Act 368 of 2016 / MCL 388.1291-1295
Michigan's K-12 student data privacy statute. Applies to operators of websites, online services, and applications used primarily for K-12 school purposes. Under MCL 388.1295: operators may not engage in targeted advertising based on student data, build non-education-purpose profiles of students, sell or rent student information, or disclose covered information outside enumerated legitimate purposes (school purposes, legal compliance, safety, judicial process, parent-requested educational uses, or contracted service providers with restrictions). Operators must implement reasonable security procedures and delete student data when schools request removal. Permitted: use of de-identified data for product improvement and research, adaptive learning, recommendation engines for educational content not driven by third-party payment. District obligations run through vendor contracting - districts must ensure DPAs bind operators to SOPPA requirements.