California Governor Gavin Newsom signed Assembly Bill 1159 (“AB 1159”) on September 10, 2026, expanding California’s existing student data privacy protections and placing new limits on how student information may be used in artificial intelligence (“AI”) systems.

AB 1159 modifies the K-12 Pupil Online Personal Information Act (“KOPIPA”) and the Early Learning Personal Information Act (“ELPIPA”), which regulate how operators of websites, online services, applications, and other digital products used for educational purposes collect and use student information. Most notably, AB 1159 prohibits covered operators from using student information collected through their products to train a generative AI system or to develop an AI system. Protected information includes persistent unique identifiers and other covered information collected or generated through the product.

The law also extends similar protections to students in higher education through the newly created Higher Education Student Information Protection Act (“HESIPA”), which becomes operative July 1, 2027. AB 1159 also enables students who are actually harmed by an operator’s failure to comply with KOPIPA, ELPIPA, or HESIPA to bring a civil action.

AB 1159 is part of a broader package of recently enacted California legislation addressing children’s use of AI and other emerging technologies. Other measures regulate companion chatbots, restrict certain features of social media for users under 16, and expand child sexual exploitation laws to include certain digitally altered or AI generated material.

As AI-enabled tools become increasingly common in schools, local education agencies should review their technology procurement practices, vendor agreements, and data use terms to understand how third party vendors may protect, collect, and use student information.

The authors extend a special thank you to Jackie Haigh, post-bar law clerk, for her contribution to the alert.