State Data Privacy Agreement Library

1. Federal Baseline

Law	Status	Notes
FERPA (20 USC §1232g)	Exempt	No education records received from schools
COPPA (15 USC §6501)	Exempt	Platform not directed at children under 13
PPRA (20 USC §1232h)	N/A	No student surveys conducted

2. SDPC Alignment

ThinkKits supports the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement framework. We can execute the SDPC National DPA as a baseline for any state. Our standard DPA includes scope limitations documenting our public-data-only model.

3. California

California

AB 1584 / SOPIPA (Student Online Personal Information Protection Act) — Education Code §49073.1; Business & Professions Code §22584

Key Requirements

Operators must not use student data for targeted advertising
Must delete data upon request from school/district
Must implement and maintain reasonable security practices
Annual security audit and breach notification

Our Compliance Posture

ThinkKits does not qualify as an "operator" under SOPIPA because we do not operate a website or service designed and marketed for K-12 purposes that collects student information. Our platform serves adult professionals and processes only publicly available federal data. However, we can execute an AB 1584-compliant contract addendum with explicit scope limitations.

The Contractor (ThinkKits LLC) does not access, collect, store, or process Student Personal Information as defined in California Education Code §49073.1. All data processed by the Contractor consists of publicly available federal education data from the National Center for Education Statistics, U.S. Census Bureau, and other federal agencies. This DPA is executed to satisfy procurement requirements and does not constitute an acknowledgment that SOPIPA provisions apply to the Contractor's services.

View California AB 1584 →

4. Texas

Texas

HB 18 — Securing Children Online through Parental Empowerment (SCOPE) Act + Student Data Privacy Act — Texas Business & Commerce Code Chapter 509; Texas Education Code §32.151

Key Requirements

Operators must not collect, use, or share student PII beyond educational purpose
Districts must have DPA before sharing student data
Breach notification within 60 days
Annual compliance audit option for districts

Our Compliance Posture

ThinkKits does not receive student PII from Texas districts. Our data sources are entirely federal (NCES CCD, CRDC, SAIPE). We do not fall under the definition of "operator" in TEX Code §32.151. We can execute a TEA-compatible DPA addendum for Texas district procurement.

The Contractor processes only publicly available federal education data and does not receive, access, or store Student Personal Information as defined under Texas Education Code §32.151. No student data will be shared with, collected by, or processed by the Contractor's systems. This addendum is provided for procurement compliance purposes.

View Texas HB 18 →

5. New York

New York

Education Law 2-d — Student Data Privacy and Security — NY Education Law §2-d; 8 NYCRR Part 121

Key Requirements

Third-party contractors must have DPA before receiving student data
Parents' Bill of Rights for Data Privacy and Security (must be published)
NIST Cybersecurity Framework alignment required
Annual breach notification and training requirements
Data must stay within contractor's control; no unauthorized sub-processing

Our Compliance Posture

ThinkKits is not a "third-party contractor" under Ed Law 2-d because we do not receive student PII from educational agencies. Despite exemption, our security practices align with the NIST CSF (Identify, Protect, Detect, Respond, Recover). We can provide a supplemental Parents' Bill of Rights disclosure and execute a 2-d compliant DPA.

The Contractor does not receive Personally Identifiable Information of students (as defined in Education Law §2-d and 8 NYCRR §121.1) from the Educational Agency. All data processed is publicly available federal data. The Contractor maintains security practices aligned with the NIST Cybersecurity Framework as referenced in Education Law §2-d.

View NY Education Law 2-d →

6. Florida

Florida

FLDOE Student Privacy Guidelines — Florida Statute §1002.22; Florida Admin Code 6A-1.0014

Key Requirements

Education records must be maintained in a confidential manner
Access limited to authorized individuals
Annual notification to parents about data practices
School-level data governance

Our Compliance Posture

ThinkKits does not access Florida education records. Our platform uses publicly available NCES and federal data. We are not subject to §1002.22 requirements. We can provide a Florida-specific DPA addendum upon request.

The Contractor does not access, store, or process education records as defined under Florida Statute §1002.22. All data utilized by the Contractor is publicly available through federal agencies (NCES, CRDC, USAC). This addendum is provided to satisfy district procurement requirements.

View Florida Statute §1002.22 →

7. Illinois

Illinois

SOPPA (Student Online Personal Protection Act) — 105 ILCS 85/

Key Requirements

Operators must not sell, lease, or trade student data
Data must be deleted within 60 days of end of contract
Annual data governance plan required
Written consent before collecting biometric data
Breach notification within the most expedient time possible

Our Compliance Posture

ThinkKits does not qualify as an "operator" under SOPPA because we do not operate a website, online service, or app that is (a) used primarily for K-12 purposes, (b) designed and marketed for K-12 purposes, or (c) used at the direction of a K-12 school or teacher with student data. Our platform serves adult administrators and vendors.

The Contractor is not an "operator" as defined in 105 ILCS 85/5 because its platform does not collect, maintain, or use Student Data. The Contractor processes only publicly available federal education data. This DPA is executed as a procurement accommodation and does not constitute a designation as an operator under SOPPA.

View Illinois SOPPA →

8. Pennsylvania

Pennsylvania

Act 88 — Student Data Privacy — 24 P.S. §4604

Key Requirements

Operators must protect student data from unauthorized access
No targeted advertising based on student data
Breach notification within the most expedient time
Annual review of DPAs by school entity

Our Compliance Posture

ThinkKits is headquartered in Pennsylvania (Colmar, PA). We do not qualify as an operator under Act 88 because we do not collect student data. We are registered as a Pennsylvania vendor and can execute an Act 88-compliant DPA addendum.

The Contractor (ThinkKits LLC, 151 Discovery Dr Ste 107, Colmar, PA 18915) does not collect or process Student Data as defined in 24 P.S. §4604. The Contractor's services utilize publicly available federal education data exclusively. This agreement satisfies the DPA review requirement under Act 88.

View Pennsylvania Act 88 →

9. Ohio

Ohio

Student Data Privacy (HB 49) — Ohio Revised Code §3319.321

Key Requirements

Written consent required before sharing directory information with third parties
Data governance policies required for each district
Annual notification to parents
Restrictions on commercial use of student data

Our Compliance Posture

ThinkKits does not receive directory information or any student data from Ohio districts. Our data comes from public federal sources. We can execute an Ohio-specific DPA addendum.

The Contractor does not receive, access, or store student information as defined in Ohio Revised Code §3319.321. All data processed consists of publicly available federal datasets. This DPA serves procurement documentation purposes for the District.

View Ohio Revised Code §3319.321 →

10. Georgia

Georgia

Student Data Privacy, Accessibility, and Transparency Act — O.C.G.A. §20-2-324.4

Key Requirements

Operators must maintain reasonable security standards
No secondary use of student data
Data deletion upon contract termination
Transparency about data collection practices

Our Compliance Posture

ThinkKits does not collect student data from Georgia schools. Our platform uses publicly available federal data. We meet Georgia's transparency requirements through our public documentation (security overview, state compliance, methodology whitepaper).

The Contractor does not collect, store, or process Student Data as defined in O.C.G.A. §20-2-324.4. Services provided utilize publicly available federal education data from NCES, CRDC, and USAC. This DPA is provided for procurement compliance in accordance with Georgia data privacy requirements.

View Georgia O.C.G.A. §20-2-324.4 →

11. Michigan

Michigan

Student Data Privacy Act — MCL §380.1136

Key Requirements

Operators may not use student data for commercial purposes
Data must be deleted upon contract expiration
Breach notification within 45 days
Public transparency about data practices

Our Compliance Posture

ThinkKits does not receive student data from Michigan schools. Our platform processes publicly available federal datasets. We can execute a Michigan-compliant DPA.

The Contractor does not access or process Student Personal Information as defined in MCL §380.1136. All data utilized is publicly available through federal government sources. This DPA satisfies Michigan procurement requirements and documents the Contractor's public-data-only operating model.

View Michigan MCL §380.1136 →

12. North Carolina

North Carolina

Student Privacy Guidelines (Identity Theft Protection Act supplement) — N.C.G.S. §115C-401.1; §75-65

Key Requirements

Reasonable measures to protect student information
Breach notification within 60 days
No sale of student data
Data governance at district level

Our Compliance Posture

ThinkKits does not collect or process student information from North Carolina schools. All data is sourced from publicly available federal datasets. We can provide a North Carolina-specific DPA addendum.

The Contractor does not collect, store, or process personally identifiable student information as protected under N.C.G.S. §115C-401.1. The Contractor's services rely exclusively on publicly available federal education data. This DPA addendum is provided to meet district procurement documentation requirements.

View North Carolina N.C.G.S. §115C-401.1 →

13. How to Request a DPA

Request a DPA

Email legal@thinkkits.com with your state and district name.

We'll return a pre-drafted DPA within 2 business days.

Custom addenda available for any state not listed above.

Bulk DPA execution for multi-state organizations available.

14. Contact

Compliance & Security Inquiries

legal@thinkkits.com for DPA and legal requests

security@thinkkits.com for security questions

Phone: (267) 936-0332