Kentucky School Internet Safety Laws
Kentucky has required school internet filtering in state law since 1998. In 2025 it went a step further than most states: social media that a teacher has not authorized must now be blocked on school technology, alongside sexually explicit material.
This guide for Kentucky technology coordinators, principals and library media specialists covers CIPA, KRS 156.675, the HB 208 phone rule and what they mean for your filter. Planning guidance, not legal advice.
KRS 156.675State filtering law since 1998, amended by HB 208 effective June 27, 2025
Social media addedUnless a teacher authorizes it for instruction
KRS 158.165Personal devices barred during instructional time, at minimum
KRS 365.734Limits on cloud providers' use of student data
The CIPA baseline for Kentucky schools
Federal CIPA applies to every Kentucky school and library that receives E-Rate discounts for internet access or internal connections. For the full background, read what is CIPA.
Technology protection measure
Block or filter visual depictions that are obscene or child pornography for everyone, and harmful to minors on computers minors use.
Internet safety policy
Cover inappropriate material, email and chat safety, hacking, disclosure of minors' data and the filter, adopted after public notice and a hearing or meeting.
Monitoring and education
Monitor minors' online activity and teach appropriate online behavior, social networking safety and cyberbullying awareness.
Turn the Social Networking default block and teacher exceptions into real settings
KRS 156.675 now expects social media to stay off school technology unless a teacher authorizes it. Our hosted CIPA filter is a DNS filter that we run, and Social Networking is one category switch per school.
- The category catches new platforms, which a hand-made list would miss
- An approved platform can be opened with an always-allow entry for the school and removed afterwards
- The latest category data suits a law that asks for the latest filtering technology
What Kentucky adds: KRS 156.675 before and after 2025
KRS 156.675 started as Senate Bill 230 in 1998 and dealt only with sexually explicit material. House Bill 208, signed on March 26, 2025 as Acts Chapter 90, widened it to social media. The amended section took effect June 27, 2025.
Sexually explicit material
- State Board of Education rules to keep sexually explicit material off school technology.
- Districts use the latest available filtering technology.
- Department of Education offers filtering software to districts at no cost.
- Districts adopt an internet access policy.
Sexually explicit material and social media
- Same duties, now covering social media as well.
- The social media part applies only to platforms a teacher has not authorized for an instructional purpose.
- District audits look for use of school technology to reach social media or sexually explicit material.
- The rules reach any video, computer, software, hardware or internet service managed or provided to schools.
The four duties in KRS 156.675
The section splits work between the state and districts. Knowing who owns which duty makes it easier to show compliance.
State Board rules
The Kentucky Board of Education issues regulations to prevent social media and sexually explicit material from being transmitted through technology managed or provided to schools and districts.
Latest filtering technology
Districts and schools use the latest available filtering technology so that this material is not made available to students. "Latest" points to current category data, not a list set once.
State software on request
The Department of Education makes filtering software available to districts and schools on request and without cost, and tells every district it is available.
District internet access policy
Each district adopts a policy covering parental consent for student internet use, teacher supervision of student computer use, and audit procedures for misuse of education technology.
Teacher-authorized social media: a workable process
The social media rule has a built-in exception for teacher-authorized instructional use. Your filter and your procedures need to make that exception real, without opening social media to everyone.
What counts as social media
Use a category, not a hand-made list. A Social Networking category catches new platforms as they appear, which a fixed list will miss.
Embedded content
Video and image sharing platforms sit close to social media. Decide in writing whether Streaming Media and Community Sites are inside the rule.
District accounts
A school's own public page is managed by staff on staff devices. The student rule is about what students can reach, so staff rule sets can differ.
Image, video and reading communities and how our data labels them
The guide asks each district to decide in writing what is inside the rule. This is how our database files several borderline sites.
| Site | Categories in our data | Question for the district |
|---|---|---|
| flickr.com | Arts & Entertainment, Social Networking | Photo sharing that counts as social media |
| dailymotion.com | Social Networking, Streaming Media | Video platform with a social label |
| imgur.com | Community Sites, Cloud Storage / File Hosting | Image host without the Social Networking label |
| deviantart.com | Arts & Entertainment, Community Sites | An art community to review |
| wattpad.com | Community Sites | A reading and writing community |
| goodreads.com | Community Sites, Arts & Entertainment | Book reviews that a teacher may want |
HB 208 and student phones: KRS 158.165
The same 2025 bill also changed the personal device law. A House floor amendment moved the core rule from the whole school day to instructional time, and added a teacher-authorization exception.
| Point | What the law does | What it means for IT |
|---|---|---|
| Core rule | Each board adopts a policy that at minimum bans student use of a personal telecommunications device during instructional time | More class browsing moves onto school devices you filter |
| Exceptions | Specific exceptions apply, including teacher-authorized use | Phones in use by exception should still get the student Wi-Fi rule set |
| Federal-law devices | Devices a student is authorized to use under certain federal laws are excluded from the definition | Keep a record of accommodation devices so they are not blocked from school Wi-Fi by mistake |
| Local choice | Boards may go further; some districts ban phones all day | Match Wi-Fi access rules to your local policy |
Closing VPN routes so a phone cannot tunnel around the social media rule
When a phone is allowed by exception it can still try a VPN on student Wi-Fi. In our hosted CIPA filter VPN/Proxy is blocked, stays blocked even with the staff PIN, and public encrypted DNS and browser settings that skip the filter are blocked by default.
Student data: KRS 365.734 and filtering logs
Kentucky limits how cloud computing providers that serve schools use student data. Most filtering and monitoring tools today are cloud services, so their contracts sit inside this rule.
No advertising use
Providers may not use student data for advertising purposes. Check the contract says so in plain words.
No selling
Student data may not be sold or reused for other commercial purposes. Ask how the provider meets that.
Your own data map
List what your filter logs, where it is stored, who can read it and how long it is kept.
Retention you can explain
Keep browsing logs long enough for the audit procedure and for incident reviews, then delete them on a written schedule.
Narrow access
Name the few staff who may search student browsing records, and log every search so the district can show who looked and why.
Parent questions
Parents often ask what the filter records. A one-page summary drawn from the data map answers most of them quickly.
What it means for filtering and monitoring in Kentucky
Kentucky's floor is higher than CIPA's because of the social media rule. Here is how the main categories line up for students on school technology.
| Category | Students | Legal driver |
|---|---|---|
| Adult | Block | CIPA and KRS 156.675 (sexually explicit material) |
| Lingerie/Swimsuits/Intimate Apparel | Block, at least for younger grades | Harmful to minors standard |
| Social Networking | Block unless teacher-authorized | KRS 156.675 as amended in 2025 |
| Forums / Message Boards, Community Sites | Review against the social media rule | Depends on your district's definition |
| VPN / Proxy / Anonymizers | Block | Needed to keep the other blocks working |
| Gambling, Illegal Drugs, Weapons, Dating | Block | Local policy and common practice |
| AI / LLM Tools | Allow approved tools only | Local policy; see the AI tools blocklist for schools |
Audit procedure
The statute asks districts to audit whether technology is used to reach social media or explicit material. Monthly category reports by school make that audit simple.
Teacher supervision
The district policy must address teacher supervision of student computer use. Classroom tools help, but the filter is still the safety net.
Off campus
The law covers technology provided to schools, including take-home devices. See filtering school devices off campus.
Common Kentucky questions in practice
The 2025 changes raised new questions in schools. These are short, practical answers based on the statute text.
Is a video platform social media?
Decide locally and write it down. Many districts treat video sharing with comments as social media for students, then allow specific educational channels.
Does the rule cover staff?
The social media rule is about material made available to students. Staff rule sets can allow social media for school communication.
Is the state software required?
The Department must offer it on request. Districts may use other tools, as long as they meet the "latest available filtering technology" standard.
What about guest Wi-Fi?
If students can reach it, treat it as school technology and apply the student rule set.
What about messaging apps?
Email and Messaging is a separate category. Decide whether chat apps fall inside your social media definition.
How do we check a site?
Look it up in the domain category checker to see whether it is categorized as social networking.
Writing the Kentucky district internet access policy
KRS 156.675 names three topics the district policy must cover. CIPA adds its own list. One document can serve both if it is laid out around these sections.
Parental consent
Explain how parents give consent for their child's internet use, how they can withdraw it and what happens to schoolwork when they do. Keep the signed or digital consent on file.
Teacher supervision
Describe what supervision looks like in a lab, a one-to-one classroom and the library. Short, concrete expectations work better than general statements.
Audit procedures
Say who reviews filter reports, how often and what happens when misuse is found. Monthly reviews by school are a common pattern.
CIPA topics
Add the federal items: inappropriate material, email and chat safety, hacking, personal data of minors, the filter, monitoring and online safety education.
| What people say | What the law says |
|---|---|
| "Kentucky bans social media at school." | It bans student access through school technology unless a teacher authorizes it for instruction. Personal phones fall under the phone policy instead. |
| "The phone law is all day." | The state minimum is instructional time. Districts may choose a longer ban. |
| "Using the state software means we are compliant." | The software helps, but the district still needs its own policy, audit procedure and records. |
| "CIPA covers everything Kentucky asks." | CIPA has no social media block or parental consent element. Kentucky adds both. |
Kentucky compliance checklist
Work through this each summer. The federal items are covered in depth in the CIPA compliance checklist.
- CIPA internet safety policy covers every required topic
- Public notice and hearing or meeting held and documented
- District internet access policy updated for the 2025 social media wording
- Policy covers parental consent, teacher supervision and audit procedures
- Sexually explicit material blocked for students on all school technology
- Social Networking blocked for students unless teacher-authorized
- Written process for teacher-authorized social media, with records
- VPN and proxy categories blocked for students
- Filtering active on take-home devices off campus
- KRS 158.165 phone policy adopted, with exceptions recorded
- Cloud contracts reviewed against KRS 365.734 and FERPA
- Monthly audit reports reviewed and kept
- Online safety and cyberbullying lessons delivered
- Form 486 or 479 filed on time
Evidence to keep
Kentucky's audit wording means records matter more than in many states. Keep these together for each school year.
| Record | What it shows | Rule |
|---|---|---|
| Internet safety policy, notice and minutes | Policy adopted with public process | CIPA |
| District internet access policy (2025 version) | Consent, supervision and audit topics covered | KRS 156.675 |
| Dated rule set exports | Explicit material and social media blocked for students | CIPA and KRS 156.675 |
| Teacher social media authorizations | Exception used properly | KRS 156.675 |
| Monthly category audit reports | Audit procedure carried out | KRS 156.675 |
| Parental consent records for internet use | Consent element of the policy | KRS 156.675 |
| Phone policy and exception list | Instructional-time rule in place | KRS 158.165 |
| Provider contracts and data map | Student data limits respected | KRS 365.734, FERPA |
| Filed Forms 486 or 479 | Federal certification | CIPA |
Running the Kentucky social media rule: process step against filter feature
The steps come from the teacher-authorization process in the guide above.
| Step in the Kentucky process | What the hosted CIPA filter offers |
|---|---|
| Default block for all students | Social Networking switched on for each school, with a single DNS setting |
| Teacher requests a platform | Always-allow and always-block lists per site, edited by your staff |
| Access ends after the lesson | Remove the entry, and the change applies in seconds |
| Audit of use | Activity reports and log export |
| Proof of the latest technology | 120M+ categorized domains and 99.99% coverage of the active internet |
| Devices managed or provided to schools | A private encrypted link keeps the rules on laptops and phones away from the network |
Kentucky school internet safety FAQ
Does Kentucky have its own school internet filtering law?
Yes. KRS 156.675, first enacted in 1998, requires state rules and district filtering to keep sexually explicit material, and since 2025 social media, off school technology. CIPA applies on top for E-Rate schools.
What did House Bill 208 (2025) change about filtering?
It added social media to KRS 156.675. The amended section took effect June 27, 2025, and the social media part applies only to platforms a teacher has not authorized for instruction.
Can Kentucky teachers still use social media in class?
Yes, when a teacher authorizes a platform for an instructional purpose. Your filter needs a scoped way to grant that access, with records.
What does HB 208 require for phones?
Boards adopt a policy that at minimum bans student personal device use during instructional time, with exceptions. Districts may go further.
Does the Kentucky Department of Education provide a filter?
The statute directs it to make filtering software available on request and at no cost. Check current offerings with the department.
Does KRS 156.675 apply to take-home devices?
The section covers technology managed or provided to schools and districts, which includes school-issued devices used at home. Filtering that travels with the device is the practical way to meet it off campus.
Do Kentucky private schools have to follow KRS 156.675?
The section is written for local school districts and public schools. A private school that takes E-Rate must still meet CIPA, and many follow the Kentucky approach as good practice.
Which Kentucky law protects student data held by cloud providers?
KRS 365.734 limits cloud providers' use of student data, including advertising and selling. Review your filtering contracts against it and FERPA.
Compare Kentucky with other states
Neighbouring states handle filtering and phones in different ways. See every guide on our school internet safety laws by state page.
Related guides
The quote depends on how many Kentucky schools and devices you cover, and it arrives within one business day. A pilot on a single school lets you see the blocks and reports before you commit.
Talk to us about your district
Need social media blocked by default and opened per class on request? We can show how category filtering, scoped allow rules and audit-ready reports can fit your Kentucky district.
Talk to us about your district