Illinois School Internet Safety Laws for K-12 Districts
Illinois does not add a separate filtering mandate on top of CIPA. What it adds is one of the strictest student data laws in the country, a yearly internet safety lesson and, from 2027-28, a statewide phone policy.
Does Illinois have its own school web filtering law?
This is the question most Illinois technology directors ask first, so we answer it plainly before anything else.
No specific state filtering mandate that we could verify
We did not find an Illinois statute that tells K-12 districts which content to filter beyond what CIPA already requires. Filtering in Illinois schools rests on CIPA and the E-Rate certification.
The Illinois layer is about what happens to student data, what students are taught and when they may use personal devices. Each of those still shapes how you run a filter.
What this means in practice
- Your category choices beyond the CIPA minimum, such as social media, games or AI tools, are local board decisions in Illinois.
- Your choice of filter vendor is a student data decision under SOPPA, not only a technical one.
- Your phone policy, once adopted, changes how much student browsing runs through district systems.
Who this page is for
- Technology directors and network staff in Illinois public districts.
- Data privacy leads who manage SOPPA lists and agreements.
- Private and parochial schools that take E-Rate and so follow CIPA.
- Edtech vendors selling filtering or monitoring into Illinois schools.
Choose Illinois filtering that is simple to explain to a data privacy lead
Under SOPPA, every tool a district adds raises questions about what it collects. Our hosted CIPA filter is a DNS filter that decides by domain, not by page, with nothing installed on school computers.
- Separate settings for each school help you answer the board's questions building by building
- It is not a monitoring or classroom screen tool, so the scope of the review stays narrow
- Reports and a policy record support your CIPA file and your operator paperwork
What CIPA requires in Illinois schools and libraries
CIPA applies to every Illinois school and library that takes E-Rate discounts for internet access or internal connections. Read the full explanation in what is CIPA.
The three duties
- Technology protection measure: block visual depictions that are obscene, child pornography or harmful to minors on computers minors use.
- Internet safety policy: adopted after public notice and a hearing or meeting, covering the five CIPA topics.
- Monitoring and education: oversee minors' online activity and teach appropriate online behavior, including social networking and cyberbullying.
How it is certified
- Schools and libraries certify on FCC Form 486 each funding year.
- Consortium members certify to the lead on Form 479.
- Records may be reviewed in an audit, and an inaccurate certification can lead to recovery of discounts.
- The money side is explained in E-Rate and CIPA funding.
Illinois laws that touch school internet safety
The matrix shows which rule drives which part of your program. Citations are given so your counsel can check the current text.
| Law | Main subject | Who carries the duty | Effect on filtering and monitoring |
|---|---|---|---|
| CIPA (federal) | Filtering, policy, monitoring | E-Rate schools and libraries | Sets the categories that must be blocked and the monitoring duty. |
| SOPPA, 105 ILCS 85 | Student data held by online services | Districts, ISBE and operators | Filter and monitoring vendors that collect student data need agreements and must be listed. |
| ISSRA, 105 ILCS 10 | School student records | Schools | Logs tied to a named student may become student records; set access and retention rules. |
| 105 ILCS 5/27-13.3 | Internet safety instruction | School districts | Supports the CIPA education duty; keep lesson records. |
| 105 ILCS 5/27-23.7 | Bullying, including cyberbullying | Schools | Monitoring alerts may feed bullying procedures; align who sees them. |
| SB 2427 (signed 2026) | Wireless device policies | School districts | Pushes more student browsing onto managed devices and district networks. |
| BIPA, 740 ILCS 14 | Biometric identifiers | Private entities, including vendors | Relevant if any safety or monitoring tool uses face or voice data. |
What Illinois adds on top of CIPA
Three state laws do most of the work for school technology teams. Summaries are in our own words; check the statute text and ISBE guidance for the exact language.
Student Online Personal Protection Act (SOPPA)
Amended version in force since 1 July 2021SOPPA governs how operators of K-12 online services, districts and the state board handle covered student information. It is the Illinois law most likely to affect how you buy and configure a filter.
Internet safety education
Yearly, grade 3 and aboveIllinois districts include an internet safety component in the curriculum, taught at least once each school year to students in grade 3 and above. The school board decides the scope and duration of the unit.
Bell-to-bell wireless device policies
Signed 28 July 2026, policies due for 2027-28Districts must adopt policies that broadly restrict student use of personal wireless communication devices during the school day. The definition reaches beyond phones to tablets, laptops, gaming devices and wearables such as smartwatches.
SOPPA and school web filters: a five-step workflow
Most cloud filters and monitoring tools identify students by account, so they collect covered information. Treat them like any other operator.
Map the data
List what the filter collects: account IDs, device IDs, URLs, timestamps, alerts, screenshots.
Sign the agreement
Use your SOPPA-compliant data agreement, covering security, breach notice and deletion.
Publish the listing
Add the vendor, data elements and subcontractors to your posted operator list.
Limit access
Give full URL history to a small group; others see category-level reports.
Set retention
Keep logs long enough for safety review and audits, then delete on a schedule.
Questions to ask a filtering vendor
- Which student data elements do you store, and where?
- Who are your subcontractors that can access student data?
- How fast will you tell us about a breach, and in what form?
- Can we set log retention ourselves and delete on request?
- Can category decisions run on our own systems without sending browsing data out?
A lower-data option
- A downloadable category database runs inside district systems, so URL lookups need not leave your network.
- Formats such as DNS RPZ, firewall external dynamic lists and PAC files plug into existing gear.
- Reports can stay at category level, which is often enough for CIPA monitoring.
- See student data privacy and filtering for the federal angle.
What the Illinois phone law changes for school networks
A device policy is not a filter policy, but it decides which devices end up on your network and which browse on cellular data out of your reach.
More traffic on managed devices
With personal devices put away, district laptops and tablets carry almost all student browsing. Filter coverage there matters most.
Guest Wi-Fi rules
Decide whether students may join guest Wi-Fi at lunch in high schools that allow it, and give that network a student-grade category policy.
Exception devices
Devices allowed for medical, IEP or translation needs may need network access. Assign them a filter policy and note it.
Timing
Policies are due for 2027-28. ISBE was asked to publish a model policy first; check for it before drafting.
Community input
Expect board discussion and parent questions. Have a clear explanation of what the filter does and does not see.
Bypass pressure
Students who lose phone access often try VPN extensions and proxy sites on school devices. Block those categories.
Holding the line when students turn to VPN extensions on school devices
Once personal phones are away, bypass attempts tend to move to the school laptop. In our hosted CIPA filter the VPN/Proxy category stays blocked even when staff use the adult research PIN, and public encrypted DNS and browser settings that skip the filter are blocked by default.
What Illinois law means for web filtering and monitoring
Since Illinois adds no extra content categories, your category policy follows CIPA plus local board choices. These are the categories most Illinois districts review.
Monitoring with privacy in mind
- Use category-level dashboards for routine oversight.
- Send safety alerts to a named team with a written process.
- Keep cyberbullying alerts inside your bullying procedures.
- Review who has access to named-student logs every term.
Keep coverage current
- About 300,000 newly registered domains are categorized every day, which catches new proxy and AI sites early.
- Check a site's categories with the domain checker.
- Extend rules to take-home devices; see 1:1 device filtering.
How our data labels common school platforms an Illinois district might list
These are the classroom tools that tend to appear in an operator inventory. The categories below come from our database.
| Platform | Categories in our data |
|---|---|
| classdojo.com | Education/Reference, Community Sites |
| remind.com | Education/Reference, Web-based Applications |
| powerschool.com | Education/Reference, Computers & Technology |
| zoom.us | Webinars/E-learning, Web-based Applications, Business |
| schoology.com | Web-based Applications |
| seesaw.me | Education/Reference |
Illinois scenarios: how the rules combine
Laws are easier to apply when you see them meet a real request. These are typical situations Illinois technology teams describe.
A school wants a new monitoring add-on
Before turning it on, map the data it collects, sign the SOPPA agreement and add it to the posted operator list. Then set who receives its alerts.
A teacher asks to unblock a social site
Illinois leaves social media to local policy. Follow your board's exception process, set an end date and note the reason in your exception log.
A parent asks what the filter records
Answer from your posted SOPPA list and policy: what is collected, who sees it and how long it is kept. A clear one-page summary saves repeat requests.
A vendor reports a security incident
Start your breach procedure: confirm what student data was involved, record the date the operator determined the breach and follow ISBE guidance on posting and parent notice.
Students find a new AI chat site
Check its category, decide by grade band whether it is allowed, and if it collects student accounts, treat it as a possible SOPPA operator before approving it.
Take-home devices browse at night
CIPA monitoring applies to district devices wherever they go. Keep off-campus filtering on, and keep reporting at category level unless there is a safety concern.
| Role | Owns | Shares with | Evidence produced |
|---|---|---|---|
| Technology director | Filter categories, device policies, off-campus coverage | Principals, data privacy lead | Configuration exports, block tests |
| Data privacy lead | SOPPA list, agreements, breach procedure | Business office, counsel | Posted operator list, signed agreements |
| Curriculum lead | Internet safety instruction from grade 3 | Teachers, librarians | Lesson schedules by grade |
| Student services | Safety alerts, bullying follow-up | Counselors, administrators | Alert handling notes |
| E-Rate coordinator | Form 486 or Form 479 certification | Technology director | Filed forms and the evidence folder |
Illinois school internet safety compliance checklist
Tick these off once a year. For the federal items in more depth, use the CIPA compliance checklist.
Evidence Illinois districts should keep
Store these per school year in one place. They answer E-Rate auditors, board members and parent requests.
Policy record
Internet safety policy, meeting notice and minutes of adoption.
Filter settings
Exports showing blocked categories for each student and staff group.
Block tests
Dated results from test accounts on campus and at home.
Review notes
Category reports with notes showing who reviewed them.
SOPPA agreements
Signed agreements and the posted operator list as it stood that year.
Lesson records
Internet safety instruction by grade and date.
Device policy
The adopted wireless device policy and exception decisions.
E-Rate forms
Form 486 or Form 479 copies and confirmations.
Illinois district questions answered by the hosted CIPA filter
Each row starts with something an Illinois technology team has to settle and shows what we offer for it.
| Illinois question | Where it comes from | Our hosted CIPA filter |
|---|---|---|
| How does the filter reach the network? | CIPA technology protection measure | One DNS setting on the router or firewall |
| What does it look at? | SOPPA and records questions | It decides by domain, not by page, and is not a monitoring tool |
| Different rules for each building | Local board decisions | One console, separate settings per school or branch |
| Teacher needs a blocked social site | Board exception process | Always-allow lists per site, applied in seconds |
| Take-home devices | CIPA monitoring and the 1:1 program | A private encrypted link applies the rules off the network |
| Evidence for E-Rate reviewers | Form 486 or 479 records | Activity reports, policy record and log export |
Illinois school internet safety FAQ
Does Illinois have its own school web filtering law?
We have not found an Illinois statute that adds K-12 filtering duties beyond CIPA. Filtering is driven by CIPA and E-Rate.
Illinois adds student data, instruction and device policy rules that shape how you run the filter.
Does SOPPA apply to web filters?
If the filter or monitoring tool collects covered information about students for K-12 purposes, it is likely an operator under SOPPA. List it and sign a written agreement.
Confirm with counsel for your specific tools.
When does the Illinois school phone law take effect?
SB 2427 was signed on 28 July 2026. District policies must be in place for the start of the 2027-28 school year.
Districts with an existing policy covering most or all of the day may have extra time; check ISBE guidance.
Does the phone law cover school-issued laptops?
The law targets students' personal wireless devices. How school-issued devices are treated during class is a district decision; read the final statute and the ISBE model policy.
Do Illinois schools have to teach internet safety?
Yes. Under 105 ILCS 5/27-13.3, districts include an internet safety component taught at least once a year to grade 3 and above. The board decides scope and duration.
Are filter logs student records in Illinois?
They can be, when they are tied to a named student and kept by the school. Treat them under ISSRA and FERPA rules for access and retention, and ask counsel about your setup.
Is this page legal advice?
No. It is a plain-language summary for school IT staff. Confirm details with counsel, ISBE guidance and your E-Rate consultant.
Other state pages and CIPA guides
Compare Illinois with other large states, or go deeper on the federal rules.
See all state guides on our school internet safety laws by state hub.
Related guides
The price follows how many schools and devices you run, and a quote arrives within one business day. If you want to test first, a pilot on one school shows the blocks and the reports before you commit.
Talk to us about your Illinois district
See how a category database can run inside your own systems, keep student browsing data local and cover CIPA categories on every device.
Talk to us about your districtNot legal advice. This page summarises Illinois and federal law as we understand it in October 2026. Statutes, ISBE guidance and effective dates change; confirm with counsel and current official sources before acting.