§ 2443a. Operator prohibitions

(a) An operator shall not knowingly do any of the following with respect to its site, service, or application:

(1) Engage in targeted advertising on the operator's site, service, or application or target advertising on any other site, service, or application if the targeting of the advertising is based on any information, including covered information and persistent unique identifiers, that the operator has acquired because of the use of that operator's site, service, or application for PreK-12 school purposes.

(2) Use information, including a persistent unique identifier, that is created or gathered by the operator's site, service, or application to amass a profile about a student, except in furtherance of PreK-12 school purposes. “Amass a profile” does not include the collection and retention of account information that remains under the control of the student, the student's parent or legal guardian, or the school.

(3) Sell, barter, or rent a student's information, including covered information. This subdivision (3) does not apply to the purchase, merger, or other type of acquisition of an operator by another entity if the operator or successor entity complies with this subchapter regarding previously acquired student information.

(4) Except as otherwise provided in section 2443c of this title, disclose covered information, unless the disclosure is made for one or more of the following purposes and is proportionate to the identifiable information necessary to accomplish the purpose:

(A) to further the PreK-12 school purposes of the site, service, or application, provided:

(i) the recipient of the covered information does not further disclose the information except to allow or improve operability and functionality of the operator's site, service, or application; and

(ii) the covered information is not used for a purpose inconsistent with this subchapter;

(B) to ensure legal and regulatory compliance or take precautions against liability;

(C) to respond to judicial process;

(D) to protect the safety or integrity of users of the site or others or the security of the site, service, or application;

(E) for a school, educational, or employment purpose requested by the student or the student's parent or legal guardian, provided that the information is not used or further disclosed for any other purpose; or

(F) to a third party if the operator contractually prohibits the third party from using any covered information for any purpose other than providing the contracted service to or on behalf of the operator, prohibits the third party from disclosing any covered information provided by the operator to subsequent third parties, and requires the third party to implement and maintain reasonable security procedures and practices.

(b) This section does not prohibit an operator's use of information for maintaining, developing, supporting, improving, or diagnosing the operator's site, service, or application.