Massachusetts School Internet Safety Laws: CIPA, Chapter 71 and What Districts Must Show
Massachusetts districts work under two sets of rules. Federal CIPA sets the filtering duty for E-Rate schools, and state law adds an internet safety policy rule, a cyberbullying law and student record regulations.
This guide separates what each rule asks for, what it does not ask for, and the evidence a technology director should keep ready.
The rules on one card
- Federal CIPAFilter, policy, public meeting and monitoring for E-Rate schools and libraries.
- M.G.L. c. 71, s. 93Every public school giving students computer access needs an internet safety policy.
- M.G.L. c. 71, s. 37OBullying law that covers cyberbullying, including through school technology.
- 603 CMR 23.00State student record regulations that shape how monitoring data is handled.
1What CIPA requires of Massachusetts schools
The Children's Internet Protection Act applies to schools and libraries that receive E-Rate discounts for internet access or internal connections. A Massachusetts district that takes E-Rate is bound by it, whatever state law says.
| CIPA element | What it means in practice | Typical proof |
|---|---|---|
| Technology protection measure | A filter that blocks or filters visual depictions that are obscene, child pornography or harmful to minors on computers minors use. Adult computers must block the first two. | Filter policy export, category list, screenshot of active rules |
| Internet safety policy | A written policy covering minors' access to inappropriate matter, safety in email and other direct messaging, hacking and other unlawful activity, disclosure of minors' personal information, and measures that restrict harmful material. | Adopted policy with date and vote record |
| Public notice and meeting | At least one public hearing or meeting on the proposed policy, with reasonable public notice. | Agenda, notice posting, minutes |
| Monitoring of minors | School policies must include monitoring the online activities of minors. CIPA itself says it does not require tracking of internet use by any identifiable user. | Policy language, supervision practice, staff guidance |
| Online safety education | Schools must educate minors about appropriate online behavior, including social networking, chat rooms and cyberbullying awareness and response. | Lesson plans, curriculum map, attendance records |
| Certification | Schools and libraries certify on FCC Form 486. Consortium members certify to their lead on Form 479. | Filed Form 486 or signed Form 479 |
Our plain guide to what CIPA is and who it applies to covers each element in more depth, and the E-Rate and CIPA funding guide explains the certification timing.
Give a Massachusetts school committee settings it can read, vote on and show
Chapter 71 section 93 asks for a written internet safety policy, and the technology team turns it into settings. Our hosted CIPA filter is a DNS filter that we run, using plain category switches that match the wording of a policy.
- Each category choice beyond the CIPA core can be recorded next to the vote that approved it
- Charter schools and district schools can have separate settings in one console
- Nothing is installed on computers, so a change is a setting, not a rollout
2What Massachusetts adds on top of CIPA
Massachusetts does not have its own statute listing website categories that schools must block. What it does add is a policy requirement for all public schools, and laws on bullying and student records that shape how filtering and monitoring are run.
Internet safety policy for every public school
Public schools that give students computer access must have an internet safety policy that addresses inappropriate material online, with notice to parents.
The policy sits with the school committee working with the superintendent, or with the board of trustees for a charter school.
- Applies whether or not the district takes E-Rate
- Does not name categories or products
Bullying and cyberbullying
The state bullying law covers cyberbullying, including bullying through technology or devices owned by the district. Districts must keep a bullying prevention and intervention plan.
- Shapes your acceptable use rules
- Sets the response path when monitoring finds bullying
Student record regulations
State regulations govern student records, including who may see them and how parents get access. Alerts and logs tied to a named student can fall into this space.
- Decide what monitoring data becomes a record
- Set retention and access for flagged events
Student phones during the school day
The Senate passed a bill in July 2025 to bar personal device use from the start of the school day to dismissal, aimed at 2026-27. When we checked, we could not confirm it had passed the House.
- Check the current status before planning
- Many districts already set local phone rules
Earlier bills to rewrite section 93, including proposals to publish the specific blocking measures used and to review the policy on a set cycle, did not become law in their sessions. Check the current text of section 93 before you cite it in board papers.
3How the layers stack for a Massachusetts district
It helps to see which body owns which decision. That stops a filter setting from turning into a policy question, and a policy question from being settled by a default in a console.
When a decision is unclear, ask which layer owns it. A category choice that limits what students can read is a policy decision for the school committee, even if the technology team clicks the setting. Our guide to the CIPA internet safety policy shows how to write those choices into the policy itself.
4What it means for filtering and monitoring
Because the state does not name categories, Massachusetts districts set their own block lists. That freedom is useful, but it means you need a written reason for each choice that you can show a parent or an auditor.
Start from the CIPA core
Block adult and explicit content on every student device and network. This covers the obscene, child pornography and harmful to minors standard.
Close the bypass routes
Block VPN, proxy and anonymizer services. A filter that students can tunnel around does not meet the intent of the policy you adopted.
Add local categories in writing
Gambling, weapons, illegal drugs, violence and hate content are common local choices. Record the vote or the decision memo for each.
Cover devices off campus
Take-home devices need the same policy at home. Use device-level or cloud filtering so rules follow the device, not just the building network.
Keep monitoring proportionate
CIPA asks for monitoring, not tracking of every click. Decide what supervision looks like in class and what automated alerts you really need.
Connect alerts to section 37O
If a tool flags possible bullying, route it into the bullying plan you already run, with a named staff owner and a recorded outcome.
Mapping the policy words to filter categories
| Policy wording | Filter categories that usually carry it | Who decides |
|---|---|---|
| Obscene, child pornography, harmful to minors | Adult; Lingerie/Swimsuits/Intimate Apparel (for minors) | Required by CIPA |
| Circumventing the filter | VPN / Proxy / Anonymizers; URL Shorteners where abused | Policy, strongly advised |
| Unlawful activity and hacking | Malware / Phishing / Suspicious; Illegal Drugs | Policy and security team |
| Age-restricted products | Gambling; Alcohol; Tobacco; Weapons; Dating | School committee |
| Harmful or hostile content | Violence; Hate/Discrimination | School committee, with care for research use |
| Distraction and bandwidth | Gaming; Streaming Media; Social Networking | Local choice by grade band |
For the full set of category options, see the web filtering categories taxonomy. You can look up how any single site is classed with the domain category checker.
Link shorteners in our data and why they matter for a circumvention rule
The guide names URL shorteners as a possible circumvention tool where abused. Here is how our database files several of them.
| Domain | Categories in our data |
|---|---|
| bit.ly | URL Shorteners |
| t.co | Advertising/Marketing, Cloud Storage / File Hosting, Social Networking, URL Shorteners |
| rebrand.ly | URL Shorteners |
| is.gd | URL Shorteners |
| cutt.ly | URL Shorteners |
| tiny.cc | URL Shorteners |
5Massachusetts compliance checklist
Use this as a working list for the start of each school year. It combines the CIPA items with the state policy, bullying and records points. Our general CIPA compliance checklist adds more detail on the federal side.
Policy and governance
- Internet safety policy adopted by the school committee or charter board
- Policy covers each CIPA topic, including student personal information
- Public notice given and a public hearing or meeting held before adoption
- Parent notice of the policy sent and dated
- Acceptable use policy for students and staff aligned with the safety policy
- Review date set and owner named
Filtering in practice
- Adult content blocked on all student networks and devices
- VPN, proxy and anonymizer services blocked
- Local categories recorded with the reason for each
- Take-home devices filtered off campus
- Process for staff to request an unblock, with response owner
- Adult disable process for bona fide research recorded
Monitoring and student safety
- Monitoring approach written down: class supervision, alerts, or both
- Alerts that suggest bullying routed into the section 37O plan
- Named staff can see alerts, and access is logged
- Retention period set for logs tied to named students
Education and certification
- Online safety lessons scheduled by grade band
- Cyberbullying awareness and response covered
- Form 486 filed on time, or Form 479 signed for the consortium lead
- Vendor data agreements on file for tools that touch student data
6Evidence to keep, and for how long
An E-Rate review or a parent complaint will ask you to show, not tell. Keep these items in one folder per funding year. E-Rate rules require records to be kept for at least 10 years after the last date of service.
| Item | Why it matters | Where it usually lives |
|---|---|---|
| Adopted internet safety policy | Shows the CIPA topics are covered and the state policy duty is met | School committee records |
| Notice of the public hearing or meeting | Proves the public process happened before adoption | Clerk, website archive |
| Minutes of the meeting | Records discussion and the vote | School committee records |
| Parent notice copy and date | Shows the section 93 notice step | Communications office |
| Filter configuration export | Shows which categories were blocked and when | Technology department |
| Off-campus device filtering record | Shows take-home devices follow the same rules | Device management console |
| Online safety curriculum | Shows the education element | Curriculum office |
| Form 486 or Form 479 | Certification for each funding year | E-Rate coordinator |
Licence holders of our category data also receive validation reports with the measured accuracy of the CIPA categories, which many districts file alongside their configuration export as part of the same evidence pack.
Reports and exports a Massachusetts auditor or parent can be shown
Our hosted CIPA filter produces activity reports and a policy record, and logs can be exported for your CIPA file. It decides by domain and is not a monitoring tool, so bullying review under section 37O stays with your staff and plan.
7A school-year rhythm that keeps you ready
Compliance work is easier when it follows the calendar instead of the next complaint. This is a simple pattern many Massachusetts teams can adapt.
Review and reset
Check the policy against the current law, refresh the category list, re-enroll devices and test that blocks work on and off campus.
Notify and teach
Send the parent notice, publish the acceptable use rules and schedule online safety lessons in each grade band.
Spot check
Sample blocked and allowed sites, review unblock requests and look for new bypass tools students are trying.
Certify and file
Confirm Form 486 timing for the next funding year, save configuration exports and close the year's evidence folder.
8Common Massachusetts situations
These are the questions that tend to land on a technology director's desk. Each answer points back to the rule that settles it.
A teacher needs a blocked site for a lesson
CIPA lets an authorized person disable the measure for an adult doing bona fide research or other lawful work. For students, use a reviewed unblock request with a time limit and a record of who approved it.
A parent asks what is blocked
Section 93 asks for parent notice of the policy. Sharing the category list in plain terms builds trust and is easier than defending a list nobody has seen.
Students use AI chat tools
Neither CIPA nor state law requires blocking AI tools. Decide by grade band and purpose, and see our AI tools blocklist for schools if you choose to restrict them.
A new monitoring tool is proposed
Ask what it collects, who sees it and how long it is kept. Many Massachusetts districts sign a student data privacy agreement with each vendor, and the record regulations apply to anything that becomes part of a student record.
Students bring their own phones
Personal phones on cellular data sit outside the school filter. Until a state phone rule is settled, local phone policies and blocking of the school guest network do most of the work here.
A library in town shares the network
Public libraries that take E-Rate have their own CIPA duties, including adult disable rules. Our guide to web filtering for libraries covers the differences.
Which Massachusetts layer owns each job, and where a hosted filter helps
The guide splits decisions between federal law, the committee and the technology team, so the table follows that split.
| Decision | Who owns it | What our hosted CIPA filter adds |
|---|---|---|
| Block the CIPA core | Federal law | Preset with Adult and VPN/Proxy/Anonymizers on |
| Local categories such as Gambling or Weapons | School committee | Optional switches for each school, so the vote becomes a setting |
| Unblock a site for a lesson | Principals and staff | Always-allow lists per site, applied in seconds |
| Adult research access | Technology team | Staff PIN for 15, 30 or 60 minutes, logged, then it switches back |
| Devices at home | Technology team | A private encrypted link keeps the rules off the network |
| Show the policy works | Technology team | Activity reports, a policy record and log export |
9Massachusetts school internet safety FAQ
Does Massachusetts have its own school internet filtering law?
Chapter 71, section 93 requires public schools that give students computer access to have an internet safety policy that deals with inappropriate material, with notice to parents. It does not list categories. The technical filtering standard comes from CIPA for E-Rate schools.
Does section 93 apply if we do not take E-Rate?
Section 93 is a state law aimed at public schools that provide student computer access, so it does not depend on E-Rate. CIPA only binds you if you take the covered discounts. Many districts meet both with one policy.
Is there a statewide school cell phone ban?
The Senate passed a bell-to-bell bill in July 2025 aimed at 2026-27. When we checked, we could not confirm House passage or enactment. Check the current status with the Legislature.
Does the anti-bullying law require a filter?
No. Section 37O covers bullying and cyberbullying and requires a prevention and intervention plan. It affects how you write acceptable use rules and respond to what monitoring finds.
Do we have to log every student's browsing?
CIPA requires monitoring of minors but says it does not require tracking of internet use by any identifiable user. Logs tied to named students raise records questions under state regulations, so set a clear retention period.
Who approves the internet safety policy?
The school committee, working with the superintendent, or a charter school's board of trustees. CIPA also needs public notice and at least one public hearing or meeting.
How long should we keep evidence?
E-Rate records must be kept for at least 10 years after the last date of service. Keep the policy, meeting records, filter exports and Form 486 copies on that schedule.
Should social media be blocked?
That is a local choice. Many districts block social networking for younger grades and allow specific tools later. See social media filtering in schools for options.
10Compare other state school internet laws
See all state guides, grouped by type of rule, on our school internet safety laws by state page.
Related guides
Cost is based on the number of Massachusetts schools and devices, and the quote lands within one business day. Beginning with a pilot on one school shows the blocks and the reports before the committee commits.
Talk to us about your district
Tell us how your devices and networks are set up. We will show how our CIPA category data and the hosted CIPA filter pilot can cover the federal standard and the policy your school committee adopted.