Establishes provisions relating to software accountability for education

SECOND REGULAR SESSION
HOUSE BILL NO. 3281
103RD GENERAL ASSEMBL Y
INTRODUCED BY REPRESENT A TIVE BYRNES.
7041H.01I JOSEPH ENGLER, Chief Clerk
AN ACT
T o amend chapter 160, RSMo, by adding thereto one new section relating to software
accountability for education, with penalty provisions.
Be it enacted by the General Assembly of the state of Missouri, as follows:
Section A. Chapter 160, RSMo, is amended by adding thereto one new section, to be
2 known as section 160.071, to read as follows:
160.071. 1. This section shall be known and may be cited as the "PROTECT
2 Students Act".
3 2. As used in this section, the following terms mean:
4 (1) "Addictive design featur e", any featur e or component of a digital or online
5 pr oduct that encourages or incr eases a student's freq uency , time spent, or engagement
6 with the pr oduct including, but not limited to:
7 (a) Infinite scr oll or autoplay;
8 (b) Points, badges, or other gamification reward s tied to time spent on the
9 pr oduct;
10 (c) Persistent notifications or push alerts pro mpting reeng agement when not
11 actively in use; and
12 (d) Personalized r ecommendation systems or addictive algorithms that pro mote
13 extended or compulsive use;
14 (2) "Contracting entity", a local educational agency or the Missouri state board
15 of education;
16 (3) "Digital privacy agreement", a requi red contract between a local educational
17 agency and a digital pro vider that strictly governs access, use, pr otection, r etention, and
EXPLANA TION — Matter enclosed in bold-faced brackets [thus] in the above bill is not enacted and is
intended to be omitted from the law . Matter in bold-face type in the above bill is proposed language.
18 disclosur e of student data and ensures compliance with applicable laws. Digital privacy
19 agr eements pr ohibit advertising use, pr ofiling, r esale, or any noneducational use of
20 student data and termination clause;
21 (4) (a) "Educational purpose", a purpose dir ectly tied to:
22 a. Instruction;
23 b. Assessment;
24 c. Student learning; or
25 d. School operations necessary for instruction.
26 (b) "Educational purpose" does not include:
27 a. Marketing;
28 b. Advertising;
29 c. Behavioral pr ofiling; or
30 d. Any commer cial purpose;
31 (5) "Independently verified", a pr oduct that has been checked for its safety ,
32 effectiveness, and compliance by an impartial, separate third party who is not involved
33 with its crea tion or management, ensuring objectivity and trust by rem oving potential
34 bias fr om the original sour ce;
35 (6) "Instructional software":
36 (a) Softwar e that has successfully:
37 a. Executed a digital privacy agreement; and
38 b. Been verified for academic effectiveness, compliant with the pr ovisions of this
39 section;
40 (b) Any instructional softwar e that has not successfully completed the steps
41 under paragraph (a) of this subdivision shall be deemed noncompliant software and
42 shall not be used for student learning or school-sponsor ed activities in Missouri schools;
43 (7) "Local educational agency", the same meaning as defined in section 167.225;
44 (8) "School-issued device", any laptop, tablet, mobile device, or hardware
45 pr ovided to a student by a local educational agency for educational use;
46 (9) (a) "Softwar e", any application, web-based service, cloud application,
47 mobile application, plug-in, or other code-based prod uct, whether fr ee or paid, that:
48 a. Runs on or is accessed fr om a school-issued device, or fr om a student-owned
49 device when used under the authority of a local educational agency; and
50 b. Is assigned, re quir ed, r ecommended, installed, or otherwise made available by
51 a local educational agency for student use in connection with:
52 (i) Classr oom instruction;
53 (ii) A school-sponsor ed activity; or
54 (iii) Any curricular , co-curricular , or extracurricular activity .
HB 3281 2
55 (b) "Software" includes, without limitation, software used for instruction,
56 assessment, communication, collaboration, enrichment, or recr eation in connection with
57 school-r elated purposes.
58 (c) "Softwar e" does not include the physical device itself;
59 (10) "Student data", includes:
60 (a) Personally identifiable information;
61 (b) Metadata, device identifiers, and clickstr eam data;
62 (c) Behavioral, engagement, or usage data; and
63 (d) Information collected, generated, or inferr ed by the softwar e during student
64 use;
65 (1 1) "V endor", any company , developer , organization, or individual who
66 pr ovides software, digital tools, digital services, or re lated technology to a contracting
67 entity for student use, whether fr ee or paid.
68 3. (1) Befor e any softwar e may be installed, assigned, reco mmended, or
69 otherwise made available for student use, the vendor shall:
70 (a) Execute a statewide digital privacy agr eement; and
71 (b) Complete an independent r eview demonstrating that the softwar e is
72 academically effective.
73 (2) (a) The state board of education shall adopt a single statewide digital privacy
74 agr eement governing the use of software and digital services by students in Missouri
75 public schools.
76 (b) All vendors shall execute the statewide digital privacy agree ment as a
77 condition of prov iding software or digital services to any local educational agency or the
78 state board of education.
79 (c) The statewide digital privacy agreement shall not be alter ed, supplemented,
80 r eplaced, modified, or negotiated by a vendor , local educational agency , or contracting
81 entity .
82 (d) Any vendor -pr oposed privacy agreement, end-user license agr eement, click-
83 thr ough terms, terms of service, or substitute contract is void and unenfor ceable with
84 r espect to student data or student use.
85 (e) The contracting entity shall execute the statewide digital privacy agreement
86 befor e software may be installed, assigned, reco mmended, or otherwise made available
87 for student use.
88 (3) The statewide digital privacy agreement shall incorporate and comply with
89 state statutes governing data minimization, secondary use limitations, targeted
90 advertising pr ohibitions, security safeguards, privacy notices, br each re sponse,
9 1 r etention and deletion, and dir ectory-information pro tections, wher e applicable.
HB 3281 3
92 (4) The statewide digital privacy agr eement shall requ ire full compliance with
93 state statues and state board of education rules governing sensitive materials in schools.
94 Softwar e shall not display , recomm end, algorithmically generate, link to, embed, or
95 pr ovide access to any material that:
96 (a) Is pornographic;
97 (b) Is harmful to minors;
98 (c) Is indecent or obscene;
99 (d) Contains descriptions or depictions of sexual conduct, sexual excitement,
100 ar ousal, or stimulation;
101 (e) Contains violent, graphic, or self-harm or suicidal content inconsistent with
102 safety standards; or
103 (f) Otherwise is pr ohibited under Missouri law .
104 (5) (a) The statewide digital privacy agr eement shall r equir e that software shall
105 not display , recomm end, algorithmically generate, or pr ovide access to any instructional
106 or supplemental content that constitutes:
107 a. Human sexuality instruction;
108 b. Sexual education;
109 c. Maturation instruction;
110 d. Content rel ating to rep rodu ction, contraception, sexual activity , or sexually
111 transmitted diseases; or
112 e. Sexual- or health-r elated information
113
114 unless affirmative written par ental consent has been obtained by the local educational
115 agency in accordance with any rule or law .
116 (b) Such req uire ment applies to core content, supplemental content, adaptive
117 learning pathways, embedded media, hyperlinks, and AI-generated or AI-rec ommended
118 content.
119 (6) The statewide digital privacy agr eement shall also include the following
120 pr otections:
121 (a) Softwar e shall not req uire open-internet access for core educational
122 functions. All external links, embedded media, and third-party content shall be
123 r eviewed and appr oved by the contracting entity;
124 (b) Softwar e shall not include:
125 a. Infinite scr oll;
126 b. Auto-play video;
127 c. Gamified r eward loops unr elated to learning; or
HB 3281 4
128 d. Behavioral nudges or engagement mechanics designed to incr ease scr een
129 time;
130 (c) V endors shall not collect, stor e, or analyze:
131 a. Biometric identifiers;
132 b. Behavioral or emotional signals;
133 c. V oiceprints or keystr oke dynamics; or
134 d. Pr ecise geolocation
135
136 unless strictly necessary for the educational purpose and disclosed in the digital privacy
137 agr eement;
138 (d) Softwar e shall not:
139 a. Use student data to train machine-learning models;
140 b. Employ AI systems that analyze or influence a student's emotions, behavior ,
141 or attention;
142 c. Generate or rec ommend content intended to shape student beliefs or
143 pr efer ences;
144 d. Pr oduce or enable content that cir cumvents Missouri laws r elating to sensitive
145 materials or instructional materials;
146 (e) Softwar e shall not:
147 a. Display commer cial or sponsored content;
148 b. Use session rep lay , heat-mapping, or behavioral analytics;
149 c. Creat e persistent identifiers; or
150 d. T rack students outside the educational purpose;
151 (f) V endors shall:
152 a. Use encryption for data in transit and at r est;
153 b. Store and process all student data within the United States;
154 c. Disclose all subpr ocessors and obtain appr oval before use; and
155 d. Pr ohibit backgroun d data collection when software is minimized or inactive;
156 (g) V endors shall disclose to the contracting entity:
157 a. All data elements collected;
158 b. All third-party re cipients;
159 c. All embedded libraries, softwar e development kits, and analytics tools;
160 d. All device-level permissions; and
161 e. All AI components and functions;
162 (h) Camera, micr ophone, and system-level access shall not be used unless strictly
163 necessary for the educational function and disclosed in the digital privacy agr eement;
164 and
HB 3281 5
165 (i) A vendor shall not condition access, featur es, pricing, or support on any form
166 of usage quota or scr een-time expectation.
167 (7) The statewide digital privacy agreement shall include a termination-for -
168 cause pr ovision that:
169 (a) Requires the vendor to cure any violation of the digital privacy agreemen t
170 within a timeline established by rule;
171 (b) Authorizes the contracting entity to terminate the contract if the vendor fails
172 to cure the violation;
173 (c) Pr ovides that termination under this subdivision may occur without penalty ,
174 early-termination fee, or additional obligation to the contracting entity;
175 (d) Requires the vendor to acknowledge that termination under this subdivision
176 does not constitute a brea ch by the contracting entity; and
177 (e) In order to pr otect students and ensure compliance with this section,
178 authorizes the state board of education when a local educational agency does not cure or
179 terminate a noncompliant contract within the r equir ed timeline to:
180 a. Direct the contracting entity to terminate the contract; or
181 b. T erminate the contracting entity's participation in the contract on its behalf.
182 (8) (a) The independent rev iew of academic effectiveness shall be performed by
183 an evaluator that:
184 a. Has no financial or contractual rela tionship with the vendor or any subsidiary
185 of the vendor;
186 b. Is not compensated by the vendor whose pro duct is being revi ewed;
187 c. Uses transpar ent, publicly available evaluation methods; and
188 d. Demonstrates expertise appr opriate to the type of softwar e being evaluated.
189 (b) a. For purposes of this paragraph, "academic effectiveness" means:
190 (i) Evidence, supported by independent studies, r esear ch, or evaluation,
191 demonstrating that the software measurably impr oves student learning, skill
1 9 2 development, or academic performance in the intended subject area;
193 (ii) Alignment with Missouri core standards or state board of education–adopted
194 standards for the r elevant grade level or course;
195 (iii) Demonstrated instructional value that meaningfully supplements or
196 impr oves upon traditional, nondigital instructional practices;
197 (iv) Absence of addictive design featur es that interfer e with learning, distract
198 fr om instruction, or red uce academic focus; and
199 (v) Independent findings, based on transpar ent methodology , showing that the
200 softwar e pr oduces positive, r eliable, and r eplicable academic outcomes when used as
201 intended in a classr oom setting.
HB 3281 6
202 b. Each evaluation of academic effectiveness shall include:
203 (i) A description of the res earch or evaluation methods used;
204 (ii) Identification of the student populations, grade levels, or instructional
205 contexts evaluated;
206 (iii) Evidence that the res ults were not pr oduced, funded, or influenced by the
207 vendor;
208 (iv) Disclosure of any limitations in the evidence or methodology; and
209 (v) A determination of whether the software pro vides educational value
210 sufficient to justify classr oom use.
211 c. The state board of education shall maintain a public list of independent
212 evaluators that meet the standards described in this subdivision. Inclusion on the list
213 does not constitute endorsement of an evaluator's findings.
214 d. Befor e software may be installed, assigned, reco mmended, or otherwise made
215 available for student use, the contracting entity shall obtain documentation of an
216 independent evaluation demonstrating that the softwar e meets the academic-
2 1 7 effectiveness standards described in this subsection.
218 4. (1) The state board of education shall cr eate and maintain a statewide master
219 list of software used by students in Missouri public schools. The master list is a
220 transpar ency tool and does not constitute an appr oval or endorsement by the state
221 board.
222 (2) (a) Softwar e shall be placed on the master list when the contracting entity
223 has:
224 a. Executed the statewide digital privacy agreement req uired under subsection 3
225 of this section; and
226 b. Obtained the academic-effectiveness verification req uir ed under subsection 3
227 of this section.
228 (b) Completion of the requi rem ents under paragraph (a) of this subdivision shall
229 be met before student use.
230 (3) (a) The contracting entity shall:
231 a. Execute the statewide digital privacy agr eement for any software it adopts;
232 b. Obtain the academic-effectiveness verification; and
233 c. Submit the digital privacy agreement, verification, and requ ired software
234 information to the state board of education for listing.
235 (b) Local educational agencies shall continue to maintain their local software
236 inventory .
237 (4) (a) The state board of education shall:
238 a. Receive documentation submitted by contracting entities;
HB 3281 7
239 b. Publish and update the statewide master list on an ongoing basis; and
240 c. Conduct compliance audits as pr ovided in this subsection.
241 (b) The state board of education does not appr ove or certify softwar e and is not
242 r esponsible for a local educational agency's contracting decisions.
243 5. (1) The state board of education shall monitor and enfor ce compliance with
244 this section thr ough periodic audits of contracting entities and software vendors.
245 (2) (a) The state board of education shall audit each local education agency to
246 confirm that, for every software pr oduct used by students, the local educational agency
247 has:
248 a. Executed the statewide digital privacy agreement req uired under subsection 3
249 of this section; and
250 b. Obtained the academic-effectiveness verification req uir ed under subsection 3
251 of this section.
252 (b) Audits shall occur at least once every thr ee years, with additional spot checks
253 as needed.
254 (3) As part of the audit proce ss, the state board of education shall revi ew vendor
255 compliance with:
256 (a) The statewide digital privacy agr eement; and
257 (b) The academic-effectiveness verification req uire ments established under
258 subsection 3 of this section.
259 (4) As part of vendor compliance revi ews under subdivision (3) of this
260 subsection, the state board of education shall verify whether the vendor discloses
261 student data to unauthorized third parties in violation of the statewide digital privacy
262 agr eement or any rule or law .
263 (5) Contracting entities and vendors shall pr ovide the state board of education
264 access to all re cords, documents, and data necessary to complete compliance audits and
265 vendor revi ews.
266 (6) Following each audit, the state board of education shall issue a written
267 compliance rep ort identifying:
268 (a) Findings of noncompliance;
269 (b) Required correct ive actions; and
270 (c) Applicable timelines for re mediation.
271 (7) The state board of education may publish summary audit findings to support
272 statewide transpar ency and allow paren ts and the public to identify compliant and
273 noncompliant practices.
274 6. (1) A local educational agency is out of compliance with this section if the
275 local educational agency:
HB 3281 8
276 (a) Uses or assigns software for student use without a fully executed statewide
277 digital privacy agr eement; or
278 (b) Uses or assigns software for student use without obtaining the academic-
279 effectiveness verification requ ired under subsection 3 of this section.
280 (2) Upon finding a local educational agency is in noncompliance, the state board
281 of education shall req uire the local educational agency to:
282 (a) Discontinue use of the noncompliant softwar e;
283 (b) Remedy the deficiency by executing the statewide digital privacy agreement
284 or obtaining the academic-effectiveness verification;
285 (c) Implement a corre ctive-action plan to pr event futur e violations; and
286 (d) Comply with any withholding of state technology funds imposed by the state
287 board of education until corr ective action is completed.
288 (3) (a) A vendor is out of compliance with this section if the vendor:
289 a. V iolates any term of the statewide digital privacy agreement; or
290 b. Pr ovides false, misleading, or incomplete academic-effectiveness
2 9 1 documentation.
292 (b) V endor violations under this subdivision are limited to violations of the
293 statewide digital privacy agr eement or the independent-verification req uirements.
294 (4) Upon finding vendor noncompliance, the contracting entity may:
295 (a) Require the vendor to cur e the violation within a timeline established by rule;
296 (b) T erminate the contract under the terms of the digital privacy agr eement if
297 the vendor fails to cure the violation; and
298 (c) Bar the vendor fr om entering into new contracts with that contracting entity
299 for up to twenty-four months.
300 (5) (a) If a local privacy agreement does not cure or terminate a noncompliant
301 contract within the timeline requ ired by rule, the state board of education may:
302 a. Direct the contracting entity to terminate the contract; or
303 b. T erminate the contracting entity's participation in the contract on its behalf, if
304 necessary to pr otect students and ensur e compliance with this section.
305 (b) The authority under this subdivision applies only after a violation and does
306 not include preap prov al or certification of software.
307 (6) (a) A par ent or guardian may submit a written complaint to the state board
308 of education alleging:
309 a. Use of software without a statewide digital privacy agree ment;
310 b. Use of softwar e without requ ired academic-effectiveness verification; or
311 c. A vendor's violation of the statewide digital privacy agr eement.
312 (b) Upon recei ving a complaint, the state board of education shall:
HB 3281 9
313 a. Review the complaint;
314 b. Determine whether a violation has occurr ed;
315 c. Notify the par ent of the determination; and
316 d. T ake appr opriate enforcem ent action under this section if noncompliance is
317 found.
318 (c) The state board of education shall adopt rules establishing pro cedure s and
319 timelines for par ent complaints submitted under this subdivision.
320 (7) T eachers, school employees, and staff acting within the normal course of
321 duties shall not be held personally res ponsible for the noncompliance with this section
322 by a local educational agency .
323 (8) A local educational agency or vendor may appeal a finding of noncompliance
324 or enforcem ent actions imposed under this subsection thr ough the administrative
325 pr ocess established by the state board of education.
326 7. (1) All existing software contracts used by students in Missouri public schools
327 shall be brou ght into compliance with this section within twenty-four months of the
328 effective date of this section.
329 (2) The state board of education shall pr ovide:
330 (a) T echnical guidance to local educational agencies and vendors regard ing the
331 transition to the statewide digital privacy agree ment and academic-effectiveness
332 r equir ements; and
333 (b) Implementation timelines and instructions necessary for contracting entities
334 to achieve full compliance.
335 (3) During the phase-in period, local educational agencies may continue to use
336 existing software contracts, pr ovided that the contracting entity is actively working
337 toward compliance with the statewide digital privacy agr eement and academic-
338 effectiveness requ irem ents.
339 (4) The state board may prioritize technical guidance and transition support for:
340 (a) Softwar e used across multiple local educational agencies;
341 (b) Statewide or consortium contracts; or
342 (c) Softwar e with known privacy , safety , or effectiveness concerns.
343 (5) The phase-in period does not waive the requ irem ents of this section. All
344 softwar e shall meet compliance req uirements within twenty-fours months after the
345 effective date of this section.
346 8. (1) (a) Each local educational agency shall pro vide par ents and guardians
347 with an annual list of all instructional software pro ducts that:
348 a. Have a fully executed statewide digital privacy agre ement;
HB 3281 10
349 b. Have completed the requ ired independent academic-effectiveness verification
350 under subsection 3 of this section; and
351 c. Wil l be assigned, re quir ed, r ecommended, or otherwise made available for
352 student use during the upcoming school year .
353 (b) The list shall include, at a minimum:
354 a. The pr oduct name and vendor;
355 b. The pr oduct's primary instructional purpose; and
356 c. A link to the pr oduct's statewide digital privacy agr eement and academic-
357 effectiveness verification summary .
358 (c) The list shall be:
359 a. Published on the local educational agency's public website in an easily
360 accessible, sear chable format; and
361 b. Updated within ten business days of any addition or r emoval of a software
362 pr oduct.
363 (2) If any new instructional software pr oduct is added during the school year
364 that was not included in the annual list, the local educational agreement shall:
365 (a) Pr ovide written notice to par ents within five school days of the pr oduct's
366 appr oval;
367 (b) Include links to the prod uct's statewide digital privacy agreement and
368 academic-effectiveness verification summary; and
369 (c) Pr ovide this notice prior to assigning the software or making it available for
370 student use.
371 (3) (a) Local educational agencies shall pr ovide par ents with timely written
372 notice of any significant softwar e update or change in data-collection or data-sharing
373 practices that:
374 a. May affect compliance with the statewide digital privacy agr eement; or
375 b. May trigger new consent requ irem ents under state or federal law .
376 (b) Local educational agencies shall maintain a publicly accessible arch ive of
377 instructional softwar e pr eviously used by students, including:
378 a. The pr oduct name and vendor; and
379 b. The dates during which the pro duct was in active use
380
381 for a minimum of two years after the software is ret ired .
382 9. (1) The attorney general shall have authority to enforce the pr ovisions of this
383 section to ensure compliance by cover ed entities.
HB 3281 1 1
384 (2) (a) A paren t or legal guardian may submit a complaint thr ough the
385 established complaint pro cess pro vided for under this section alleging a violation of this
386 section.
387 (b) If the complaint is determined to have merit after initial re view by the
388 designated administrative body , the complaint may be ref erred to the attorney general
389 for investigation and enforcem ent.
390 (c) The attorney general may initiate an investigation upon r eferral or upon
391 independent determination that a violation may have occurr ed.
392 (3) For purposes of enforcin g this section, the attorney general may:
393 (a) Issue subpoenas to compel testimony or pr oduction of documents, records, or
394 data rel evant to an investigation;
395 (b) Conduct audits or requi re pro duction of compliance reco rds fr om cover ed
396 entities;
397 (c) Requir e written r esponses or compliance r eports; and
398 (d) T ake other lawful investigative actions necessary to determine compliance.
399 (4) A court may impose civil fines or penalties for violations of this section,
400 including graduated penalties for r epeated or willful violations, as determined
40 1 appr opriate by rule or statute.
402 (5) In any enforcem ent action in which the attorney general preva ils, the court
403 may award reas onable attorney's fees, investigative costs, and litigation expenses to the
404 state.
405 (6) The attorney general may seek injunctive r elief or court orders r equiring
406 corr ective action, compliance plans, or cessation of unlawful practices.
407 (7) The attorney general may pr omulgate rules necessary to implement
408 enfor cement pro cedur es consistent with this subsection. Any rule or portion of a rule,
409 as that term is defined in section 536.010, that is creat ed under the authority delegated
410 in this section shall become effective only if it complies with and is subject to all of the
411 pr ovisions of chapter 536 and, if applicable, section 536.028. This section and chapter
412 536 are nonseverable and if any of the powers vested with the general assembly
413 pursuant to chapter 536 to revi ew , to delay the effective date, or to disappr ove and annul
414 a rule are subsequently held unconstitutional, then the grant of rulemaking authority
415 and any rule pr oposed or adopted after the effective date of this act shall be invalid and
416 void.
417 10. The state board of education shall pr omulgate all necessary rules and
418 r egulations for the administration of this section. Any rule or portion of a rule, as that
419 term is defined in section 536.010, that is creat ed under the authority delegated in this
420 section shall become effective only if it complies with and is subject to all of the
HB 3281 12
421 pr ovisions of chapter 536 and, if applicable, section 536.028. This section and chapter
422 536 are nonseverable and if any of the powers vested with the general assembly
423 pursuant to chapter 536 to revi ew , to delay the effective date, or to disappr ove and annul
424 a rule are subsequently held unconstitutional, then the grant of rulemaking authority
425 and any rule pr oposed or adopted after the effective date of this act shall be invalid and
426 void.
✔
HB 3281 13