The bill amends Chapter 71 of the General Laws to enhance the privacy of student and educator data by introducing new sections (34I through 34L) that define key terms and establish regulations for the handling of covered information, which includes any data that can identify a student, teacher, or administrator. It prohibits operators providing services for K-12 purposes from engaging in targeted advertising based on covered information, creating profiles, or selling student information. Operators are required to implement security measures to protect this data and must return or destroy it upon request. Contracts between educational entities and operators must include provisions that prohibit commercial use and ensure data security.

Additionally, the bill mandates the public disclosure of a comprehensive list of categories of covered information collected by the department, detailing the source, reason for collection, and intended use. Each school district is required to develop a privacy and security policy, report significant data breaches to the commissioner within ten business days, and publish a list of categories of student personally identifiable information collected on their website. The bill also requires districts to disclose a list of operators with whom they have contracts related to covered information and establishes an annual training requirement for employees with access to this data, making completion of the training a condition for educator certification.