New Jersey § 56:8-216

§ 56:8-216.

a. An operator of an online education service shall not knowingly: (1) use information, including covered information, created or gathered by the operator's

online education service, to amass a profile about a student for any purpose other

than K-12 school purposes. A profile shall not include the collection and retention of account information

that remains under the control of the student, the student's parents or guardian,

or K-12 school; (2) sell or rent a student's information, including covered information. This paragraph shall not apply to the purchase, merger, or other type of acquisition

of an operator by another entity if the operator or successor entity complies with

this section concerning previously acquired student information, including covered

information, or to national assessment providers if the provider secures express written

consent of the student or the student's parent or guardian, given in response to clear

and conspicuous notice, solely to provide access to employment, educational scholarships,

financial aid, or postsecondary educational opportunities; (3) disclose covered information unless the disclosure is: (a) made in furtherance of the K-12 school purposes purpose of the service, provided

the recipient of the covered information shall not further disclose the information

unless done to allow or improve the operability and functionality of the operator's

online education service; (b) required by federal or State law to protect against liability; (c) made to respond to or participate in a judicial process; (d) to protect the safety of students or security of the service; (e) for educational or employment purposes requested by the student's parent or guardian,

provided that the covered information is not used or further disclosed for any other

purpose not requested by the student's parent or guardian; (f) to a third party if the operator contractually prohibits the third party from

using any covered information for any purpose other than providing the contracted

service to or on behalf of the operator, prohibits the third party from disclosing

any covered information provided by the operator with subsequent third parties, and

requires the third party to implement and maintain reasonable security procedures

and practices; or (g) for legitimate research purposes, subject to the requirements of paragraphs (1)

through (3) of this subsection: (i) as required by federal or State law and subject to the restrictions of the application

of federal or State law; (ii) as allowed by federal or State law and under the direction of a K-12 school,

school district, or the Department of Education, if no covered information is used

for any purpose in furtherance of advertising or to amass a profile on the student

for any purpose that is not in furtherance of a K-12 school purpose; or (iii) for use by a federal, State, or local educational agency, including K-12 schools

and school districts, for K-12 school purposes, as permitted by federal or State law;

and (4) engage in targeted advertising on the operator's service, or target advertising

on any other Internet website, online service, online computer application, or mobile

application if the targeted advertising is based on any information, including covered

information, that the operator's service has acquired because of the use of the operator's

service for K-12 school purposes. b. Nothing in this section shall be construed to prohibit the operator's use of covered

information for maintaining, developing, supporting, diagnosing, or improving the

operator's online education service.