Assemblymember Dawn Addis authored AB 1159 to protect college student privacy and security within educational artificial intelligence technology. If passed, the bill would extend personal privacy protections found in K-12 education into higher education.
AB 1159, Student Personal Information, closes privacy gaps for California college students by preventing educational technology from using student data to train and develop AI, according to the CalMatters Digital Democracy database. The bill extends sensitive personal information and student data protections into higher education, according to Addis.
“I think there’s a piece around privacy, but there’s also a piece around being able to protect your future as a college student and not be leveraged by big tech, basically that’s either selling your data or using your data to sell products to you,” Addis said in an interview with Mustang News.
AB 1159 also establishes a civil action allowing violated students to file civil suits against tech companies violating privacy protection laws.
“Students don’t have to sacrifice their privacy for education,” Addis said.
A concern for some Cal Poly students is the use of writing towards AI development and training. Students were shocked and surprised by their data being utilized without their knowledge or consent.
“That doesn’t sit right with me,” said Morgan Hoston, a political science freshman. “It’s my intellectual property, my own ideas that I’m writing down. I don’t know if I want that to be shared or used for AI. That’s really weird.”
Major educational technology provider, Illuminate Education, was found to have breached student privacy protections. Third-party EdTech companies are not obligated for student security and have sold student data that can include citizenship, primary language, home address and personal info to private companies, according to Addis.
“And they were selling student data,” Addis said.
AB 1159 expands off previous acts
Addis’ proposed AB 1159, which expands an existing K-12 law into higher education. The bill establishes the Higher Education Student Information Protection Act, aimed at extending privacy protections to college students. The adoption of the bill would implement HESIPA in July 2027 into higher education and college students.
Additionally, the existing K-12 Pupil Online Personal Information Protection Act, restricts how third party technology collects, discloses and uses personal information, according to CalMatters. They ensure parental rights to access records, enforce safety measures on websites and prohibit targeted advertising towards students.
“This bill will create those protections, and then it will create enforcement mechanisms if a student is actually harmed by such violations,” Addis said in an interview with Mustang News.
Enforcement of AB 1159 would be through private right of action, empowering individuals to sue educational technology for violating student privacy, according to CalMatters. Additionally, stated in AB 1159 bill text, Section 22584 facilitates a 45 day period to garner class action cases of violated student privacy.
SB 1159 is not the only initiative to provide additional privacy protections for college students. An additional bill, SB 1101, requires companies to notify individuals before sharing personal data to outside parties, specifically targeted toward the U.S. Department of Education’s Office for Civil Rights.
California’s privacy framework protects student data and closes loopholes that allow sensitive personal information to be collected, shared or monetized without safeguards, expanding the preexisting student protections into higher education.
AB 1159 passed through the Assembly in January and is now in the Senate, sitting in the first chamber. SB 1101 is currently in committee in the Senate.