Schools; Parent Data Sovereignty Act of 2026; legislative findings; definitions; prohibiting student data use or transfer for commercial purposes; parental rights to student data; opt out; Data Transparency Portal; contractors and vendors protection of data; violations; rules; effective date.
HB3547, the “Parent Data Sovereignty Act of 2026,” would create a new section of Oklahoma law governing the collection, use, disclosure, and retention of student data by the State Department of Education, local school districts, and their contractors. The bill declares that parents are the primary stewards of their children’s information and that personally identifiable educational data for minors is the property of the parent until the student turns 18. It would bar schools and education agencies from selling, trading, or licensing student data for commercial purposes and would limit collection to what is expressly authorized by law or otherwise approved with parental consent.
The bill gives parents broad access and control rights over student records. Parents could request a complete record of data collected on their child, seek correction or deletion of inaccurate or unnecessary information, opt out of nonessential data collection and cross-agency linkage, and exclude their child from research studies, predictive analytics, AI training datasets, and workforce linkages. It also prohibits collection of certain sensitive categories—such as political or religious beliefs, nonessential health or biometric data, social media identifiers, and internet activity—without written parental consent, and requires legislative approval before new data elements may be collected.
HB3547 would also require the State Department of Education to create a standardized parent opt-out form and a public Data Transparency Portal. The portal would have to list data elements collected, identify mandatory versus optional items, publish vendor contracts and data-sharing agreements, report breaches, and post annual privacy and security audits. Contractors and vendors handling student data would be required to sign privacy agreements, use security safeguards such as encryption and multi-factor authentication, delete or return data after contract termination, and submit to audits.
The bill includes enforcement mechanisms that could significantly affect schools, vendors, and agencies. Violations could result in civil penalties of up to $10,000 per violation, misdemeanor criminal liability for knowing or intentional misuse of student data, and a private right of action for parents seeking injunctive relief and damages. The State Board of Education would be required to adopt rules within 180 days of enactment, and the act would take effect November 1, 2026. Overall, the bill’s impact would be to substantially tighten state education-data practices and increase parental control, transparency, and liability exposure for data handlers.
HB3547 would amend Oklahoma education law by adding a new statutory framework in Title 70 governing student data privacy and governance. It would restrict the State Department of Education, school districts, and vendors from collecting, retaining, sharing, or monetizing personally identifiable educational data except as authorized by law or with parental consent, while also creating new notice, access, opt-out, transparency, security, and enforcement requirements. The bill would directly affect school districts, the State Department of Education, education technology vendors, contractors, and any agencies receiving student data through cross-agency linkages.
No committee transcript or vote history is available in the provided context, so there is no recorded floor or committee sentiment to summarize. Based on the bill text alone, the measure appears strongly privacy-oriented and parent-rights focused, reflecting a policy preference for limiting government and vendor access to student information. Its framing suggests support from privacy advocates and parents concerned about data collection, though the bill’s broad restrictions and compliance obligations could draw resistance from education administrators, data vendors, and agencies that rely on data-sharing for reporting, research, and service coordination.
The main points of contention are likely to be the breadth of parental control, the limits on data sharing, and the operational burden on schools and state agencies. Supporters would likely emphasize privacy, transparency, and preventing commercialization or secondary use of student data, while opponents may argue that the bill could hinder legitimate educational administration, accountability reporting, research, and cross-agency services. Additional friction points include the requirement for legislative approval of new data elements, the opt-out from AI and predictive analytics uses, the public posting of vendor contracts and breach reports, and the civil, criminal, and private litigation penalties imposed on violators.