information.

For parents and educators, understanding these protections is an important part of keeping children safe while supporting meaningful learning.

What Is California's New Student AI Privacy Law?

California's student AI privacy law, Assembly Bill 1159 (AB 1159), prohibits covered education technology companies from using protected student information to train generative AI systems or develop AI systems. It also strengthens rules covering advertising, data collection, storage, and sharing.

Governor Gavin Newsom signed AB 1159 on September 10, 2026, as part of a broader package of children's online safety laws.

The legislation was introduced by Assemblymember Dawn Addis and sponsored by Privacy Rights Clearinghouse.

For families already concerned about student data privacy in school apps and devices, the law addresses an important issue: information collected for education should not quietly become a resource for unrelated business activities.

When Does the New Law Take Effect?

Although AB 1159 was signed in September 2026, its new provisions have different start dates.

California already had student privacy protections before AB 1159. The new legislation expands those protections and addresses the growing use of AI in education.

Can Schools Share Children's Data With AI Companies?

Schools may share student information with outside technology providers when permitted by applicable privacy laws and when the information supports legitimate educational purposes.

However, sharing information to deliver an educational service is different from allowing a company to use that information to train an AI model.

Under AB 1159, covered technology providers cannot knowingly use protected student information collected through their educational services for prohibited AI training or development.

This distinction matters because AI can still support classroom learning without requiring children's personal information to become model-training material.

A student might use AI to understand a mathematics problem or practice writing. Families considering AI homework help and schoolwork can focus on whether the tool supports learning and how it handles children's information.

The law does not ban educational AI tools. It restricts specific uses of student data.

What Student Information Does California's Law Protect?

Student data includes much more than names, grades, or attendance records.

AB 1159 protects covered personally identifiable information collected or created through qualifying educational technology services.

Examples include:

• Identity information: Names, email addresses, student identification numbers, and contact details.

• Academic records: Grades, assignments, test results, evaluations, and special education information.

• Digital activity: Search histories, text messages, device identifiers, and online activity linked to students.

• Personal records: Health information, disabilities, behavioral information, and disciplinary records.

• Media and location: Photographs, voice recordings, biometric information, and geolocation data.

The legislation also places strong restrictions on collecting, using, keeping, or disclosing covered information about reproductive or sexual health, immigration status, sexual orientation, and gender identity.

Understanding these categories is part of teaching digital consent and online privacy, because children deserve to know that information they share while learning can reveal personal details about their lives.

Why Do Device Identifiers Matter?

An app may not need a child's name to recognize them.

Persistent unique identifiers can connect activity across sessions or devices. Combined with other information, they may reveal learning patterns or personal habits.

AB 1159 expressly includes these identifiers in its AI-training restrictions, helping address data collection that families may never notice.

Which AI Companies and School Platforms Must Follow AB 1159?

The law focuses on covered technology providers, called operators.

These include qualifying educational websites, mobile applications, online learning services, digital textbooks, and companies working on behalf of those providers.

AB 1159 broadens coverage by removing the previous requirement that a service be used primarily for school purposes.

A company can now fall within the law when it actually knows its service is used for educational purposes and the product was designed or marketed for those purposes.

However, AB 1159 does not automatically cover every website a child visits. General-purpose services used outside the educational setting may fall under other privacy laws instead.

Schools themselves are excluded from the law's definition of an operator, although their data-sharing practices remain subject to other legal requirements.

What Can AI Tools Do With Student Data?

Not every use of student information is prohibited. The purpose of collection, the type of information, and the provider's legal obligations all matter.

A school might use an adaptive reading platform to identify where a child needs more support.

That educational function is different from taking the child's responses and adding them to a dataset for developing a general AI product.

The distinction helps protect students without treating every form of educational technology as harmful.

How Do FERPA, COPPA, and California Privacy Laws Work Together?

AB 1159 does not replace existing federal and California protections.

Several laws work together to regulate how schools and technology providers handle children's information.

FERPA: Protection for Education Records

The Family Educational Rights and Privacy Act (FERPA) protects education records at schools covered by the law.

Schools may disclose protected records to qualifying service providers without individual parental consent in certain circumstances.

However, providers must operate under school control regarding those records and cannot freely reuse the information for unrelated purposes.

COPPA: Protection for Children Under 13

The Children's Online Privacy Protection Act (COPPA) places additional obligations on covered online services collecting personal information from children under 13.

Schools can sometimes consent on parents' behalf when a service collects information solely for the school's educational benefit, rather than unrelated commercial purposes.

School authorization is not a general permission for technology companies to use children's data however they wish.

California's Department of Education also encourages districts to review AI vendors carefully, including their privacy practices and contracts.

Can Companies Still Use Anonymous Student Data?

This is one of the more important details in California's student AI privacy law.

AB 1159 permits certain uses of deidentified information for improving educational products and allows sharing of aggregated deidentified information for specified educational development purposes.

However, removing a student's name does not automatically make information anonymous.

To qualify as deidentified, data must meet safeguards designed to prevent it from being linked back to an individual, school, or household.

These safeguards include contractual protections, commitments against reidentification, and making deidentification processes available for school review.

If a school reviews a provider's process, the provider cannot treat the information as deidentified unless the school finds the process sufficient.

These permissions should not be confused with unrestricted permission to train AI models.

What Rights Do California Parents Have Over Student Data?

California's expanded privacy protections give families additional ways to question how covered providers handle children's information.

1. Access to Education Records

Under FERPA, parents generally have the right to inspect their child's education records. Schools normally must provide access within 45 days of a request.

Those rights usually transfer to students when they turn 18 or enter postsecondary education.

2. Requests to Delete Certain Information

AB 1159 adds specific deletion rights for certain information outside the California Consumer Privacy Act's coverage.

For qualifying requests, parents can seek deletion from covered operators after a child has been out of the relevant educational institution for at least 60 days.

Important exceptions apply, including protections for records schools must legally retain.

3. Limits on Data Retention

Covered providers must establish written data retention policies and generally delete protected information when its collection purpose has been completed, subject to legal exceptions.

Families can request these policies to understand how long information is stored.

4. Legal Remedies for Privacy Violations

AB 1159 allows students who suffer actual harm from certain violations to bring civil actions against covered operators, including through parents or guardians acting on their behalf.

The law includes notice requirements before filing suit and permits specified remedies.

These protections do not mean every privacy concern automatically creates a successful lawsuit.

What Should Parents Ask Their Child's School About AI?

Families do not need to understand every technical detail of artificial intelligence to ask meaningful privacy questions.

A calm conversation with a teacher, principal, or district technology representative can provide useful clarity.

Consider asking:

• Which AI tools and outside technology companies does the school use?

• What information can these tools collect about my child?

• Do vendor agreements prohibit using covered student information to train AI?

• How long is the information stored, and when is it deleted?

• Can families review privacy policies or discuss alternatives when concerned?

These questions are not about challenging teachers or refusing useful technology.

They are about building a shared understanding of how children's information is protected.

How Can Parents Talk to Children About AI Privacy Without Creating Fear?

Children should not feel responsible for understanding complicated privacy laws.

Instead, everyday conversations can help them understand what personal information is and why it deserves care.

Parents can begin by asking what AI tools children enjoy using and what kinds of questions they ask.

This reflects the heart of digital citizenship for kids: developing awareness, respect, and thoughtful decision-making through connection.

A simple conversation might explain that an AI tool can help with homework without needing to know private family details, medical information, or home addresses.

Children also benefit from hearing that questions and mistakes are welcome topics for discussion.

Privacy education works best when it strengthens trust rather than creating another reason for children to feel watched.

Does California's Law Protect Children Using AI at Home?

AB 1159 focuses on qualifying educational services and their providers.

It does not automatically extend its AI-training prohibition to every chatbot, game, or social media service children use independently at home.

Other laws, including COPPA and California consumer privacy protections, may apply depending on the service and circumstances.

That makes family conversations about what to check before a child uses an AI chatbot important even when a school has strong privacy practices.

Parents can review privacy policies with children, discuss what should stay private, and encourage them to ask before sharing sensitive details.

Protecting Children's Privacy Through Connection and Shared Responsibility

California's new student AI privacy law marks an important shift in how educational technology companies must handle children's information.

It recognizes that students should be able to learn with technology without their personal experiences automatically becoming material for developing AI systems.

For parents, the goal is not to eliminate every digital tool or turn privacy into another family conflict.

It is to stay curious, ask thoughtful questions, and work alongside educators to make sure technology serves children with care and respect.

Children deserve both the opportunity to learn with technology and meaningful protection for the information they share along the way.

Frequently Asked Questions About California Student AI Privacy Law

Is California banning AI in schools?

No. AB 1159 does not ban classroom AI. It restricts covered technology providers from using protected student information for prohibited AI training and development while allowing lawful educational uses.

Can schools share student information without parental permission?

Sometimes. FERPA allows certain disclosures without individual consent, including to qualifying school service providers under specific conditions. COPPA also allows limited school authorization for educational services involving children under 13.

Can parental consent make prohibited AI training legal?

AB 1159 does not provide a general parental-consent exception allowing covered operators to use protected student information for prohibited AI training. Consent should not be treated as a way around the law.

Can parents request that an AI company delete their child's information?

Certain deletion rights apply, including specific rights after a student has left an institution for at least 60 days. The type of data, the provider, and legally required records affect what must be deleted.

Does the law apply to private schools and colleges?

Coverage depends on the institution, educational service, and statutory definitions. The law includes qualifying K–12 educational services and extends separate protections to higher education beginning July 1, 2027.