Washington Revised Code Title 28A. Common School Provisions § 28A.604.030. Collection, sharing, and use of student personal information--Authorized purposes and uses--Consent

(1) School service providers may collect, use, and share student personal information only for purposes authorized by the relevant educational institution or teacher, or with the consent of the student or the student's parent or guardian.

(2) School service providers may not sell student personal information. This prohibition does not apply to the purchase, merger, or other type of acquisition of a school service provider, or any assets of a school service provider by another entity, as long as the successor entity continues to be subject to the provisions of this section with respect to previously acquired student personal information to the extent that the school service provider was regulated by this chapter with regard to its acquisition of student personal information.

(3) School service providers may not use or share any student personal information for purposes of targeted advertising to students.

(4) School service providers may not use student personal information to create a personal profile of a student other than for supporting purposes authorized by the relevant educational institution or teacher, or with the consent of the student or the student's parent or guardian.

(5) School service providers must obtain consent before using student personal information in a manner that is materially inconsistent with the school service provider's privacy policy or school contract for the applicable school service in effect at the time of collection.

(6) The provisions of subsections (1), (2), (4), and (5) of this section may not apply to the use or disclosure of personal information by a school service provider to: