Student Consent Amendments

Students gain control over education records

Beginning July 1, 2026, current and former Utah public K–12 and college students can access their education data and authorize sharing. Covered data includes transcripts, enrollment information, course history, and academic credentials. Schools need a parent's informed consent to share an under-18 student's data with anyone other than that student. Consent must be voluntary and written, identifying the data, purpose, recipient, scope, duration, and whether program participation requires consent. Students or parents must be able to review those details and revoke consent at any time. Schools cannot bundle unrelated terms, demand unrelated rights waivers, or block or delay valid consent. Schools can set reasonable access windows, but must allow renewed access without unduly limiting students' rights. Beginning July 1, 2027, secure digital consent must be the primary option; written consent remains allowed when digital access is not reasonably available. Third parties must agree to follow consent terms and cannot use or reshare data beyond them, unless applicable law allows it. Those receiving data for more than 10 students face added state privacy duties and relevant board policies and rules. Students whose data is shared because of third-party noncompliance can sue that third party, but not the school under this right. Federal student privacy law and other applicable privacy laws still apply.