(1) "Aggregate student data" means data that is not personally identifiable and that is collected or reported at the group, cohort, or institutional level.

(2) "De-identified data" means a student data set that is not student personally identifiable information because the local board of education or department or other party has made a reasonable determination that a student's identity is not personally identifiable, whether through single or multiple releases, and taking into account other reasonably available information.

(3) "Department" means the Department of Education.

(4) "Education record" means an education record as defined in the Family Educational Rights and Privacy Act (FERPA) and its implementing regulations, 20 U.S.C. Section 1232g; and 34 C.F.R. Part 99.3. An education record does not include the types of student data excepted in FERPA, does not include student data collected by an operator when it is used for internal operations purposes, does not include student data that is not formatted for or expected to be accessed by school, local board of education, or department employees, nor does it include student data that a local board of education determines cannot reasonably be made available to the parent or eligible student.

(5) "Eligible student" means a student who has reached 18 years of age or is attending an institution of postsecondary education.

(6) "K-12 school purposes" means purposes that take place at the direction of the K-12 school, teacher, or local board of education or aid in the administration of school activities, including, but not limited to, instruction in the classroom or at home, administrative activities, preparing for postsecondary education or employment opportunities, and collaboration between students, school personnel, or parents, or are for the use and benefit of the school.

(7) "Online service" includes cloud computing services.

(8) "Operator" means any entity other than the department, local boards of education, the Georgia Student Finance Commission, or schools to the extent that the entity:

(A) Operates an Internet website, online service, online application, or mobile application with actual knowledge that the website, service, or application is used for K-12 school purposes and was designed and marketed for K-12 school purposes to the extent that it is operating in that capacity; and

(B) Collects, maintains, or uses student personally identifiable information in a digital or electronic format.

(9) "Provisional student data" means new student data proposed for inclusion in the state data system.

(10) "State-assigned student identifier" means the unique student identifier assigned by the state to each student that shall not be or include the social security number of a student in whole or in part.

(11) "State data system" means the department state-wide longitudinal data system established pursuant to Code Section 20-2-320.

(12) "Student data" means information regarding a K-12 student who is a resident of this state that is collected and maintained at the individual student level in this state, including but not limited to:

(A) Data descriptive of a student in any media or format, including but not limited to:

(i) The student's first and last name;

(ii) The name of the student's parent or other family members;

(iii) The physical address, email address, phone number, or other information that allows physical or online contact with the student or student's family;

(iv) A student's personal identifier, such as the student number, when used for identification purposes;

(v) Other indirect identifiers, such as the student's date of birth, place of birth, and mother's maiden name;

(vi) State, local, school, or teacher administered assessment results, including participation information;

(vii) Transcript information including but not limited to courses taken and completed, course grades and grade point average, credits earned, degree, diploma, credential attainment, or other school exit information;

(viii) Attendance and mobility information between and within local school systems in this state;

(ix) The student's sex, race, and ethnicity;

(x) Program participation information required by state or federal law;

(xi) Disability status;

(xii) Socioeconomic information;

(xiii) Food purchases; or

(xiv) Emails, text messages, documents, search activity, photos, voice recordings, and geolocation information; or

(B) Such information that:

(i) Is created or provided by a student, or the student's parent or legal guardian, to an employee or agent of the school, local board of education, or the department or to an operator in the course of the student's or parent's or legal guardian's use of the operator's site, service, or application for K-12 school purposes;

(ii) Is created or provided by an employee or agent of the school or local board of education, including to an operator in the course of the employee's or agent's use of the operator's site, service, or application for K-12 school purposes; or

(iii) Is gathered by an operator through the operation of an operator's site, service, or application for K-12 school purposes.

(13) "Student personally identifiable data" or "student personally identifiable information" or "personally identifiable information" means student data that personally identifies a student that, alone or in combination, is linked to information that would allow a reasonable person who does not have personal knowledge of the relevant circumstances to identify the student.

(14) "Targeted advertising" means presenting advertisements to a student where the advertisement is selected based on information obtained or inferred from that student's online behavior, usage of applications, or student data. Targeted advertising does not include advertising to a student at an online location based upon that student's current visit to that location or single search query without collection and retention of a student's online activities over time.