New York school internet safety laws: Education Law 2-d, devices and CIPA
New York schools filter under federal CIPA, protect student data under one of the more detailed state privacy regimes, and since 2025 restrict personal devices for the whole school day. This guide connects the three for IT directors, data protection officers and librarians.
What CIPA already requires of New York schools
Any New York school or library taking E-Rate discounts for internet access or internal connections must meet CIPA. New York law sits on top of it and does not replace it. Our guide to what CIPA is has the full background.
Need the step-by-step version? Use the CIPA compliance checklist and the internet safety policy guide.
A CIPA filter that a New York data protection officer can describe in two lines
Education Law 2-d puts the filter vendor under contract terms, a Bill of Rights and published details, so a simple tool eases the paperwork. Our hosted CIPA filter blocks by domain category and does not read pages or screens.
- Nothing is installed on the computers, so there is no extra device software to review
- Reports by school and a policy record support your Part 121 file
- One console holds separate settings for each district school or BOCES-served building
Education Law 2-d: student data privacy in New York schools
Education Law section 2-d protects personally identifiable information from student records, and certain teacher and principal evaluation data. It applies to educational agencies, which include school districts and BOCES, and to the third-party contractors they share data with.
No sale, no marketing
Student PII may not be sold or used or disclosed for marketing or commercial purposes.
Parents' Bill of Rights
Each agency publishes a Parents' Bill of Rights for data privacy and security on its website and includes it in contracts with contractors that receive PII.
Supplemental information
Each such contract comes with published details on how the contractor will use, protect and dispose of the data.
Contractor plans
Contractors provide a data privacy and security plan and follow the agency's policy.
Complaints route
Parents and others can file complaints about possible breaches or unauthorized releases.
State oversight
NYSED has a Chief Privacy Officer and Privacy Office that receive breach reports and complaints.
Why this matters for filtering: filter and monitoring logs tie a student account to browsing activity. Once those logs reach a vendor, they are very likely student PII under 2-d, so the vendor relationship needs the full contract package. Our guide to FERPA and student data privacy in web filtering explains the federal side.
Part 121: the duties that turn 2-d into practice
The Board of Regents adopted Part 121 of the Commissioner's Regulations in January 2020. It sets concrete duties for each educational agency. Check the current text, because NYSED guidance has been updated since then.
| Duty | What it involves | Link to your filter or monitoring tool |
|---|---|---|
| Data security and privacy policy | An adopted policy aligned to the NIST Cybersecurity Framework. NYSED guidance on which version to use has changed, so confirm. | Filtering, DNS protection and logging are part of the controls the policy describes. |
| Data protection officer | A named person with the right knowledge and training to oversee privacy and security. | The DPO should sign off on any new monitoring feature or vendor. |
| Staff training | Annual privacy and security awareness training for staff with access to PII. | Include who may view student browsing reports and how to handle them. |
| Breach and incident reporting | Breaches and unauthorized releases are reported to the NYSED Privacy Office, and affected parents are notified, within set time limits. | The filter contract should state how fast the vendor tells you about an incident. |
| Contract terms | Contracts with contractors receiving PII include required privacy and security terms, the Parents' Bill of Rights and supplemental information. | Add these at signature or renewal for every filter, monitoring and classroom tool. |
| Data minimization | Agencies limit collection and sharing of PII to what is needed. | Review which log fields you keep and for how long. |
Onboarding a web filter vendor under Education Law 2-d
The same five steps apply to a cloud filter, a monitoring add-on or a classroom management tool. Do them before student data flows, not after the pilot ends.
Vendors also face newer rules. The New York Child Data Protection Act took effect on June 20, 2025. It governs how operators of online services process data of users under 18. The SAFE for Kids Act, aimed at social media feeds, depends on Attorney General rules. Ask vendors how they handle both alongside 2-d.
What the hosted filter is, in terms a contract file can use
It is a DNS filter that decides by domain category, with activity reports, a policy record and a log export for CIPA files. It is not a monitoring or classroom screen tool.
Questions to ask a school web filter vendor in New York
Ask these in writing and keep the answers in the contract file. Clear answers make the supplemental information much easier to write.
Where is the data held?
Which country and region store logs, and whether any copies go to other providers for support or analytics.
What is collected by default?
Full URLs, search terms, screenshots or only blocked events. Ask what can be switched off.
How long is it kept?
The default retention period, whether you can shorten it, and how deletion is confirmed.
Who can see it?
Which vendor staff can access district data, under what controls, and whether access is logged.
How fast will you tell us?
The incident notice time in hours or days, and who at the vendor makes the call.
What happens at the end?
Return or deletion of data when the contract ends, and a written confirmation.
Who owns which part of compliance in a New York district
Gaps usually appear between roles, not inside them. Agree owners once and write them into your data security and privacy policy.
| Role | Main responsibilities | Hand-offs to watch |
|---|---|---|
| Technology director | Filter configuration, device management, testing and E-Rate technical records. | Tell the DPO before enabling any new logging or alert feature. |
| Data protection officer | Contract review, Bill of Rights, supplemental information, incident reporting. | Confirm vendor answers before the technology team signs off. |
| Board of education | Adopts the internet safety, data security and device policies after the required process. | Keep minutes and notices for each adoption. |
| Building leaders | Run the device rule day to day, handle exceptions and parent contact. | Report recurring bypass attempts to the technology team. |
| Library media specialists | Teach online behavior and research skills, and request unblocks for learning resources. | Use one documented request route so changes are tracked. |
New York's bell-to-bell rule for internet-enabled devices
A 2025 amendment to Education Law section 2803 required each public school district, charter school and BOCES to adopt a policy restricting student use of personal internet-enabled devices on school grounds for the whole school day. Policies were due by August 1, 2025, for the 2025 to 2026 school year.
What policies typically still allow
- School-provided laptops and tablets used for learning
- Basic phones without internet access
- Device use needed for a medical condition
- Use written into an IEP or Section 504 plan
- Translation needs and specific educational purposes the policy permits
What the rule restricts
- Personal smartphones during the school day, including lunch and breaks
- Personal tablets and smartwatches with internet access
- Other personal devices that can connect to the internet
Process points: schools had to consult staff, parents and students when writing the policy, provide a way for parents to reach students when needed, and choose their own storage approach. The state set aside funding to help schools buy storage solutions.
How AI and study tools are labelled in our category data
The FAQ notes that AI chat tools collect what students type, which brings 2-d questions. Below are the categories our database gives a few of them.
| Domain | Categories in our data | Why a district looks twice |
|---|---|---|
| chatgpt.com | AI / LLM Tools | Students type text into it, so allow-listing is a local decision |
| character.ai | AI / LLM Tools, Web-based Applications | Chat companion with a second label |
| perplexity.ai | AI / LLM Tools | Search-style tool that can sit on an approved list |
| grammarly.com | AI / LLM Tools | Writing aid that reads what is typed |
| quizlet.com | Education/Reference, Webinars/E-learning | Ed-tech with student accounts, a contract question |
How web filtering fits CIPA and New York law
Each law covers a different layer. Your web filter sits mostly in the CIPA layer, but its logs and its vendor sit squarely in the 2-d layer.
Settings that help on both fronts
- Category blocking at DNS or network level with no per-student logging where you do not need it
- Shorter log retention for routine browsing, longer only for safety alerts
- Role-based access so teachers see their class only
- Device-level filtering on take-home devices, as in 1:1 device filtering
Settings to review with your DPO
- Screenshot capture or keystroke features
- Exporting logs to a second analytics vendor
- Default retention of a year or more
- Alert emails that include full browsing detail
Public libraries are different. A New York public library that takes E-Rate or certain library funding still follows CIPA, but Education Law 2-d is written for educational agencies such as districts and BOCES, so a public library's data duties come from other rules.
Adults can ask for filtering to be disabled for lawful purposes. See our guide to public library internet filtering policy for how libraries handle requests and signage.
Choosing between tool types? See web filtering vs monitoring vs classroom management.
New York school internet safety compliance checklist
Open each group and tick as you go. Nothing you tick is saved.
CIPA and E-Rate 5 items
- Filter blocks the CIPA visual depiction categories on all devices minors use.
- Internet safety policy covers each required element.
- Public notice and meeting recorded in board minutes.
- Online behavior education in place for each grade band.
- Form 486 or 479 filed, filed copy kept with E-Rate CIPA records.
Education Law 2-d and Part 121 6 items
- Data security and privacy policy adopted and aligned to the NIST framework version NYSED currently expects.
- Data protection officer named.
- Parents' Bill of Rights posted on the website.
- Filter and monitoring contracts include the required terms and the Bill of Rights.
- Supplemental information for each contract published.
- Annual staff privacy training delivered and logged.
Logs and configuration 4 items
- Log fields and retention period written down and matched to system settings.
- Access roles reviewed each term.
- Vendor incident notice terms tested with a tabletop exercise.
- Proxy and anonymizer blocking checked against bypass attempts.
Personal devices 3 items
- Board-adopted internet-enabled device policy on file.
- Exceptions process for medical, IEP, 504 and translation needs.
- Acceptable use policy updated to match.
Evidence to keep in a New York district
Two audiences ask for proof: E-Rate reviewers about filtering, and parents or the Privacy Office about data. One shared folder serves both.
Category export with date, test results on and off campus, and checks from our domain category checker.
Internet safety policy, data security and privacy policy, device policy, each with adoption dates.
Every filter and monitoring contract, the Bill of Rights attachment, security plan and published supplemental information.
DPO appointment, staff training records and the access role list for student reports.
Incident log, reports made to the Privacy Office, parent notices and vendor correspondence.
Form 486 or 479 confirmations for each funding year and the matching policy version.
Questions for your DPO: category filter or heavier monitoring add-on
These rows use the topics the guide asks a New York district to review with its data protection officer.
| Question for the DPO | Hosted CIPA filter | Heavier monitoring add-on |
|---|---|---|
| What does the tool decide on? | The domain of a request, by category | Often page content or screens |
| Software on student devices | None installed | Usually an agent or extension to approve |
| Screenshots or keystrokes | Not part of a DNS filter | A feature to review and possibly switch off |
| Take-home devices | A private encrypted link keeps the school rules on | Depends on the product |
| Records for CIPA files | Policy record, activity reports and log export | Varies by tool |
| Several buildings or a BOCES service | Separate settings per school in one console | Separate set-ups to document |
New York school internet safety FAQ
Is our web filter vendor a third-party contractor under Education Law 2-d?
If the product receives student PII from the district, such as usernames tied to browsing records, it is likely a contractor under 2-d. The contract then needs the Bill of Rights and supplemental information, and the vendor needs a security plan. Confirm with your DPO.
Does the New York device law change what our filter must block?
No. The Education Law 2803 amendment restricts personal internet-enabled devices during the school day. It does not set filter categories. School-provided devices stay allowed and stay under your CIPA filter.
Does New York have its own school filtering standard?
We are not aware of a separate New York statute that sets a K-12 filtering standard beyond CIPA. New York's additions concern student data under 2-d and Part 121, and personal device use.
What is Part 121?
Part 121 of the Commissioner's Regulations implements Education Law 2-d. Adopted in January 2020, it requires a policy aligned to the NIST framework, a DPO, staff training and breach reporting, among other duties.
Do the New York Child Data Protection Act rules apply to districts?
The Act, in effect since June 20, 2025, targets operators of online services that process data of users under 18. It mainly affects vendors. Ask vendors how they comply, alongside 2-d.
Can we keep filtering logs for years just in case?
Keeping more than you need increases what a breach exposes and what you must protect. Set a retention period with your DPO and records officer, then make the system match it.
Do BOCES-provided filters change who is responsible?
Many districts receive filtering through a BOCES or regional service. The district still certifies CIPA and still owes its own 2-d duties, so keep copies of the BOCES contract terms, configuration and test results in your own file.
Should AI chat tools be blocked?
That is a local choice. Many of these tools collect student input, which raises 2-d questions. A dedicated category lets you allow approved tools only. See our AI tools blocklist for schools.
Compare state school internet rules
Every state guide is listed on our school internet safety laws by state page.
Related guides
- Student Data Privacy, FERPA and Web Filtering
- CIPA Internet Safety Policy: What It Must Contain and How to Write One
- Explaining Web Filtering to Parents: Letters, FAQs, Clear Limits
- Connecticut School Internet Safety Laws: CIPA and Data Privacy
- New Jersey School Internet Safety Laws: CIPA and Phone-Free
A quote for your New York district depends on how many schools and devices it has, and it comes back within one business day. A pilot on a single site shows the blocks and reports before any contract steps begin.
Talk to us about your New York district
Tell us about your devices, your logging needs and your 2-d contract process. We will show how our CIPA category coverage and the hosted CIPA filter pilot can fit with less student data leaving your systems.