Read the full stored bill text
Req. No. 14154 Page 1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
STATE OF OKLAHOMA
2nd Session of the 60th Legislature (2026)
HOUSE BILL 3547 By: Maynard
AS INTRODUCED
An Act relating to schools; creating the Parent Data
Sovereignty Act of 2026; declaring legislative
findings and intent; defining terms; clarifying
ownership of certain student data; prohibiting
student data use for commercial purposes; declaring
parental rights to obtain student data and opt out of
certain data collection activities; prohibiting
collection of student data under certain
circumstances without parental consent; requiring
legislative approval for certain data collection;
prohibiting transfer of student data to other
agencies and private organizations; requiring the
State Department of Education to create a parent opt-
out form; prohibiting penalization of students for
opting out; mandating the creation of a Data
Transparency Portal; providing portal content;
requiring contractors and vendors to take certain
steps to protect student data; providing penalties
for violations; requiring the State Department of
Education to promulgate rules; providing for
codification; and providing an effective date.
BE IT ENACTED BY THE PEOPLE OF THE STATE OF OKLAHOMA:
SECTION 1. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 3-168.1 of Title 70, unless
there is created a duplication in numbering, reads as follows:
Req. No. 14154 Page 2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
A. This act shall be known and my be cited as the "Parent Data
Sovereignty Act of 2026".
B. 1. The Legislature finds that:
a. parents possess a fundamental right to direct the
upbringing, education, and privacy of their children,
b. public agencies exist to serve citizens, not to
compile or commercialize data on them,
c. current state and federal education data systems
collect and retain personally identifiable student
information without sufficient transparency, consent,
or parental control, and
d. the preservation of liberty in the digital age
requires explicit limits on the collection, retention,
and disclosure of personal data by state agencies.
2. It is the intent of the Legislature to affirm that parents
are the primary stewards of their children's information, to
restrict government data collection to what is legally necessary,
and to provide parents clear rights of notice, access, and consent.
C. As used in this act:
1. "Personally identifiable educational data (PIED)" means any
information maintained by a state education agency or contractor
that could identify an individual student or parent, including but
not limited to, name, student identification, demographic data,
Req. No. 14154 Page 3
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
disciplinary history, test results, biometric or health data, or any
combination thereof;
2. "Parent" means a natural parent, guardian, or person with
legal authority to make educational decisions for the student;
3. "State education agency" means the State Department of
Education and any other public entity or vendor authorized to
collect or process student data; and
4. "Longitudinal linkage" means any state database that links
student information across years, programs, or agencies for tracking
educational or workforce outcomes.
D. All personally identifiable educational data relating to a
minor child is the property of the parent until the student reaches
eighteen (18) years of age. State agencies and their contractors
shall act only as custodians of personally identifiable educational
data and shall not obtain any proprietary or ownership interest of
such data. No state education agency or local school district shall
sell, trade, or license any student data for commercial purposes.
E. A parent shall have the right to:
1. Obtain, within thirty (30) days of request, a complete
record of all data elements collected or maintained on his or her
child by any state education agency or local school district;
2. Request correction or deletion of any inaccurate or
unnecessary data;
Req. No. 14154 Page 4
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
3. Opt out of any nonessential collection or data linkage
beyond what is required by state or federal law for enrollment,
funding, or accountability;
4. Opt out of inclusion in any research study, predictive
analytics model, artificial intelligence training dataset, or cross-
agency workforce linkage; and
5. Receive annual written notice from the school district and
the State Department of Education listing data elements collected,
their purpose, and all authorized data-sharing agreements.
F. 1. No personally identifiable educational data shall be
collected unless expressly authorized by state or federal law. The
following categories shall not be collected or retained without the
written consent of a parent:
a. political or religious affiliation or beliefs,
b. family income or tax information other than free and
reduced lunch eligibility,
c. biometric, health, or psychological data unrelated to
special education services,
d. student social media identifiers or Internet activity,
and
e. any data not directly necessary for educational
instruction or accountability.
Req. No. 14154 Page 5
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
2. New data elements proposed for collection by the State
Department of Education shall receive legislative approval following
public notice and hearing before implementation.
G. 1. Personally identifiable student data shall not be
transferred to any federal or state agencies, including but not
limited to, workforce, health, or human services agencies, or to any
private contractor or nonprofit organization without the written
consent of the parent, or the student if the student has reached
eighteen (18) years of age, unless otherwise authorized by law.
2. Any data-sharing arrangement between multiple agencies shall
be disclosed publicly through the Data Transparency Portal
established under subsection I of this section.
H. 1. The State Department of Education shall develop a
standardized Parent Data Opt-Out Form, available electronically and
in paper format. Upon receipt of a completed form, the local school
district shall exclude the applicable student's records from
longitudinal and cross-agency linkage, and only de-identified or
aggregate data shall be used for state reporting purposes.
2. No student shall be penalized, denied enrollment, or suffer
academic disadvantage for opting out of data sharing as permitted by
this section.
I. In addition to the requirements of Section 3-168 of this
title, the State Department of Education shall create and maintain a
publicly accessible Data Transparency Portal that:
Req. No. 14154 Page 6
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
1. Lists all data elements collected by the Department;
2. Identifies which elements are mandatory versus optional;
3. Publishes copies of all active vendor contracts and data-
sharing agreements;
4. Reports all data breaches or unauthorized disclosures within
thirty (30) days; and
5. Posts annual privacy and security compliance audits required
under this section.
J. 1. Any contractor or vendor handling student data shall:
a. sign a Parent Data Privacy Agreement acknowledging its
obligations under this section,
b. employ industry standard encryption, multi-factor
authentication, and secure data storage protocols,
c. delete or return all data within ninety (90) days of
contract termination, and
d. submit to random privacy and security audits by the
State Department of Education or an independent third-
party auditor.
2. Vendors found in violation may be barred from future
contracts for a period of up to five (5) years.
K. 1. Any person or entity that violates any provision of this
section shall be subject to a civil penalty not to exceed Ten
Thousand Dollars ($10,000.00) per violation, which may be assessed
by a court of competent jurisdiction. Each unauthorized disclosure,
Req. No. 14154 Page 7
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
transfer, sale, or use of personally identifiable educational data
shall constitute a separate violation.
2. Any person who knowingly or intentionally discloses, sells,
transfers, or otherwise makes available personally identifiable
educational data in violation of this section shall be guilty of a
misdemeanor, punishable by imprisonment in the county jail for a
term not to exceed one (1) year, or by a fine not to exceed One
Thousand Dollars ($1,000.00), or by both such imprisonment and fine.
3. Parents may bring a private cause of action for injunctive
relief and damages in the district court of competent jurisdiction
for harm caused by violations of this section.
L. The State Board of Education shall promulgate rules to
implement the provisions of this section within one hundred eighty
(180) days of the effective date of this act.
SECTION 2. This act shall become effective November 1, 2026.
60-2-14154 SW 01/10/26