Ohio SB 29 school compliance: device monitoring, notices and CIPA filtering
Ohio's SB 29 limits when districts and their technology providers may look into school-issued devices, and sets rules for provider contracts. This guide explains how districts keep CIPA filtering running while meeting the new notice and contract duties.
Before your team opens a device feature, ask:
What CIPA already requires of Ohio schools
Ohio districts that take E-Rate discounts follow federal CIPA like every other state. SB 29 does not remove those duties. If you need the background, start with what CIPA is and how it works.
Filter
Blocks obscene images and child sexual abuse material, plus images harmful to minors on devices they use.
Policy
An internet safety policy covering the required topics, including minors' personal information.
Public process
Reasonable public notice and at least one public hearing or meeting before adoption.
Monitoring
School policies provide for monitoring minors' online activities.
Certify
FCC Form 486, or Form 479 for consortium members, each funding year.
The key tension in Ohio: CIPA expects monitoring of minors online, while SB 29 limits monitoring of browsing on school-issued devices unless an exception applies. The exceptions are how the two fit together. Our CIPA compliance checklist covers the federal items in detail.
Describe CIPA filtering to Ohio parents without listing cameras, keystrokes or location
Your annual notice has to say plainly which features are used and why, and a category filter keeps that list short. Our hosted CIPA filter is a DNS filter that we run for you, deciding by domain and nothing else.
- Nothing is installed on the school computers, so no extra device features appear in the notice
- Activity reports and a policy record back up the CIPA line in your file
- It is not a monitoring or classroom screen tool, which keeps the feature inventory simple
What Ohio SB 29 restricts on school-issued devices
SB 29 of the 135th General Assembly took effect on October 24, 2024. It enacted Revised Code sections 3319.325, 3319.326 and 3319.327. Section 3319.327 sets the default: a district or technology provider may not electronically access or monitor three kinds of features unless an exception applies.
Location tracking
Features that report where the device, and so the student, is.
Audio and visual features
Camera and microphone functions on the device.
Student interactions
Activity such as keystrokes and web browsing on the device.
When Ohio districts may access or monitor school devices
These are the circumstances most often listed in the statute and in district notices. Wording varies between sources, so read the current text of 3319.327 before you rely on any one of them.
Education, support and proctoring
Non-commercial educational purposes such as instruction, technical support or exam proctoring by district staff or staff under contract, with advance notice.
Advance noticeJudicial warrant
Access the warrant permits. District notices often mention subpoenas alongside warrants.
Event noticeMissing or stolen device
Access after the district is told the device is lost or stolen, to locate or secure it.
Event noticeThreat to life or safety
Action to prevent or respond to a threat, limited to that purpose.
Event noticeFederal or state law
Activity needed to comply with federal or state law. Districts commonly place CIPA filtering and monitoring here.
Annual noticeFunding program duties
Many district notices list requirements of a federal or state funding program. E-Rate is the obvious example for filtering.
Annual noticeHow Ohio districts handle SB 29 monitoring notices
In practice there are two kinds of notice. One is a yearly statement of the monitoring a district does as routine. The other is a specific notice after an event-driven access, sent to the parent of the student concerned.
- Required in any year the district elects to generally monitor school-issued devices under an exception.
- Written notice to the parents of enrolled students.
- Should say which features are monitored and why, for example web filtering for CIPA.
- Many districts post it on the website and include it in enrollment packets.
- District notices describe written notice within 72 hours after access under exceptions such as a threat to safety.
- Typically states which features were accessed and a description of the circumstances.
- Where notice itself could endanger someone, districts describe sending it after the threat has passed.
- Check the statute text for the exact triggers and timing.
Your annual notice should agree with your CIPA internet safety policy and acceptable use policy. Families notice when three documents describe monitoring three different ways.
What a clear SB 29 annual monitoring notice covers
Parents read these notices quickly. A short, specific notice builds more trust than a long legal one. These are the elements districts most often include, in plain language.
Write the notice in your own district's words and have counsel review it. Avoid wording that promises more than your systems actually do, such as "no data is ever stored" when filter logs exist.
Questions to ask your technology provider under SB 29
Your provider's answers decide what you can truthfully put in the notice. Ask in writing and keep the replies with the contract.
Can features be switched off?
Can location, screen view, camera and microphone access be disabled for the whole district, not just hidden from the console?
What is logged by default?
Is every visited URL stored per student, or only blocked events? Can routine logging be reduced?
Who at the vendor can see data?
Which staff can access district records, under what controls, and is that access itself logged?
Is any data used commercially?
Confirm no sale, sharing or commercial use of educational records, matching the 3319.326 rules.
Can you report each access?
Does the product record who opened which student's activity and when, so event notices are accurate?
What happens at contract end?
How are records returned or deleted, and will you confirm deletion in writing?
Technology provider contracts and educational records
SB 29 also sets rules for vendors that hold student educational records under a district contract. Web filters and monitoring tools that log student activity are typical examples.
DNS category filtering for take-home devices as well as classrooms
A private encrypted link keeps the same rules on laptops and phones away from the network, and it works by domain, not by page. Log export and activity reports are there for CIPA files.
What SB 29 means for web filtering and monitoring tools
Not every tool touches SB 29 in the same way. The closer a feature gets to watching an individual student in real time, the more care it needs. Our guide on web filtering vs monitoring vs classroom management explains the tool types.
| Tool or feature | SB 29 sensitivity | Typical basis | Practical step |
|---|---|---|---|
| Network or DNS category filtering | Lower | CIPA, federal law and funding program | Describe it in the annual notice. Keep per-student logs only if you need them. |
| Device-level filter on take-home devices | Medium | CIPA, as browsing on a school-issued device is involved | Name it in the annual notice and limit who can view student histories. |
| Teacher screen view during class | Medium | Educational purpose, with advance notice | Limit to class time and staff, and say so in the notice. |
| Keystroke or content alerting | Higher | Depends on purpose; review with counsel | Document the exception relied on and the event notice process. |
| Location lookup | Higher | Missing or stolen device, or safety threat | Restrict to named staff and log each use for the 72 hour notice. |
| Camera or microphone access | Higher | Narrow exceptions only | Disable remote activation by default in device management. |
For devices that leave school, see how to enforce CIPA on off-campus student devices. Filtering by category at the DNS layer, as in a CIPA DNS filter for education, blocks content without recording keystrokes or screens.
How common classroom services are labelled in our category data
SB 29 treats student cloud accounts as part of the school-issued device, so a notice often names the services behind them. These are the categories our database gives a few well-known ones.
| Domain | Categories in our data | Filtering note |
|---|---|---|
| office.com | Web-based Applications | Account sign-in service that most schools allow |
| canva.com | Web-based Applications, AI / LLM Tools | Design tool that also carries an AI label |
| kahoot.com | Education/Reference, Webinars/E-learning | Classroom quizzes, usually allowed |
| clever.com | Education/Reference | Single sign-on for learning apps |
| zoom.us | Webinars/E-learning, Web-based Applications, Business | Three labels for video lessons and meetings |
Ohio cell phone policy law for schools
Phone rules sit in a different part of the Revised Code, section 3313.753. They concern students' personal phones, not school-issued devices, but they change where students go online during the day.
HB 250 signed. Districts must adopt a policy limiting student cell phone use, with a state model policy available.
Deadline for the HB 250 policy, with access kept for health needs and IEPs.
Budget bill HB 96 changes take effect, moving to a ban on use during the instructional day.
Policies prohibiting student cell phone use during the instructional day due, with listed exceptions.
With personal phones put away, more student browsing happens on school-issued devices, which are covered by both your filter and SB 29. That makes clear annual notices more important, not less.
Ohio SB 29 school compliance checklist
Grouped by when the work happens. Ticks are only for your current session.
Before the school year
Ongoing
When an exception is used
Evidence to keep for SB 29 and CIPA
If a parent, board member or auditor asks, you should be able to show both that you filter and that you only look where the law allows.
Two ways to meet CIPA on Ohio school-issued devices
The comparison uses the tool types listed in the SB 29 table earlier on the page.
| SB 29 consideration | Hosted CIPA filter | Heavier device-level tool |
|---|---|---|
| Features to describe in the annual notice | Web filtering by domain category | Possibly screens, keystrokes or alerts as well |
| Software to review on the device | None installed | An agent or extension to evaluate |
| Take-home school devices | Private encrypted link applies the same rules | Depends on the product |
| Adult staff research under CIPA | PIN bypass for 15, 30 or 60 minutes, logged, then it reverts | Often a manual filter change |
| Proof for a parent or auditor | Policy record, activity reports and log export | Varies by tool |
| Several schools in one district | Separate settings per school in one console | Separate set-ups per site |
Ohio SB 29 and school web filtering FAQ
Does Ohio SB 29 stop schools from filtering the web?
SB 29 limits access to and monitoring of school-issued devices, including browsing, but it lists exceptions. One covers activity needed to comply with federal or state law, and districts commonly rely on it for CIPA filtering. Confirm your reading with counsel.
When did Ohio SB 29 take effect?
October 24, 2024. It enacted Revised Code sections 3319.325, 3319.326 and 3319.327.
What notices does SB 29 require?
A district that generally monitors devices under an exception gives parents a written notice for that year. District notices also describe a written parent notice within 72 hours after certain event-based access. There are also notice duties about provider contracts. Check the statute for exact timing.
What counts as a school-issued device?
Hardware, software, devices and accounts a district provides to an individual student for personal use. Student cloud accounts can be included.
Is the Ohio cell phone rule part of SB 29?
No. It sits in Revised Code 3313.753. HB 250 required a policy in 2024, and HB 96 in 2025 required a ban on use during the instructional day, with adoption due by January 1, 2026.
Does SB 29 apply to the guest Wi-Fi?
SB 29 focuses on school-issued devices. Filtering personal devices on guest Wi-Fi is a separate question, though it still belongs in your acceptable use policy.
Do community and STEM schools face the same rules?
SB 29 is written around school districts and their providers, while the cell phone law expressly reaches community and STEM schools. If you run a community or STEM school, ask counsel how SB 29 applies to you and follow the same notice habits either way.
Can we keep using our current monitoring product?
Usually yes, if each enabled feature fits an exception and your notices describe it. The common fix is configuration: turn off what you cannot justify, shorten retention and log every event-based access.
Does a teacher looking at screens in class count?
Screen viewing touches student interactions on the device. District notices usually place it under the educational purpose exception, with advance notice. Keep it to class time and to staff with a teaching reason.
Should we block AI chat tools on school devices?
That is a local decision. Blocking by category does not require reading what students type. See our AI tools blocklist for schools.
Compare school internet rules in other states
More states are covered on our school internet safety laws by state page.
Related guides
- Student Online Monitoring: What Schools Can and Cannot See
- Explaining Web Filtering to Parents: Letters, FAQs, Clear Limits
- Presenting Web Filtering to the School Board: Budget, Risk, Metrics
- West Virginia School Internet Safety Laws: Policy 2460
- Michigan School Internet Safety Laws: CIPA, SOPPA and Phones
We quote on the number of schools and devices in your Ohio district and reply within one business day. A pilot on a single site lets you review the blocks and reports before deciding.
Talk to us about your Ohio district
Tell us which monitoring features you run and which you could switch off. We will show how category filtering from our CIPA data and the hosted CIPA filter pilot can cover CIPA with less device-level watching.