State guide: California

California school internet safety laws: CIPA plus the state layer

California districts filter to the federal CIPA standard, then add state rules on student data, vendor contracts, social media monitoring and smartphones. This guide shows how the pieces fit and what your web filter and monitoring tools need to respect.

The four layers a California district works within

Federal CIPAFiltering, internet safety policy, monitoring of minors, tied to E-Rate.
Student data lawsSOPIPA for school-focused vendors, Education Code 49073.1 for district contracts.
Social media monitoringEducation Code 49073.6 notice and comment before such a program.
Smartphone policyEducation Code 48901.7, made mandatory by AB 3216.
Part 1

What CIPA already requires of California schools

The federal Children's Internet Protection Act applies to schools and libraries that take E-Rate discounts for internet access or internal connections. It is the same in Fresno as in Florida. For the long version, read our guide on what CIPA is and who it covers.

Technology protection measure

  • Blocks or filters visual depictions that are obscene or child pornography.
  • For computers used by minors, also blocks material harmful to minors.
  • Can be disabled by an authorized person for an adult doing bona fide research or other lawful purposes.

Internet safety policy

  • Covers access to inappropriate matter, safety in email, chat and other direct messaging.
  • Addresses unauthorized access such as hacking, and unauthorized disclosure of minors' personal information.
  • Includes measures restricting minors' access to harmful material.
  • Adopted after reasonable public notice and at least one public hearing or meeting.

School-specific extras

  • The policy must provide for monitoring the online activities of minors.
  • Schools must educate minors about appropriate online behavior, including social networking, chat rooms and cyberbullying awareness.
  • Certification is filed on FCC Form 486, or Form 479 for consortium members.
Key point: CIPA does not tell you which product to buy or which categories to block beyond the visual depiction standard. Each district decides what else to block, and that local choice is where California's state rules start to matter. Our CIPA compliance checklist walks through the federal items one by one.
CIPA plus California's data layer

A filter that does the CIPA job and leaves less data to govern

California has no separate K-12 filtering statute, but its student data and vendor contract rules shape what a filter should collect. Our hosted CIPA filter decides by domain, not by page, and is not a monitoring or classroom screen tool.

  • Category rules cover the federal duty, with Adult and VPN/Proxy/Anonymizers on in the preset
  • Separate settings for each school or branch fit districts of very different sizes
  • Activity reports and a log export give the vendor file something solid to point to
Category switches in the hosted filter that a California district sets for each school
Milliseconds
for the filter to answer each domain lookup
120M+
categorized domains used for every decision
1 DNS setting
per site, nothing installed on student computers
Review the hosted filter for California districtsTalk about a California pilotSee the category of any domain
Part 2

What California adds: the state laws that touch school internet use

We are not aware of a California statute that creates a separate filtering standard for K-12 networks. Instead, the state regulates the data your filter collects, the contracts you sign, social media monitoring and personal phones. Confirm the current text before relying on any summary below.

Business and Professions Code 22584SB 1177 (2014)

SOPIPA: the Student Online Personal Information Protection Act

SOPIPA regulates operators of websites, online services and apps that know their product is used mainly for K-12 school purposes and was designed and marketed for that use. It applies whether or not the operator has a contract with the district.

Restricts
Targeted advertising using student information, building student profiles for non-school purposes, selling student information and most disclosures.
Requires
Reasonable security for covered information, and deletion when the school or district asks.
Filter angle
School filtering and monitoring vendors often fit the operator definition. Ask how browsing logs are protected and used.
Education Code 49073.1AB 1584 (2014)

District contracts for digital records and software

A local educational agency may contract with a third party to store pupil records digitally, or for software that can access them, under a policy adopted by its governing board. The contract must contain specific terms.

Must state
Pupil records stay the property and under the control of the district, and the vendor may not use them beyond the contract.
Also covers
Security actions, breach notification to parents, return or deletion at contract end, a parent review and correction route, and FERPA compliance.
Risk
A contract that fails these requirements can be rendered void under conditions set in the statute.
Education Code 49073.6AB 1442 (2014)

Gathering pupil social media information

A district, county office or charter school that considers a program to gather or maintain social media information about pupils must first notify pupils and parents and allow public comment at a regularly scheduled public meeting.

Scope
Social media is defined broadly, but accounts used only for education or school publications are excluded.
Retention
The statute sets limits on how long gathered information is kept and extends duties to contracted vendors. Check the current text for exact terms.
Filter angle
Blocking a social network is not the same as gathering what pupils post. Content capture features need a closer look.
Education Code 48901.7AB 272 (2019)AB 3216 (2024)

Smartphone policy: from optional to required

AB 272 let districts, county offices and charter schools limit or prohibit pupil smartphone use. AB 3216, the Phone-Free School Act, made a policy mandatory, with adoption due by July 1, 2026.

Exceptions
Use must remain possible in an emergency or perceived threat, with staff permission, on a doctor's determination and where an IEP requires it.
Upkeep
Reports on AB 3216 state that the policy must be updated every five years. Confirm in the current statute.
Filter angle
Personal phones on cellular data sit outside your network filter. The policy, not the filter, governs them.
Also relevant: federal FERPA still applies to California education records, alongside state law. See our guide to student data privacy, FERPA and web filtering for how browsing logs fit into education records.
Part 3

Timeline of California rules that affect school internet use

The data laws came as a 2014 package. The phone rules came in two steps. Read them as a sequence, because district policies written in 2015 may never have been revisited.

2001

Federal CIPA enacted

Filtering and internet safety policy conditions attach to E-Rate. California districts certify through the federal forms like every other state.

2014

SOPIPA, AB 1584 and AB 1442 signed

California adds rules for school-focused online services, for district contracts that touch pupil records and for social media information programs.

2015

Contract rules apply to new and renewed agreements

Education Code 49073.1 does not reach contracts in effect before January 1, 2015 until they expire, are amended or are renewed.

2020

AB 272 takes effect

Education Code 48901.7 allows local smartphone limits, with required exceptions for emergencies, health and IEPs.

2024

AB 3216, the Phone-Free School Act, signed

The Governor signed the bill in September 2024. It turns the optional smartphone policy into a duty for every district, county office and charter school.

July 1, 2026

Smartphone policy deadline

The adopted policy should now be on board record. If yours is still in draft, treat it as a priority item with counsel.

Social apps and the phone rules

Chat and community sites a California district may need to sort

The state phone rules and social media monitoring policies put attention on apps students use between classes. This is how our data labels a few of them, including sites that carry several categories.

SiteCategories in our data
pinterest.comSocial Networking
twitch.tvStreaming Media, Gaming
whatsapp.comEmail and Messaging, Social Networking
kik.comEmail and Messaging, Social Networking
reddit.comSocial Networking, Forums / Message Boards, Community Sites
Search for an app your students use
Part 4

What California law means for web filtering and monitoring tools

The filter still has to do its CIPA job. California law mostly changes what the filter records, who can see it, how long it is kept and what the vendor contract says.

LawQuestion to ask about your filter or monitoring toolTypical configuration response
CIPAAre obscene, child abuse and harmful-to-minors depictions blocked on every device minors use, on and off campus where you provide access?Category blocking for adult content plus related categories you choose locally, applied to network and school-managed devices.
SOPIPADoes the vendor use browsing data for advertising, profiling or sale? Will it delete data on request?Written vendor statement, data use terms, deletion process tested on a sample account.
Ed Code 49073.1Does the contract say pupil records remain district property and set out security, breach notice and deletion?Contract addendum with each required term, signed before rollout or at renewal.
Ed Code 49073.6Does any feature gather or keep pupils' social media posts or profiles?Disable capture features, or run the notice and public comment process before turning them on.
Ed Code 48901.7Does the smartphone policy reference school devices and network rules consistently?Align the acceptable use policy with the phone policy so students hear one set of rules.

Category choice

Start with Adult, then decide on Gambling, Weapons, Illegal Drugs, Violence, Hate/Discrimination and VPN / Proxy / Anonymizers by grade band.

Log retention

Keep browsing logs only as long as your policy says. Shorter retention means less pupil data to protect.

Access roles

Limit who can open individual student histories. Many staff only need aggregate reports.

Take-home devices

Filtering that follows the device keeps CIPA coverage consistent once students leave the campus network.

Good practice for California districts

  • Map each data field your filter logs and note why you need it.
  • Keep one register of vendors that touch pupil records, with contract dates.
  • Use proxy and anonymizer blocking so the filter cannot be bypassed easily.
  • Review your school acceptable use policy whenever the phone policy changes.

Common gaps we see

  • Renewing a filter contract without adding the 49073.1 terms.
  • Switching on a social media alerting feature without any notice to families.
  • Keeping years of full URL history for every student by default.
  • Assuming the phone policy covers school Chromebooks. It is a separate topic.

For managed devices, see our guide to Chromebook 1:1 device filtering and how to enforce CIPA on off-campus student devices.

What the filter keeps and what it skips

Domain-level records for a data-conscious state

The hosted filter works on the domain requested, with activity reports, a policy record and a log export for the file. It does not read pages or messages, which keeps the answer to a parent's data question short.

Read what the reports and logs contain
Part 5

California school internet compliance checklist

Tick items as you go. The boxes are for your own working session and are not saved anywhere.

Federal baseline
California data and contracts
Phones and alignment
Part 6

Evidence to keep for an audit or a parent request

Federal reviewers ask for CIPA proof. Parents and boards in California ask about data. Keep both in one place so a request takes minutes, not weeks.

CIPA folder

  • Adopted internet safety policy
  • Public notice and minutes
  • Filter category export with date
  • Form 486 or 479 confirmation

Vendor folder

  • Signed contracts and addenda
  • SOPIPA and security statements
  • Deletion confirmations at contract end
  • Breach contact details

Monitoring folder

  • List of enabled monitoring features
  • Any 49073.6 notices and comment records
  • Staff roles with access to student logs
  • Retention settings screenshot

Education folder

  • Digital citizenship lessons by grade
  • Staff training attendance
  • Parent information sessions

Phone policy folder

  • Board-adopted smartphone policy
  • Adoption date and review date
  • Exception request process

Test folder

California district checks: a patchwork or one hosted filter

The rows reflect what a California IT team has to line up for CIPA and the state's data rules at once.

California needSeveral tools stitched togetherHosted CIPA filter
Blocking harmful categories for CIPARules in more than one productOne console, Adult and VPN/Proxy/Anonymizers on in the preset
Different settings across a large districtCopies of one policySeparate settings per school or branch
Less student detail to protectDepends on the toolsDecides by domain, not by page
Take-home Chromebooks and laptopsAgent or account policy on eachA private encrypted link keeps the rules on the device
Evidence for an audit or a parent requestScreenshots and exportsActivity reports, policy record and log export
Staff needing blocked materialEdit the list, undo it laterPIN bypass for 15, 30 or 60 minutes, logged, then it switches back
Look into the hosted filterAsk for a California quote
Part 7

California school internet safety FAQ

Short answers to questions district IT teams and librarians ask us most.

Does California have its own school web filtering law on top of CIPA?
We are not aware of a California statute that sets its own filtering standard for K-12 networks. The filtering duty most districts work to is federal CIPA, tied to E-Rate. California adds rules on student data, vendor contracts, social media monitoring and smartphones. Check current law with counsel.
Does SOPIPA apply to our web filter vendor?
SOPIPA applies to operators that know their product is used primarily for K-12 school purposes and was designed and marketed for that use. Many school filtering and monitoring products fit that description. Ask each vendor how it meets SOPIPA and review the contract terms.
Does a filtering tool count as gathering social media information under Education Code 49073.6?
It depends on what the tool does. Blocking a social site differs from collecting and keeping what pupils post. If a product gathers or retains pupil social media content, treat it as a possible 49073.6 program and ask counsel to review it.
Did the Phone-Free School Act require new filtering?
No. AB 3216 required a policy limiting or prohibiting student smartphone use by July 1, 2026. It concerns personal phones, not network filtering. It does tend to move more student internet use onto school devices, which your filter already covers.
Can we block social media sites outright?
CIPA lets districts block more than the federal minimum, and many do. Weigh instructional needs by grade. Our page on social media filtering in schools covers common approaches.
Do students' own phones on the school Wi-Fi need filtering?
Traffic that passes through your network can be filtered at the network or DNS layer, so guest and student Wi-Fi is usually covered by the same category rules. A phone on its own cellular plan bypasses that path. That is one reason the smartphone policy and the filter need to be read together.
Should AI chat tools be blocked in California schools?
No California statute we know of requires blocking them. Districts decide by grade and purpose. A separate category for AI tools lets you allow approved ones for staff and older students while blocking others. See our AI tools blocklist for schools.
How often should we review all of this?
A yearly review before the E-Rate filing window works for most districts. Revisit sooner when a filter or monitoring contract renews, when a new feature is switched on, or when the legislature amends one of the codes above.
What should a California district keep as evidence?
Keep your internet safety policy and adoption meeting records, filter configuration exports, Form 486 records, vendor contracts with the 49073.1 terms, any 49073.6 notices, and the board-adopted smartphone policy.
More states

Compare other state school internet rules

Each state layers its own rules on the same federal base. These guides follow the same structure, so you can compare quickly.

Texas SCOPE Act school complianceHB 18 device standards, filters on transferred devices, banned apps. New York school internet safety lawsEducation Law 2-d, Part 121 and the bell-to-bell device rule. Ohio SB 29 school complianceMonitoring limits on school-issued devices and parent notices.

Want the full list? Browse every state on our school internet safety laws by state hub.

Related guides

The price depends on how many schools and devices you run, and we send a quote within one business day. A pilot on a single California school shows the blocks and reports before you sign anything.

Not legal advice. This page summarizes federal and California rules in our own words for general information. Laws, regulations and guidance change, and section details here may not reflect the latest amendments. Check the current statutes and guidance, and confirm your obligations with your district's legal counsel before acting.

Talk to us about your California district

Tell us how your network, devices and contracts are set up. We can walk you through CIPA category coverage, the hosted CIPA filter pilot and how our category data fits your current tools.

Talk to us about your district

Chromebook is a trademark of Google LLC. It is used here only to identify the device type discussed. CIPA Web Filtering is not affiliated with, sponsored or endorsed by Google LLC.