Michigan School Internet Safety Laws
Michigan districts filter under the federal Children's Internet Protection Act. The state then adds its own rules on student data, cyberbullying, library access and, from the 2026-27 school year, phones in class.
This guide sorts those rules into what touches your web filter, what touches monitoring, and what lives in policy and contracts.
Michigan at a glance
What CIPA requires of every Michigan district on E-Rate
CIPA is a funding condition, not a general internet law. If a school or library takes E-Rate discounts for internet access or internal connections, it must certify three things each funding year.
A technology protection measure
A filter that blocks visual depictions that are obscene, child pornography, or harmful to minors on computers that minors use.
An internet safety policy
A written policy covering minors' access to inappropriate material, safety in email and chat, hacking, and disclosure of minors' personal data.
Monitoring and education
Monitoring of minors' online activity, plus teaching students about online behavior, social networking safety and cyberbullying.
For the full federal picture, read our plain-language guide to what CIPA is and who must comply, and the money side in E-Rate and CIPA funding.
Cover district-owned devices in Michigan wherever the student opens them
Michigan has no separate state filter standard, so your CIPA certification has to hold on every district device that minors use. Our hosted CIPA filter is a DNS filter that we run, with a private encrypted link for devices off the network.
- Staff and student rules can differ, with a PIN for adult research that expires on its own
- A district, an ISD member or a school academy can keep its own settings
- No software goes onto computers, so a Michigan rollout is a DNS change
What Michigan adds on top of CIPA
Plain answer: we are not aware of a Michigan statute that sets a separate K-12 filtering standard or category list beyond CIPA. Michigan's additions sit around the filter: student data, bullying policy, libraries and phones.
Here are the laws Michigan district IT and compliance staff are most likely to meet, in the order they arrived.
Library internet access for minors: MCL 397.606
Public Act 212 of 2000 amended the Library Privacy Act and took effect on October 1, 2000. It requires a library that offers public internet access to adopt and enforce a policy restricting minors' access to obscene or harmful material.
- Option one: filtered terminals for minors, with some terminals reserved for adults or minors accompanied by a parent or guardian.
- Option two: a system designed to block minors from that material.
- Library governing bodies, board members and staff receive civil immunity under the governmental immunity statute.
- It does not apply to libraries of community colleges, colleges and universities, or private libraries open to the public.
Anti-bullying and cyberbullying: MCL 380.1310b
The Matt Epling Safe School Law requires districts, ISDs and public school academies to adopt anti-bullying policies. Public Act 478 of 2014 added cyberbullying as a form of bullying.
- The amendment took effect on March 31, 2015, and districts had six months to adopt updated policies.
- Policies cover incidents carried out by electronic communication, alongside in-person bullying.
- The statute also points to educational programs for pupils and parents on preventing and reporting bullying and cyberbullying.
Student Online Personal Protection Act: Public Act 368 of 2016
This act took effect on March 22, 2017. It governs operators of websites, online services and apps used primarily for K-12 school purposes and designed and marketed for that use.
- Operators may not knowingly run targeted advertising based on information gathered through K-12 use.
- Operators may not build student profiles except for K-12 school purposes.
- Covered information includes data created by students, parents or staff and data the operator gathers that identifies a student.
Phones during instructional time: House Bill 4141
Signed in February 2026, this law requires districts and charter schools to ban student use of wireless communication devices during instructional time, starting in the 2026-27 school year.
- It is not a bell-to-bell rule: phones may be used between classes and at lunch unless a district chooses a stricter policy.
- Exemptions include medically necessary devices and district-owned devices designated for instruction. Basic phones are also allowed.
- Districts must post their policy online and explain how it is enforced. Private and parochial schools are not covered.
- A companion bill requires a protocol for student phone use during an emergency.
Michigan also has general consumer and criminal laws that can touch online safety. Those are outside the scope of this page, which focuses on rules that change what a district does with its network and devices.
What these laws mean for filtering and monitoring
Each rule lands in a different part of your program. Mapping them once saves guesswork when an auditor, board member or parent asks how the district meets them.
| Rule | Touches the filter? | Touches monitoring? | Where the work happens |
|---|---|---|---|
| CIPA | Yes: three required categories of visual depictions | Yes: monitoring of minors' online activity | Filter configuration, internet safety policy, Form 486 certification |
| MCL 380.1310b | Indirectly: social and messaging categories you choose to restrict | Yes: reports of electronic bullying need a response path | Board policy, incident handling, student and parent education |
| Public Act 368 of 2016 | No direct filter rule | Yes: how vendors use browsing and identity data | Vendor contracts, data agreements, procurement review |
| House Bill 4141 | No category rule | Limited: enforcement is mostly classroom practice | Board policy posted online, staff procedures, emergency protocol |
| MCL 397.606 | Yes, for covered libraries | Supervision of minors on library terminals | Library governing body policy and terminal setup |
Filtering takeaways
- Your CIPA categories are the legal minimum. Michigan does not add a state category list.
- Filter every district-owned device that minors use, on campus and at home, so your certification holds wherever the device goes.
- Keep separate policies for staff and students, so adults can be unblocked for lawful research as CIPA allows.
Monitoring takeaways
- CIPA asks for reasonable monitoring, not reading every screen. Category-level reports often meet that need.
- When monitoring data names a student, treat the vendor as a school operator under Public Act 368 and check its contract terms.
- Link monitoring alerts about harassment to your cyberbullying procedure, so reports reach the right staff.
Off-campus coverage is where many programs slip. Our guide on how to enforce CIPA on off-campus student devices walks through the options.
The Michigan phone law and your web filter
The phone law changes classroom habits more than network settings. Still, it shifts some traffic and creates a few technical choices worth settling before the school year starts.
Cellular data skips your filter
A personal phone on its own data plan never touches the school network. The phone law, not the filter, is the control for that traffic during class.
Guest Wi-Fi still matters
Phones used at lunch or between classes may join school Wi-Fi. Apply the student filter policy to any network segment students can reach.
District devices stay in use
District-owned devices designated for instruction are exempt from the ban. Those devices carry the CIPA filter, so coverage on them matters more, not less.
Chat and anonymous-style apps and their categories in our data
Phones are back in hand between classes and at lunch under HB 4141, so district policy under the bullying law still has to account for them. This is how our database files a few such apps.
| App domain | Categories in our data |
|---|---|
| kik.com | Email and Messaging, Social Networking |
| yubo.live | Social Networking |
| omegle.com | Social Networking |
| monkey.app | Dating, Social Networking |
| viber.com | Email and Messaging, Social Networking |
| signal.org | Email and Messaging |
Student data, filtering vendors and Public Act 368
A web filter or monitoring tool sees a lot: which student visited which site, when, and from which device. That makes the vendor's data handling part of your compliance story.
Questions to ask any filtering vendor
- Which student identifiers do you receive, and can we limit them?
- How long are browsing logs kept, and can we set the period?
- Do you use any student data for advertising or profiles? The answer should be no.
- Who are your subprocessors, and are they bound by the same limits?
- How is data deleted when the contract ends?
Ways to reduce data exposure
- Run category decisions inside district systems where possible, so fewer browsing records leave your network.
- Keep logs at the group or device level for routine reports, and use names only when an incident needs it.
- Align retention with your records schedule and your internet safety policy.
Federal privacy rules apply too. See how FERPA and student data privacy affect filtering for the overlap with district records.
School libraries, public libraries and community use
Some Michigan communities share a library between a district and the public, or open school labs in the evening. These setups mix two rule sets, so plan them on purpose.
Separate patron groups
Give students, adult patrons and staff their own filter policies. Adults can then be unblocked for lawful research while minors stay under the CIPA rules.
Label the terminals
If you use reserved unfiltered terminals for adults, mark them clearly and place them where staff can see who uses them.
Write down who owns what
A short agreement saying which body sets the policy, runs the filter and keeps the records avoids gaps when staff change.
Our page on web filtering for libraries covers patron policies and adult unblocking in more detail.
Separate rules for a school, a library terminal and staff
The guide points to terminals for minors, adult access and staff research as different cases. One console in our hosted CIPA filter holds separate settings for each school or branch, with always-allow and always-block lists on top.
Which web filtering categories map to the CIPA duties
CIPA names harms, not categories, so each district translates the law into category settings. Most Michigan districts start from a core set and add local choices through board policy.
Core set most districts block for students
Local policy choices, often by grade band
Browse the full web filtering categories taxonomy, then decide each local category through board policy rather than ad hoc tickets.
Michigan school compliance checklist
Use this as a yearly pass. It combines the federal steps with the Michigan items above. Our general CIPA compliance checklist goes deeper on the federal parts.
Filter Technology protection measure
- Required CIPA categories blocked for every student policy group
- Filtering active on take-home devices, not only on campus
- Proxy and VPN bypass categories blocked for students
- Safe search enforced on major search engines
- Documented process for adults to request unblocking for lawful research
- Student Wi-Fi segments, including guest networks, use the student policy
Policy Board-adopted documents
- Internet safety policy covers all five CIPA topics
- Public notice and hearing or meeting documented
- Anti-bullying policy includes cyberbullying under MCL 380.1310b
- Phone policy for instructional time adopted and posted online for 2026-27
- Emergency phone-use protocol written and shared with staff
- Acceptable use policy matches the filter's real settings
People Monitoring, education and vendors
- Monitoring approach written down, with who reviews reports and how often
- Online safety and cyberbullying lessons scheduled for each grade band
- Filtering and monitoring vendor contracts reviewed against Public Act 368
- Log retention period set and matched to the records schedule
- Form 486 or Form 479 certification filed on time
- Annual review of over-blocking complaints from teachers
Evidence to keep for CIPA and Michigan rules
Certifications are statements the district may need to prove later. A single folder with the items below answers most questions quickly.
| Evidence | Proves | Suggested owner | Refresh |
|---|---|---|---|
| Adopted internet safety policy and board minutes | CIPA policy duty | Superintendent's office | When revised |
| Public notice of the hearing or meeting | CIPA public process | Board secretary | When revised |
| Filter policy export or screenshots of blocked categories | Technology protection measure in place | Network or IT lead | Each school year |
| Off-campus filtering test results for sample devices | Coverage on take-home devices | Device management team | Each semester |
| Category-level monitoring report samples | Monitoring of minors' activity | Building administrators | Monthly or termly |
| Lesson plans or schedules for online safety teaching | CIPA education duty and bullying education | Curriculum lead | Each school year |
| Cyberbullying policy and policy submission record | MCL 380.1310b | Student services | When revised |
| Posted phone policy and enforcement procedure | House Bill 4141 | Building principals | Each school year |
| Vendor data agreements and privacy terms | Public Act 368 alignment | Procurement or data officer | At renewal |
| Filed Form 486 or Form 479 | E-Rate certification | E-Rate coordinator | Each funding year |
Need to write or refresh the policy itself? Our guide to the CIPA internet safety policy lists what to include.
Michigan rules and what a hosted filter does about each one
The rows follow the table in this guide that sorts each rule into filter and monitoring work.
| Michigan rule | What lands on the filter | Our hosted CIPA filter |
|---|---|---|
| CIPA | Block the required visual categories | CIPA preset, VPN/Proxy blocked, optional Lingerie, Gambling and Weapons |
| MCL 380.1310b | Choice of messaging and social categories | Social Networking is a switch, and messaging sites go on the always-block list |
| Public Act 368 of 2016 | Vendor questions, not categories | Decides by domain, nothing installed on computers, not a monitoring tool |
| House Bill 4141 | No category rule | Keeps district devices filtered through the school day and at home |
| MCL 397.606 | Filtered terminals for minors | Separate settings per school or branch |
| Evidence | Records for E-Rate and boards | Activity reports, a policy record and log export |
Michigan school internet safety FAQ
Does Michigan have its own K-12 web filtering law?
We are not aware of a Michigan statute that sets a separate K-12 filtering standard beyond CIPA. Districts on E-Rate follow CIPA, and Michigan adds laws on student data, cyberbullying policies, library access and classroom phone use.
What does the Michigan Student Online Personal Protection Act cover?
Public Act 368 of 2016 applies to operators of sites, services and apps used for K-12 school purposes. Among other limits, they may not knowingly use student data from school use for targeted ads or build profiles outside school purposes.
Does the phone law change what our filter must block?
No. House Bill 4141 bans student phone use during instructional time from 2026-27. It sets no filtering categories, and district-owned instructional devices stay in use under your CIPA filter.
Does MCL 397.606 apply to school districts?
It applies to libraries offering public internet access and excludes college, university, community college and private libraries. Ask counsel whether it reaches a district library that also serves the public.
Is cyberbullying part of a required Michigan policy?
Yes. The Matt Epling Safe School Law requires anti-bullying policies, and Public Act 478 of 2014 added cyberbullying, with updated policies due within six months after March 31, 2015.
Do we have to monitor students' personal phones?
CIPA monitoring applies to minors' use of the internet access the district provides. A personal phone on cellular data is outside your network, which is why the phone law relies on classroom rules instead.
Compare school internet rules in other states
The full list of state guides is on our school internet safety laws by state page.
Related guides
- CIPA Internet Safety Policy: What It Must Contain and How to Write One
- Student Data Privacy, FERPA and Web Filtering
- Presenting Web Filtering to the School Board: Budget, Risk, Metrics
- Ohio SB 29 School Compliance: Device Monitoring and Filtering
- Indiana School Internet Safety Laws: CIPA and Device Rules
The price follows how many Michigan schools and devices are involved, and our quote reaches you within one business day. Testing on a pilot at one school first shows the blocks and the reports before you commit.
Talk to us about your Michigan district
Tell us about your devices, your grade bands and your logging needs. We will show how our CIPA category coverage and the hosted CIPA filter pilot fit your program.